Skip to content

Instantly share code, notes, and snippets.

@madordie
Last active September 1, 2020 08:44
Show Gist options
  • Save madordie/4534902a8aa1364b27027055ee7a845e to your computer and use it in GitHub Desktop.
Save madordie/4534902a8aa1364b27027055ee7a845e to your computer and use it in GitHub Desktop.
__int64 __fastcall __CFStringComputeEightBitStringEncoding(__int64 a1, __int64 a2)
{
unsigned int v2; // ebx
char v3; // al
__int64 v4; // rdx
__int64 v5; // rcx
unsigned int v7; // eax
unsigned int v8; // er14
int v9; // eax
__int64 v10; // rax
v2 = 1536;
if ( !__CFStringComputeEightBitStringEncoding___CFStringIsBeingInitialized2 )
{
__CFStringComputeEightBitStringEncoding___CFStringIsBeingInitialized2 = 1;
v3 = _CFExecutableLinkedOnOrAfter(9LL);
__CFStringComputeEightBitStringEncoding___CFStringIsBeingInitialized2 = 0;
if ( v3 )
{
__CFDefaultEightBitStringEncoding = 1536;
return v2;
}
v2 = 0;
if ( __CFIsReadyToInitializeSystemEncoding == 1 && !(__CFStringIsBeingInitialized & 1) )
{
v2 = __CFDefaultEightBitStringEncoding;
if ( __CFDefaultEightBitStringEncoding == -1 )
{
v7 = CFStringGetSystemEncoding(9LL, a2, v4, v5);
v2 = 1536;
if ( v7 != -1 )
{
v8 = v7;
v9 = v7 & 0xFFF;
if ( v9 <= 1279 )
{
if ( v9 )
{
if ( v9 == 256 )
goto LABEL_22;
if ( v9 != 513 )
goto LABEL_20;
}
}
else
{
if ( v9 <= 2816 )
{
if ( v9 == 1280 || v9 == 1536 )
goto LABEL_23;
LABEL_20:
v10 = CFStringEncodingGetConverter(v8);
if ( !v10 || *(_BYTE *)(v10 + 20) == 1 )
goto LABEL_23;
goto LABEL_22;
}
if ( v9 != 2817 )
{
if ( v9 != 3071 )
goto LABEL_20;
LABEL_22:
v8 = 1536;
goto LABEL_23;
}
}
LABEL_23:
__CFDefaultEightBitStringEncoding = v8;
return v8;
}
}
}
}
return v2;
}
unsigned __int64 __fastcall __CFStringCreateImmutableFunnel3(malloc_zone_t *a1, const __m128i *a2, unsigned __int64 a3, __int64 a4, char a5, __int64 a6, __int64 a7, bool a8, char a9, __objc2_class **a10, int a11)
{
char v11; // r12
unsigned int v12; // er15
unsigned __int64 v13; // r13
__objc2_class **v14; // r8
char v15; // r14
int v16; // eax
char v17; // r11
signed __int64 v18; // r15
__int64 v19; // rax
_BOOL8 v20; // r12
unsigned __int64 v21; // r11
char *v22; // rbx
__objc2_class **v23; // r12
signed int v24; // ecx
__objc2_class **v25; // r14
malloc_zone_t *v26; // rax
unsigned __int64 v27; // r13
__objc2_class **v28; // rbx
char v29; // r14
signed __int64 v30; // rcx
unsigned __int64 v31; // rbx
__int64 v32; // rax
char *v33; // r12
__objc2_class **v34; // r14
__int64 v35; // rax
signed __int64 v36; // r13
unsigned __int64 v37; // rsi
unsigned __int64 v38; // rsi
unsigned __int64 v39; // rax
unsigned __int64 v40; // rcx
unsigned __int64 v41; // rdx
signed __int64 i; // rsi
signed int v43; // ecx
signed int v44; // ecx
unsigned __int64 v45; // rax
const __m128i *v46; // rcx
__m128i v47; // xmm1
__int64 v48; // rsi
bool v49; // zf
unsigned __int64 v50; // rsi
__int64 v51; // rdx
__m128i v52; // xmm0
__m128i v53; // xmm2
__m128i v54; // xmm2
__m128i v55; // xmm1
__m128i v56; // xmm2
unsigned __int64 v57; // r14
char v58; // r14
__objc2_class **v59; // r12
signed __int64 v60; // rcx
__int64 v61; // rdx
char v62; // bl
char v63; // r15
char v64; // cl
signed __int64 v65; // rax
malloc_zone_t **v66; // rax
signed __int64 v67; // rcx
signed __int64 v68; // rsi
signed __int64 v69; // rax
signed __int64 v70; // rtt
signed __int64 v71; // rax
signed __int64 v72; // rtt
signed __int64 v73; // rax
signed __int64 v74; // rtt
signed __int64 v75; // rax
signed __int64 v76; // rtt
_BYTE **v77; // rax
_BYTE *v78; // r14
unsigned __int64 result; // rax
__int64 v80; // rsi
bool v81; // sf
char v82; // [rsp+Ch] [rbp-484h]
char v83; // [rsp+10h] [rbp-480h]
unsigned __int64 v84; // [rsp+10h] [rbp-480h]
bool v85; // [rsp+18h] [rbp-478h]
signed int v86; // [rsp+20h] [rbp-470h]
size_t v87; // [rsp+30h] [rbp-460h]
size_t v88; // [rsp+30h] [rbp-460h]
size_t v89; // [rsp+30h] [rbp-460h]
char v90; // [rsp+38h] [rbp-458h]
__objc2_class **v91; // [rsp+38h] [rbp-458h]
char *v92; // [rsp+38h] [rbp-458h]
bool v93; // [rsp+47h] [rbp-449h]
__int64 v94; // [rsp+48h] [rbp-448h]
unsigned __int64 v95; // [rsp+50h] [rbp-440h]
char v96; // [rsp+58h] [rbp-438h]
char v97; // [rsp+59h] [rbp-437h]
malloc_zone_t *v98; // [rsp+60h] [rbp-430h]
__int64 v99; // [rsp+68h] [rbp-428h]
char v100; // [rsp+70h] [rbp-420h]
__int64 v101; // [rsp+460h] [rbp-30h]
v11 = a6;
v90 = a5;
v12 = a4;
v13 = (unsigned __int64)a2;
v87 = a3;
if ( !a1 )
{
a1 = (malloc_zone_t *)_CFGetTSD(1LL);
if ( !a1 )
a1 = kCFAllocatorSystemDefault;
a3 = v87;
}
v14 = (__objc2_class **)a1;
if ( a10 != (__objc2_class **)-1LL )
{
if ( a10 )
{
v14 = a10;
}
else
{
v14 = (__objc2_class **)_CFGetTSD(1LL);
if ( !v14 )
v14 = (__objc2_class **)kCFAllocatorSystemDefault;
a3 = v87;
}
}
LOBYTE(a6) = a9;
if ( !a3 )
{
if ( kCFAllocatorSystemDefault == a1
|| (!a1 || (malloc_zone_t *)kCFAllocatorDefault == a1)
&& (v25 = v14,
v26 = (malloc_zone_t *)CFAllocatorGetDefault(a1, a2, 0LL, a4, v14, a6),
LOBYTE(a6) = a9,
a3 = v87,
v14 = v25,
kCFAllocatorSystemDefault == v26) )
{
if ( (_BYTE)a6 && v14 != kCFAllocatorNull )
CFAllocatorDeallocate(v14);
v27 = CFRetain(&stru_3D4430);
goto LABEL_172;
}
}
v97 = 0;
if ( v12 != 256 )
{
v16 = __CFDefaultEightBitStringEncoding;
if ( __CFDefaultEightBitStringEncoding == -1 )
{
v28 = v14;
v29 = a6;
__CFStringComputeEightBitStringEncoding(a1, a2, a3, a4, v14, a6);
LOBYTE(a6) = v29;
a3 = v87;
v14 = v28;
v16 = __CFDefaultEightBitStringEncoding;
if ( v12 == 1536 )
goto LABEL_47;
}
else if ( v12 == 1536 )
{
goto LABEL_47;
}
if ( v16 == v12 )
{
LABEL_17:
v15 = 1;
goto LABEL_18;
}
LABEL_47:
v15 = 0;
switch ( (unsigned __int16)(v12 & 0xFF00) >> 8 )
{
case 0:
v15 = 0;
if ( v12 > 0x22 || (v30 = 25769803826LL, !_bittest64(&v30, v12)) )
{
if ( v12 != 152 )
break;
}
goto LABEL_18;
case 1:
if ( v12 != 134217984 )
goto LABEL_13;
break;
case 2:
if ( v12 == 518 )
goto LABEL_13;
break;
case 6:
if ( v12 != 1536 )
goto LABEL_13;
break;
case 8:
case 12:
goto LABEL_18;
case 10:
if ( v12 - 2561 <= 0xF )
{
v43 = 32785;
if ( _bittest(&v43, v12 - 2561) )
goto LABEL_13;
}
break;
case 11:
if ( v12 - 3059 <= 0xC )
{
v44 = 4099;
if ( _bittest(&v44, v12 - 3059) )
goto LABEL_13;
}
break;
default:
if ( (v12 & 0xFF00) > 0xC00 )
goto LABEL_13;
break;
}
v45 = a3;
v46 = a2;
while ( v45 > 0x1F )
{
v47 = _mm_or_si128(_mm_loadu_si128(v46 + 1), _mm_loadu_si128(v46));
v46 += 2;
v45 -= 32LL;
if ( *(_OWORD *)&_mm_or_si128(_mm_shuffle_epi32(v47, 78), v47) & 0x8080808080808080LL )
goto LABEL_13;
}
v15 = 0;
while ( v45 > 0xF )
{
v48 = v46->m128i_i64[0] | v46->m128i_i64[1];
v45 -= 16LL;
++v46;
if ( v48 & 0x8080808080808080LL )
goto LABEL_18;
}
v15 = 0;
while ( v45 > 7 )
{
v45 -= 8LL;
v49 = (v46->m128i_i64[0] & 0x8080808080808080LL) == 0;
v46 = (const __m128i *)((char *)v46 + 8);
if ( !v49 )
goto LABEL_18;
}
v15 = 0;
while ( v45 > 3 )
{
v45 -= 4LL;
v49 = (v46->m128i_i64[0] & 0x80808080) == 0;
v46 = (const __m128i *)((char *)v46 + 4);
if ( !v49 )
goto LABEL_18;
}
v80 = 0LL;
v15 = 0;
while ( v45 != v80 )
{
v81 = *((_BYTE *)v46->m128i_i64 + v80++) < 0;
if ( v81 )
goto LABEL_18;
}
goto LABEL_17;
}
LABEL_13:
v15 = 0;
LABEL_18:
v17 = a7;
v85 = a8;
if ( (v12 != 256 || v90 == 0) && (unsigned __int8)v15 | (v12 == 256) )
{
if ( v12 != 256 )
{
v86 = v12;
goto LABEL_61;
}
if ( !v11 )
{
v86 = 256;
goto LABEL_61;
}
v86 = 256;
v18 = a3 >> 1;
if ( a3 >> 1 )
{
v19 = 0LL;
while ( *(_WORD *)(v13 + 2 * v19) <= 0x7Fu )
{
if ( ++v19 >= (unsigned __int64)v18 )
goto LABEL_26;
}
goto LABEL_61;
}
LABEL_26:
v93 = a3 < 0x200;
v20 = a3 < 0x200;
v21 = v18 + v20 + 1;
if ( v21 < 0x3F0 )
{
v22 = &v100;
}
else
{
v91 = v14;
v22 = (char *)CFAllocatorAllocate(a1, v18 + v20 + 1, 0LL);
if ( __CFOASafe )
__CFSetLastAllocationEventName(v22, "CFString (store)");
v14 = v91;
a3 = v87;
LOBYTE(a6) = a9;
v21 = v18 + v20 + 1;
if ( !v22 )
{
a3 = v18 + v20 + 1;
v17 = a7;
goto LABEL_61;
}
}
v92 = v22;
v39 = (unsigned __int64)v22;
if ( a3 <= 0x1FF )
{
v39 = (unsigned __int64)(v22 + 1);
*v22 = v18;
}
if ( v18 )
{
if ( a3 < 0x20 || v39 < v13 + (a3 & 0xFFFFFFFFFFFFFFFELL) && v39 + v18 > v13 )
{
v40 = 0LL;
LABEL_88:
v41 = v18 + ~v40;
for ( i = v18 & 3; i; --i )
{
*(_BYTE *)(v39 + v40) = *(_BYTE *)(v13 + 2 * v40);
++v40;
}
if ( v41 >= 3 )
{
do
{
*(_BYTE *)(v39 + v40) = *(_BYTE *)(v13 + 2 * v40);
*(_BYTE *)(v39 + v40 + 1) = *(_BYTE *)(v13 + 2 * v40 + 2);
*(_BYTE *)(v39 + v40 + 2) = *(_BYTE *)(v13 + 2 * v40 + 4);
*(_BYTE *)(v39 + v40 + 3) = *(_BYTE *)(v13 + 2 * v40 + 6);
v40 += 4LL;
}
while ( v18 != v40 );
}
goto LABEL_130;
}
v40 = v18 & 0xFFFFFFFFFFFFFFF0LL;
if ( (v18 & 0xFFFFFFFFFFFFFFF0LL) == 16 )
{
v51 = 0LL;
}
else
{
v50 = (((v18 & 0xFFFFFFFFFFFFFFF0LL) - 16) >> 4)
+ 1
- (((unsigned __int8)(((v18 & 0xFFFFFFFFFFFFFFF0LL) - 16) >> 4) + 1) & 1);
v51 = 0LL;
v52 = _mm_load_si128((const __m128i *)&xmmword_2B59F0);
do
{
v53 = _mm_loadu_si128((const __m128i *)(v13 + 2 * v51 + 16));
_mm_storel_epi64(
(__m128i *)(v39 + v51),
_mm_shuffle_epi8(_mm_loadu_si128((const __m128i *)(v13 + 2 * v51)), v52));
_mm_storel_epi64((__m128i *)(v39 + v51 + 8), _mm_shuffle_epi8(v53, v52));
v54 = _mm_loadu_si128((const __m128i *)(v13 + 2 * v51 + 48));
_mm_storel_epi64(
(__m128i *)(v39 + v51 + 16),
_mm_shuffle_epi8(_mm_loadu_si128((const __m128i *)(v13 + 2 * v51 + 32)), v52));
_mm_storel_epi64((__m128i *)(v39 + v51 + 24), _mm_shuffle_epi8(v54, v52));
v51 += 32LL;
v50 -= 2LL;
}
while ( v50 );
}
if ( ((unsigned __int8)(((v18 & 0xFFFFFFFFFFFFFFF0LL) - 16) >> 4) + 1) & 1 )
{
v55 = _mm_loadu_si128((const __m128i *)(v13 + 2 * v51 + 16));
v56 = _mm_load_si128((const __m128i *)&xmmword_2B59F0);
_mm_storel_epi64(
(__m128i *)(v39 + v51),
_mm_shuffle_epi8(_mm_loadu_si128((const __m128i *)(v13 + 2 * v51)), v56));
_mm_storel_epi64((__m128i *)(v39 + v51 + 8), _mm_shuffle_epi8(v55, v56));
}
if ( v18 != v40 )
goto LABEL_88;
}
LABEL_130:
*(_BYTE *)(v39 + v18) = 0;
if ( (_BYTE)a6 && v14 != kCFAllocatorNull )
{
v57 = v21;
CFAllocatorDeallocate(v14);
v21 = v57;
}
LOBYTE(a6) = v21 > 0x3EF;
v85 = 1;
v86 = 1536;
a3 = v18 + v20;
v17 = v93;
v14 = (__objc2_class **)a1;
if ( !__CFTaggedStringClass )
goto LABEL_134;
goto LABEL_63;
}
v23 = v14;
LOBYTE(v94) = 0;
v98 = kCFAllocatorSystemDefault;
v95 = 0LL;
if ( !(unsigned __int8)__CFStringDecodeByteStream3((void *)(v13 + ((_BYTE)a7 != 0)), a11) )
{
v27 = 0LL;
goto LABEL_172;
}
v15 = v96;
v24 = 256;
if ( v96 )
v24 = 1536;
v86 = v24;
if ( (_BYTE)v94 )
{
v14 = v23;
a3 = v87;
LOBYTE(a6) = a9;
v17 = a7;
}
else
{
a3 = v99 << (v96 == 0);
if ( a9 && v23 != kCFAllocatorNull )
{
CFAllocatorDeallocate(v23);
a3 = v99 << (v96 == 0);
}
if ( !v97 || a1 != v98 || v96 != 0 )
{
v13 = v95;
LOBYTE(a6) = 0;
v14 = (__objc2_class **)a1;
v85 = 0;
}
else
{
v97 = 0;
v85 = 0;
v31 = a3;
v32 = __CFSafelyReallocateWithAllocator(a1, v95, a3, 0LL, 0LL);
a3 = v31;
v13 = v32;
LOBYTE(a6) = 1;
v14 = (__objc2_class **)a1;
}
v17 = 0;
}
LABEL_61:
v20 = v17 != 0;
v18 = a3 - v20;
v93 = v17 != 0;
v92 = (char *)v13;
if ( !v15 || !__CFTaggedStringClass )
goto LABEL_134;
LABEL_63:
v33 = &v92[v20];
if ( v18 > 7 )
{
if ( v18 <= 11 )
{
v35 = 0LL;
v36 = 0LL;
if ( v18 >= 10 )
{
while ( 1 )
{
v38 = charToSixBitLookup[(unsigned __int8)v33[v35]];
if ( v38 > 0x1F )
break;
v36 = v38 | 32 * v36;
if ( ++v35 >= v18 )
{
LABEL_73:
v27 = objc_debug_taggedpointer_obfuscator ^ ((v18 | 16 * v36) & 0xFFFFFFFFFFFFFFFLL | 0xA000000000000000LL);
if ( v27 )
goto LABEL_76;
break;
}
}
}
else
{
while ( 1 )
{
v37 = charToSixBitLookup[(unsigned __int8)v33[v35]];
if ( v37 > 0x3F )
break;
v36 = v37 | (v36 << 6);
if ( ++v35 >= v18 )
goto LABEL_73;
}
}
}
}
else
{
v82 = v17;
v83 = a6;
v88 = a3;
v34 = v14;
v94 = 0LL;
__memmove_chk(&v94, v33, v18, 8LL);
if ( v94 & 0x8080808080808080LL )
{
v14 = v34;
a3 = v88;
LOBYTE(a6) = v83;
v17 = v82;
}
else
{
v27 = objc_debug_taggedpointer_obfuscator ^ ((v18 | 16 * v94) & 0xFFFFFFFFFFFFFFFLL | 0xA000000000000000LL);
v14 = v34;
a3 = v88;
LOBYTE(a6) = v83;
v17 = v82;
if ( v27 )
{
LABEL_76:
if ( !(_BYTE)a6 || v14 == kCFAllocatorNull )
goto LABEL_170;
CFAllocatorDeallocate(v14);
if ( !v97 )
goto LABEL_172;
goto LABEL_171;
}
}
}
LABEL_134:
v89 = a3;
v84 = v18;
if ( (_BYTE)a6 )
{
v58 = a6;
v59 = v14;
v60 = 8LL;
if ( v14 != (__objc2_class **)a1 )
v60 = 8LL * (v14 != kCFAllocatorNull) + 8;
v61 = v60 + 8;
v62 = v17;
if ( v17 )
v61 = v60;
v63 = 0;
}
else
{
if ( v93 || (v64 = 0, v65 = 8LL, (signed __int64)a3 <= 255) && v86 != 256 )
{
v65 = v17 == 0;
v64 = 1;
}
v58 = 0;
v59 = v14;
v85 = v85 != 0 || v86 != 256;
v61 = a3 + v65 + v85;
v63 = 1;
v62 = v64;
}
v66 = _CFRuntimeCreateInstance(a1, 7uLL, v61, 0LL);
if ( !v66 )
{
v27 = 0LL;
if ( v58 )
{
if ( v59 != kCFAllocatorNull )
{
CFAllocatorDeallocate(v59);
v27 = 0LL;
}
LABEL_170:
if ( !v97 )
goto LABEL_172;
goto LABEL_171;
}
if ( !v97 )
goto LABEL_172;
LABEL_171:
CFAllocatorDeallocate(v98);
goto LABEL_172;
}
v27 = (unsigned __int64)v66;
if ( __CFOASafe )
__CFSetLastAllocationEventName(v66, "CFString (immutable)");
if ( v59 == (__objc2_class **)a1 )
v67 = 32LL;
else
v67 = 32LL * (v59 != kCFAllocatorNull) | 0x40;
v68 = 0LL;
v69 = *(_QWORD *)(v27 + 8);
if ( !v63 )
v68 = v67;
do
{
v70 = v69;
v69 = _InterlockedCompareExchange((volatile signed __int64 *)(v27 + 8), v68 | v69 & 0xFFFFFFFFFFFFFF9FLL, v69);
}
while ( v70 != v69 );
v71 = *(_QWORD *)(v27 + 8);
do
{
v72 = v71;
v71 = _InterlockedCompareExchange(
(volatile signed __int64 *)(v27 + 8),
16LL * (v86 == 256) | v71 & 0xFFFFFFFFFFFFFFEFLL,
v71);
}
while ( v72 != v71 );
v73 = *(_QWORD *)(v27 + 8);
do
{
v74 = v73;
v73 = _InterlockedCompareExchange(
(volatile signed __int64 *)(v27 + 8),
8LL * (v85 != 0) | v73 & 0xFFFFFFFFFFFFFFF7LL,
v73);
}
while ( v74 != v73 );
v75 = *(_QWORD *)(v27 + 8);
do
{
v76 = v75;
v75 = _InterlockedCompareExchange(
(volatile signed __int64 *)(v27 + 8),
4LL * (v62 != 0) | v75 & 0xFFFFFFFFFFFFFFFBLL,
v75);
}
while ( v76 != v75 );
if ( v62 )
{
if ( v63 )
goto LABEL_165;
goto LABEL_168;
}
*(_QWORD *)(v27 + 8LL * ((*(_QWORD *)(v27 + 8) & 0x60) != 0) + 16) = v84 >> (v86 == 256);
if ( !v63 )
{
LABEL_168:
*(_QWORD *)(v27 + 16) = v92;
if ( (*(_QWORD *)(v27 + 8) & 0x60LL) == 96 )
{
CFRetain(v59);
*(_QWORD *)(v27 + 8LL * ((*(_QWORD *)(v27 + 8) & 5LL) != 4) + 24) = v59;
}
goto LABEL_170;
}
LABEL_165:
v77 = (_BYTE **)(v27 + 16);
if ( *(_QWORD *)(v27 + 8) & 0x60 )
v78 = *v77;
else
v78 = &v77[(*(_QWORD *)(v27 + 8) & 5LL) != 4];
if ( v62 != 0 && !v93 )
*v78++ = v89;
memmove(v78, v92, v89);
if ( v85 )
v78[v89] = 0;
if ( v97 )
goto LABEL_171;
LABEL_172:
result = __stack_chk_guard;
if ( __stack_chk_guard == v101 )
result = v27;
return result;
}
@madordie
Copy link
Author

madordie commented Sep 1, 2020

// main.mm:95
            self.xxx = [NSString stringWithFormat:@"123"];
(lldb) breakpoint set --name "__CFStringCreateImmutableFunnel3"
Breakpoint 10: where = CoreFoundation`__CFStringCreateImmutableFunnel3, address = 0x00007fff2fbc33e8
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 10.1
  * frame #0: 0x00007fff2fbc33e8 CoreFoundation`__CFStringCreateImmutableFunnel3
    frame #1: 0x00007fff2fbca56c CoreFoundation`_CFNonObjCStringCreateCopy + 364
    frame #2: 0x00007fff2fbeee9c CoreFoundation`_CFStringCreateWithFormatAndArgumentsAux2 + 165
    frame #3: 0x00007fff32298e20 Foundation`+[NSString stringWithFormat:] + 153
    frame #4: 0x0000000100001c01 debug-objc`main(argc=1, argv=0x00007ffeefbff480) at main.mm:95:24
    frame #5: 0x00007fff69cf2cc9 libdyld.dylib`start + 1
(lldb) finish
(lldb) register read rax
     rax = 0x74870ab850ec45f9
(lldb) po 0x74870ab850ec45f9
123

(lldb) po [(id)0x74870ab850ec45f9 class]
NSTaggedPointerString

(lldb) 

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment