Setting an Objective-C class as a Data Type

[nmggithub]

I'm reverse-engineering a binary with some Objective-C classes. Ghidra correctly find that much out and puts them in the symbol tree. However, there are places where a function takes in an instance of one of these classes as a parameter. Is there a way to create a data type that is an instance of one of these classes? Looking at how it's used, I can be fairly certain where one of the static members lives on the instance, so it seems each instance should have a defined structure. Can Ghidra automatically determine this?

[amomchilov]

It's not perfect, but I have two different approaches for doing this, depending on whether or not you care about the reads/writes directly to the object's instance variables (like _foo, rather than just calls to the foo and setFoo: property methods).

Approach 1: you don't need ivar info

If you don't care then I've made do by creating typedefs of void. In the Data Type Manager, I'd find ID under _objc2_, right click it, "New", "Typedef on void", and give it a name like NSFoo. Then I'd type variables as NSFoo * where I wanted.

Approach 2: you want to debug ivars

In the Data Type Manager, I would right click, "New", "Structure". I would give it the name like NSFoo. Each Objective C object starts with a Class isa field, followed by the instance variables. I use a combination of the headers and runtime type info (like class_getIvarLayout()) to get the names, sizes and offsets of the various ivars.

To check that I got them correct, I would find setter methods like setFoo: and setBar, and confirm that they're writing to self->_foo and self->_bar correctly (as opposed to some other field, due to incorrect offsets in my ivar definitions).

With the wealth of runtime metadata that's already baked into the binaries, this seems like something that could highly automated on import. Would be nice!