Skip to content

[MachO] Handle chained imports with addends #6604

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 28, 2025

Conversation

bdash
Copy link
Contributor

@bdash bdash commented Apr 9, 2025

They show up in some macOS system executables.

@bdash
Copy link
Contributor Author

bdash commented Apr 9, 2025

I noticed this in a few executables, mostly for references to type info symbols from libc++. The unapplied imports prevent the RTTI analysis from handling these types.

For instance, in /usr/libexec/syspolicyd there are four std::exception subclasses with RTTI that references __ZTVN10__cxxabiv120__si_class_type_infoE + 0x10:

mrowe@dragon:~$ dyld_info -arch arm64e -fixups /usr/libexec/syspolicyd  | grep ' + '
__DATA_CONST    __const          0x100101B60      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)
__DATA_CONST    __const          0x100101BB0      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)
__DATA_CONST    __const          0x100101C00      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)
__DATA_CONST    __const          0x100101C18      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)

@emesare emesare added this to the H milestone Apr 16, 2025
@emesare emesare added File Format: Mach-O Impact: Medium Issue is impactful with a bad, or no, workaround labels Apr 16, 2025
@0cyn 0cyn self-assigned this Apr 25, 2025
They show up in some macOS system executables.
@0cyn 0cyn force-pushed the macho-chained-import-addends branch from e205fc7 to 080495b Compare April 28, 2025 18:40
@0cyn 0cyn merged commit 080495b into Vector35:dev Apr 28, 2025
1 check passed
@0cyn
Copy link
Member

0cyn commented Apr 28, 2025

Thank you for the PR (and the premade bash for tracking down binaries with this format!)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
File Format: Mach-O Impact: Medium Issue is impactful with a bad, or no, workaround
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants