You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.md
CF\* objects come from CoreFOundation, which provides more than 50 classes of objects like `CFString`, `CFNumber` or `CFAllocatior`.
7
+
CF* objects come from CoreFoundation, which provides more than 50 classes of objects like `CFString`, `CFNumber` or `CFAllocator`.
8
8
9
-
All these clases are instances of the class `CFRuntimeClass`, which when called it returns an index to the `__CFRuntimeClassTable`. The CFRuntimeClass is defined in [**CFRuntime.h**](https://opensource.apple.com/source/CF/CF-1153.18/CFRuntime.h.auto.html):
9
+
All these classes are instances of the class `CFRuntimeClass`, which when called it returns an index to the `__CFRuntimeClassTable`. The CFRuntimeClass is defined in [**CFRuntime.h**](https://opensource.apple.com/source/CF/CF-1153.18/CFRuntime.h.auto.html):
-**`__objc_const`** (`...`): Class `r/o` data and other (hopefully) constant data
72
-
-**`__objc_imageinfo`** (`version, flags`): Used during image load: Version currently `0`; Flags specify preoptimized GC support, etc.
73
-
-**`__objc_protolist`** (`protocol_t *`): Protocol list
74
-
-**`__objc_nlcatlist`** (`category_t`): Pointer to Non-Lazy Categories defined in this binary
75
-
-**`__objc_catlist`** (`category_t`): Pointer to Categories defined in this binary
76
-
-**`__objc_nlclslist`** (`classref_t`): Pointer to Non-Lazy Objective-C classes defined in this binary
77
-
-**`__objc_classlist`** (`classref_t`): Pointers to all Objective-C classes defined in this binary
78
-
79
-
It also uses a few sections in the **`__TEXT`** segment to store constan values of it's not possible to write in this section:
80
-
81
-
-**`__objc_methname`** (C-String): Method names
82
-
-**`__objc_classname`** (C-String): Class names
83
-
-**`__objc_methtype`** (C-String): Method types
62
+
Most of the data used by Objective‑C runtime will change during execution, therefore it uses a number of sections from the Mach‑O `__DATA` family of segments in memory. Historically these included:
-`__objc_const` (`...`): Class r/o data and other (hopefully) constant data
72
+
-`__objc_imageinfo` (`version, flags`): Used during image load: Version currently `0`; Flags specify preoptimized GC support, etc.
73
+
-`__objc_protolist` (`protocol_t *`): Protocol list
74
+
-`__objc_nlcatlist` (`category_t`): Pointer to Non-Lazy Categories defined in this binary
75
+
-`__objc_catlist` (`category_t`): Pointer to Categories defined in this binary
76
+
-`__objc_nlclslist` (`classref_t`): Pointer to Non-Lazy Objective‑C classes defined in this binary
77
+
-`__objc_classlist` (`classref_t`): Pointers to all Objective‑C classes defined in this binary
78
+
79
+
It also uses a few sections in the `__TEXT` segment to store constants:
80
+
81
+
-`__objc_methname` (C‑String): Method names
82
+
-`__objc_classname` (C‑String): Class names
83
+
-`__objc_methtype` (C‑String): Method types
84
+
85
+
Modern macOS/iOS (especially on Apple Silicon) also place Objective‑C/Swift metadata in:
86
+
87
+
-`__DATA_CONST`: immutable Objective‑C metadata that can be shared read‑only across processes (for example many `__objc_*` lists now live here).
88
+
-`__AUTH` / `__AUTH_CONST`: segments containing pointers that must be authenticated at load or use‑time on arm64e (Pointer Authentication). You will also see `__auth_got` in `__AUTH_CONST` instead of the legacy `__la_symbol_ptr`/`__got` only. When instrumenting or hooking, remember to account for both `__got` and `__auth_got` entries in modern binaries.
89
+
90
+
For background on dyld pre‑optimization (e.g., selector uniquing and class/protocol precomputation) and why many of these sections are "already fixed up" when coming from the shared cache, check the Apple `objc-opt` sources and dyld shared cache notes. This affects where and how you can patch metadata at runtime.
Objective-c uses some mangling to encode selector and variable types of simple and complex types:
98
+
Objective‑C uses mangling to encode selector and variable types of simple and complex types:
88
99
89
-
- Primitive types use their first letter of the type `i` for `int`, `c` for `char`, `l` for `long`... and uses the capital letter in case it's unsigned (`L` for `unsigned Long`).
90
-
- Other data types whose letters are used or are special, use other letters or symbols like `q` for `long long`, `b` for `bitfields`, `B` for `booleans`, `#` for `classes`, `@` for `id`, `*` for `char pointers`, `^` for generic `pointers` and `?` for `undefined`.
91
-
- Arrays, structures and unions use `[`, `{` and `(`
100
+
- Primitive types use their first letter of the type `i` for `int`, `c` for `char`, `l` for `long`... and use the capital letter in case it's unsigned (`L` for `unsigned long`).
101
+
- Other data types use other letters or symbols like `q` for `long long`, `b` for bitfields, `B` for booleans, `#` for classes, `@` for `id`, `*` for `char *`, `^` for generic pointers and `?` for undefined.
102
+
- Arrays, structures and unions use `[`, `{` and `(` respectively.
92
103
93
104
#### Example Method Declaration
94
105
@@ -111,18 +122,18 @@ The complete type encoding for the method is:
111
122
112
123
#### Detailed Breakdown
113
124
114
-
1.**Return Type (`NSString *`)**: Encoded as `@` with length 24
115
-
2.**`self` (object instance)**: Encoded as `@`, at offset 0
116
-
3.**`_cmd` (selector)**: Encoded as `:`, at offset 8
117
-
4.**First argument (`char * input`)**: Encoded as `*`, at offset 16
118
-
5.**Second argument (`NSDictionary * options`)**: Encoded as `@`, at offset 20
119
-
6.**Third argument (`NSError ** error`)**: Encoded as `^@`, at offset 24
125
+
1. Return Type (`NSString *`): Encoded as `@` with length 24
126
+
2.`self` (object instance): Encoded as `@`, at offset 0
127
+
3.`_cmd` (selector): Encoded as `:`, at offset 8
128
+
4. First argument (`char * input`): Encoded as `*`, at offset 16
129
+
5. Second argument (`NSDictionary * options`): Encoded as `@`, at offset 20
130
+
6. Third argument (`NSError ** error`): Encoded as `^@`, at offset 24
120
131
121
-
**With the selector + the encoding you can reconstruct the method.**
132
+
With the selector + the encoding you can reconstruct the method.
122
133
123
-
### **Classes**
134
+
### Classes
124
135
125
-
Clases in Objective-C is a struct with properties, method pointers... It's possible to find the struct `objc_class` in the [**source code**](https://opensource.apple.com/source/objc4/objc4-756.2/runtime/objc-runtime-new.h.auto.html):
136
+
Classes in Objective‑C are C structs with properties, method pointers, etc. It's possible to find the struct `objc_class` in the [**source code**](https://opensource.apple.com/source/objc4/objc4-756.2/runtime/objc-runtime-new.h.auto.html):
This class use some bits of the isa field to indicate some information about the class.
159
+
This class uses some bits of the `isa` field to indicate information about the class.
149
160
150
-
Then, the struct has a pointer to the struct `class_ro_t` stored on disk which contains attributes of the class like its name, base methods, properties and instance variables.\
151
-
During runtime and additional structure `class_rw_t` is used containing pointers which can be altered such as methods, protocols, properties...
161
+
Then, the struct has a pointer to the struct `class_ro_t` stored on disk which contains attributes of the class like its name, base methods, properties and instance variables. During runtime an additional structure `class_rw_t` is used containing pointers which can be altered such as methods, protocols, properties.
## Modern object representations in memory (arm64e, tagged pointers, Swift)
170
+
171
+
### Non‑pointer `isa` and Pointer Authentication (arm64e)
172
+
173
+
On Apple Silicon and recent runtimes the Objective‑C `isa` is not always a raw class pointer. On arm64e it is a packed structure that may also carry a Pointer Authentication Code (PAC). Depending on the platform it may include fields like `nonpointer`, `has_assoc`, `weakly_referenced`, `extra_rc`, and the class pointer itself (shifted or signed). This means blindly dereferencing the first 8 bytes of an Objective‑C object will not always yield a valid `Class` pointer.
174
+
175
+
Practical notes when debugging on arm64e:
176
+
177
+
- LLDB will usually strip PAC bits for you when printing Objective‑C objects with `po`, but when working with raw pointers you may need to strip authentication manually:
- Many function/data pointers in Mach‑O will reside in `__AUTH`/`__AUTH_CONST` and require authentication before use. If you are interposing or re‑binding (e.g., fishhook‑style), ensure you also handle `__auth_got` in addition to legacy `__got`.
186
+
187
+
For a deep dive into language/ABI guarantees and the `<ptrauth.h>` intrinsics available from Clang/LLVM, see the reference in the end of this page.
188
+
189
+
### Tagged pointer objects
190
+
191
+
Some Foundation classes avoid heap allocation by encoding the object’s payload directly in the pointer value (tagged pointers). Detection differs by platform (e.g., the most‑significant bit on arm64, least‑significant on x86_64 macOS). Tagged objects don’t have a regular `isa` stored in memory; the runtime resolves the class from the tag bits. When inspecting arbitrary `id` values:
192
+
193
+
- Use runtime APIs instead of poking the `isa` field: `object_getClass(obj)` / `[obj class]`.
194
+
- In LLDB, just `po (id)0xADDR` will print tagged pointer instances correctly because the runtime is consulted to resolve the class.
195
+
196
+
### Swift heap objects and metadata
197
+
198
+
Pure Swift classes are also objects with a header pointing to Swift metadata (not Objective‑C `isa`). To introspect live Swift processes without modifying them you can use the Swift toolchain’s `swift-inspect`, which leverages the Remote Mirror library to read runtime metadata:
0 commit comments