Skip to content

Instantly share code, notes, and snippets.

@dnet
Created February 1, 2016 21:30
Show Gist options
  • Save dnet/a5cb558c45dcdcbfbd52 to your computer and use it in GitHub Desktop.
Save dnet/a5cb558c45dcdcbfbd52 to your computer and use it in GitHub Desktop.
ARM64 CFString decoder script for Hopper
import struct, re
doc = Document.getCurrentDocument()
sg = doc.getCurrentSegment()
addr = doc.getCurrentAddress()
i1 = sg.getInstructionAtAddress(addr)
if i1.getInstructionString() == 'adrp':
i2addr = addr + i1.getInstructionLength()
i2 = sg.getInstructionAtAddress(i2addr)
if i2.getInstructionString() in ('ldr', 'add'):
reg = i1.getRawArgument(0)
if reg in i2.getRawArgument(1):
base = int(i1.getRawArgument(1)[3:], 16)
obj = base + int(re.search(r'#0x([0-9a-f]+)', i2.getRawArgument(i2.getArgumentCount() - 1)).group(1), 16)
ds = doc.getSegmentAtAddress(obj)
meta = ''.join(chr(ds.readByte(obj + offset)) for offset in range(32))
a, b, chars, length = struct.unpack('<QQQQ', meta)
if b == 0x7c8:
ss = doc.getSegmentAtAddress(chars)
data = ''.join(chr(ss.readByte(chars + offset)) for offset in range(length))
if sg.getInlineCommentAtAddress(i2addr):
doc.log('Decoded string: ' + repr(data))
else:
sg.setInlineCommentAtAddress(i2addr, repr(data))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment