Naren Sirigere's blog

RTTI and Devirtualization in Objective-C

Wed, 17 Jun 2026 00:00:00 +0530

Object Model

Unlike C++, ObjC classes are runtime objects, not compile-time abstractions. The compiler emits class metadata into Mach-O sections (__objc_data, __objc_const) as struct objc_class:

struct objc_class {
 Class isa; // -> metaclass
 Class superclass; // -> parent class
 void *cache;
 uintptr_t bits; // class_rw_t / class_ro_t
};

superclass (offset +8): parent’s objc_class.
isa: points to the metaclass — a hidden class object whose instance methods are this class’s class methods (+alloc, etc). Metaclasses have their own superclass chain.
Symbols: _OBJC_CLASS_$_Dog, _OBJC_METACLASS_$_Dog.

objc_msgSendSuper2

[super speak] does not compile to objc_msgSend. Modern ARM64/Apple runtimes use objc_msgSendSuper2, passing a stack-allocated struct:

struct objc_super2 {
 id receiver; // self
 Class current_class; // class where the call site lives (Dog, not Animal)
};

At runtime, objc_msgSendSuper2 dereferences current_class->superclass and searches upward for the selector. current_class (not the superclass) is passed so the compiler avoids resolving the superclass statically — which means static analysis tools must reconstruct the inheritance edge themselves to devirtualize the call.

RTTI Recovery (`librz/arch/objc_rtti.c`)

1. Resolve superclass pointer of a metaclass symbol — read 8 bytes at vaddr+8, match against known symbol vaddrs:

static const RzBinSymbol *get_objc_superclass(RzCore *core,
 const RzPVector *symbols, const RzBinSymbol *meta_info) {
 ut64 addr;
 rz_io_nread_at(core->io, meta_info->vaddr + 8, (ut8 *)&addr, 8);
 void **it;
 rz_pvector_foreach (symbols, it) {
 RzBinSymbol *super_meta = *it;
 if (super_meta && super_meta->vaddr == addr)
 return super_meta;
 }
 return NULL;
}

2. Register the base-class edge — strip _OBJC_METACLASS_$_ prefix, call rz_analysis_class_base_set with offset 0 (ObjC single inheritance shares the base pointer):

static void add_objc_superclass(RzAnalysis *analysis, RzPVector *classes,
 RzBinSymbol *meta_class, const RzBinSymbol *meta_superclass) {
 if (!strstr(meta_superclass->name, "_OBJC_METACLASS_$_")) return;
 char *class_name = meta_class->name + strlen("_OBJC_METACLASS_$_");
 char *superclass_name = rz_str_dup(meta_superclass->name + strlen("_OBJC_METACLASS_$_"));
 RzAnalysisBaseClass base = { .class_name = superclass_name, .offset = 0 };
 rz_analysis_class_base_set(analysis, class_name, &base);
 rz_analysis_class_base_fini(&base);
}

3. Entry point — iterate all symbols, filter _OBJC_METACLASS_$_*, wire into rz_analysis_rtti_objc():

RZ_API void rz_analysis_rtti_objc(RZ_NULLABLE RzAnalysis *analysis) {
 if (!analysis) return;
 RzPVector *classes = rz_analysis_class_get_all(analysis, false);
 if (!classes) return;
 RzBinObject *o = rz_bin_cur_object(analysis->binb.bin);
 if (!o) return;
 const RzPVector *symbols = rz_bin_object_get_symbols(o);
 void **it;
 rz_pvector_foreach (symbols, it) {
 RzBinSymbol *sym = *it;
 if (!sym) continue;
 const RzBinSymbol *meta_superclass = NULL;
 if (strstr(sym->name, "_OBJC_METACLASS_$_"))
 meta_superclass = get_objc_superclass(analysis->core, symbols, sym);
 if (meta_superclass)
 add_objc_superclass(analysis, classes, sym, meta_superclass);
 }
 rz_pvector_free(classes);
}

Hooked into librz/arch/rtti.c dispatch:

case RZ_BIN_LANGUAGE_SWIFT:
 rz_analysis_rtti_swift(analysis);
 break;
+ case RZ_BIN_LANGUAGE_OBJC:
+ rz_analysis_rtti_objc(analysis);
+ // fallthrough

Result

[0x100000000]> aaa
[0x100000000]> acll
[Animal]
nth addr vt_offset type name
-----------------------------------------
1 0x100003e1c ---------- DEFAULT speak
[Dog: Animal]
nth addr vt_offset type name
-----------------------------------------
1 0x100003e48 ---------- DEFAULT speak

[Dog: Animal] — inheritance is now explicit in Rizin’s class DB.

Why It Matters

Devirtualizing objc_msgSendSuper2: given current_class at a call site, look up its base class and resolve the selector against the parent’s method list instead of leaving the call unresolved.
Override detection: directly see which subclasses override which parent methods.
Xref precision: a @selector(speak) call site can be narrowed to candidates within the relevant class hierarchy instead of matching every speak implementation in the binary.

The up-to-date DLang DMD Mangling Scheme *

Sat, 13 Jun 2026 00:00:00 +0530

An updated reference for the Dlang DMD name mangling ABI.

* At least up to 2026-06-13

Grammar Notation

This specification uses standard EBNF. Terminal characters are literal characters in the mangled string.

1. The Root Symbol

MangledName:
_D QualifiedName [ M ] [ Type ] [ Z ]

Note: M denotes a member function.

2. Names and Symbols

QualifiedName:
SymbolFunctionName { SymbolFunctionName }
SymbolFunctionName:
SymbolName [ M TypeModifier ] [ CallingConvention FuncAttrs (Parameters) ParamClose ]
SymbolName:
0
LName
BackRefSymbol
TemplateInstanceName
LName:
Number Name
0 // __anonymous
___S Number // Special anonymous symbol
Number:
Digit { Digit }
BackRefSymbol:
Q Base26Pos
Base26Pos:
{ UpperCaseAlpha } LowerCaseAlpha // Upper = A-Z (0-25), Lower = a-z (0-25, terminates)

3. Types and Modifiers

Type:
TypeModifiers Type
BasicType
DerivedType
FunctionType
DelegateType
VectorType
BackRefType
BasicType:
v | g | h | s | t | i | k | l | m | f | d | e | o | p | j | q | r | c | b | a | u | w | n | z i | z k
DerivedType:
A Type // Dynamic Array: Type[]
P Type // Pointer: Type*
G Number Type // Static Array: Type[Number]
H Type Type // Associative Array: Type[Type]
I QualifiedName // Identifier
C QualifiedName // Class
S QualifiedName // Struct
E QualifiedName // Enum
T QualifiedName // Typedef
B (Parameters) Z // Tuple
VectorType:
N h Type // __vector(Type)
BackRefType:
Q Base26Pos
TypeModifiers:
x // const
y // immutable
O // shared
O x // shared const
O N g // shared inout
O N g x // shared inout const
N g // inout
N g x // inout const

4. Functions and Delegates

CallingConvention:
F // D
U // C
W // Windows
R // C++
Y // Objective-C
FunctionType:
CallingConvention FuncAttrs (Parameters) ParamClose Type // (args) return_type
DelegateType:
D [ TypeModifiers ] [ CallingConvention ] FuncAttrs (Parameters) ParamClose Type

5. Function Attributes

FuncAttrs:
{ FuncAttr }
FuncAttr:
N a // pure
N b // nothrow
N c // ref
N d // @property
N e // @trusted
N f // @safe
N i // @nogc
N j // return
N j N l // return scope
N l // scope
N l N j // scope return
N m // @live

6. Parameters

Parameters:
{ Parameter }
Parameter:
[ ParamStorageClass ] Type
ParamStorageClass:
M N k J // scope return out
M N k K // scope return ref
N k J // return out
N k K // return ref
N k M J // return scope out
N k M K // return scope ref
N k M // return scope
M // scope
N k // return
I // in
I K // in ref
J // out
K // ref
L // lazy
ParamClose:
X // ...) (variadic)
Y // , ...) (C-style variadic)
Z // ) (standard)

7. Templates

TemplateInstanceName:
TemplateID SymbolName TemplateArgs [ Z ]
TemplateID:
__T | __U | T | U
TemplateArgs:
{ [ H ] TemplateArg }
TemplateArg:
T Type // Type argument
V TypeChar Type Value // Value argument
S QualifiedName // Symbol argument
S _ D QualifiedName [Z] // Fully qualified symbol
X Number Name // Externally linked LName

8. Values and Literals

Value:
n // null
i Number // positive integer
N Number // negative integer
Number // positive integer (shorthand)
b Number // boolean (0/1)
e HexFloat // real
c HexFloat c HexFloat // complex real
a Number _ HexString // char string
w Number _ HexString // wchar string
d Number _ HexString // dchar string
A Number { Value } // Array
H Number { Value : Value } // Associative Array
S Number { Value } // Struct
HexFloat:
N A N // real.nan
I N F // real.infinity
N I N F // -real.infinity
[ N ] HexDigits P [ N ] Number // Hexadecimal float (e.g., 0x...p+/-...)

Deviations & Additions from the Official Spec

Parameter Storage Classes: Added complex, undocumented combinations (e.g., M N k J for scope return out, I K for in ref).
Type Back References: Specified that Q compresses types (BackRefType), not just symbols.
New Attributes: Added @live (N m), return scope (N j N l), and scope return (N l N j).
Template Values (V): Added detailed grammar for arrays (A), associative arrays (H), structs (S), and exact hex float configurations (base-16 exponents, N A N, I N F).
Vectors & 128-bit Ints: Added __vector(Type) (N h), cent (z i), and ucent (z k).
Anonymous Symbols: Included ___S Number for special anonymous scopes.

Implementation

My C implementation of a demangler based on this DMD specification can be found here: rz-libdemangle.

This parser was developed as part of my GSoC'26 project for the Rizin reverse engineering framework.