Skip to content

IDA plugin that resolves PPL calls to the actual underlying PPL function.

License

Notifications You must be signed in to change notification settings

cellebrite-labs/PPLorer

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 
 
 
 
 

Repository files navigation

PPLorer

PPLorer is an IDA plugin that resolves PPL calls to the actual underlying PPL function.

Installation

  1. install ida-netnode somewhere IDA can import it
  2. clone the repository and symlink ~/.idapro/plugins/pplorer.py to pplorer.py in the cloned repo

Usage

Preliminary Analysis

  1. open an IDB and make sure autoanalysis has finished
  2. from the menu select Edit -> Plugins -> PPLorer -> Analyse IDB
  3. done!

Continuous Use

TL;DR CTRL-SHIFT-X or Right Click -> Jump to PAC XREFs at suitable locations will open a selection window

From call site to PPL function

  1. place the cursor on a branch instruction instruction to the PPL gate (marked with a comment- "has xref to PPL").
  2. press the hotkey or activate the menu entry
  3. the matching PPL function will pop.

From PPL function to call sites

  1. place the cursors either the start address of a PPL function
  2. press the hotkey or activate the menu entry
  3. a list of possible call sites will open

Principals of Operation

PPL has a gate that all the calls from the kernel get to. Before that gate each separate call puts in a pre-determined register (X15) the selector of the PPL function it wants to call. The control will be transferred to the PPL dispatch which will check that a valid function was selected and will then go to the PPL functions table and call it. We find the dispatch, extract the size of the PPL functions table and its address. Then we detect all the calls to the gate from the kernel side, and get the PPL selector that is put in X15. For each call we match a function from the PPL table and for each function on the PPL table we add all the matching kernel calls.

Meta

Authored by Omer Porzecanski of Cellebrite Labs.
Based on pacXplorer by Ouri Lipner while at Cellebrite Labs.
Developed and tested for IDA 8 on OS X, iOS 15.X+ for A12+

I want to work with you

click here (Remote talent welcome)

About

IDA plugin that resolves PPL calls to the actual underlying PPL function.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages