ARM64 CFString decoder script for Hopper

Decode ARM64 CFString.py

import struct, re

doc = Document.getCurrentDocument()

sg = doc.getCurrentSegment()
addr = doc.getCurrentAddress()

i1 = sg.getInstructionAtAddress(addr)

if i1.getInstructionString() == 'adrp':
    i2addr = addr + i1.getInstructionLength()
    i2 = sg.getInstructionAtAddress(i2addr)
    if i2.getInstructionString() in ('ldr', 'add'):
        reg = i1.getRawArgument(0)
        if reg in i2.getRawArgument(1):
            base = int(i1.getRawArgument(1)[3:], 16)
            obj = base + int(re.search(r'#0x([0-9a-f]+)', i2.getRawArgument(i2.getArgumentCount() - 1)).group(1), 16)
            ds = doc.getSegmentAtAddress(obj)
            meta = ''.join(chr(ds.readByte(obj + offset)) for offset in range(32))
            a, b, chars, length = struct.unpack('<QQQQ', meta)
            if b == 0x7c8:
                ss = doc.getSegmentAtAddress(chars)
                data = ''.join(chr(ss.readByte(chars + offset)) for offset in range(length))
                if sg.getInlineCommentAtAddress(i2addr):
                    doc.log('Decoded string: ' + repr(data))
                else:
                    sg.setInlineCommentAtAddress(i2addr, repr(data))