From 6b42ed1d6cf0e98c5dce5fae62c58fd580b5c73b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Florian=20M=C3=A4rkl?= Date: Wed, 28 Jun 2023 15:33:59 +0200 Subject: [PATCH] Mach-O: Do not reconstruct arm64e chained relocs without BIND_OPCODE_THREADED arm64e kernelcaches may have no BIND_OPCODE_THREADED but __TEXT$__thread_starts instead, which should then be used, meaning MACH0_(has_chained_fixups)() has to return false such that this info will be processed. --- librz/bin/format/mach0/kernelcache.c | 5 +++-- librz/bin/format/mach0/mach0_chained_fixups.c | 8 ++++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/librz/bin/format/mach0/kernelcache.c b/librz/bin/format/mach0/kernelcache.c index e86e73e893..b0554df9c5 100644 --- a/librz/bin/format/mach0/kernelcache.c +++ b/librz/bin/format/mach0/kernelcache.c @@ -223,8 +223,9 @@ RZ_API RzBuffer *rz_xnu_kernelcache_new_patched_buf(RzXNUKernelCacheObj *obj) { } if (MACH0_(has_chained_fixups)(obj->mach0)) { - MACH0_(patch_chained_fixups) - (obj->mach0, r); + // clang-format off + MACH0_(patch_chained_fixups)(obj->mach0, r); + // clang-format on } else if (obj->rebase_info) { rebase_buffer(obj, r); } diff --git a/librz/bin/format/mach0/mach0_chained_fixups.c b/librz/bin/format/mach0/mach0_chained_fixups.c index 8d29974d81..eccb7d1623 100644 --- a/librz/bin/format/mach0/mach0_chained_fixups.c +++ b/librz/bin/format/mach0/mach0_chained_fixups.c @@ -248,6 +248,7 @@ typedef struct { struct MACH0_(obj_t) * bin; struct rz_dyld_chained_starts_in_segment *cur_seg; size_t cur_seg_idx; + bool found_threaded; } ReconstructThreadedCtx; static void chained_import_threaded_fini(void *e, void *user) { @@ -257,6 +258,7 @@ static void chained_import_threaded_fini(void *e, void *user) { static void reconstruct_threaded_table_size(ut64 table_size, void *user) { ReconstructThreadedCtx *ctx = user; + ctx->found_threaded = true; struct mach0_chained_fixups_t *cf = &ctx->bin->chained_fixups; rz_vector_fini(&cf->imports); cf->imports_format = DYLD_CHAINED_IMPORT_THREADED; @@ -337,6 +339,12 @@ RZ_IPI void MACH0_(reconstruct_chained_fixups_from_threaded)(struct MACH0_(obj_t // clang-format off MACH0_(bind_opcodes_foreach)(bin, reconstruct_threaded_table_size, reconstruct_threaded_bind, reconstruct_threaded_apply, &ctx); // clang-format on + if (!ctx.found_threaded) { + // found no BIND_OPCODE_THREADED to reconstruct chained relocs from, + // so allow MACH0_(has_chained_fixups)() to still be false + RZ_FREE(cf->starts); + cf->starts_count = 0; + } } #define IS_PTR_AUTH(x) ((x & (1ULL << 63)) != 0)