go-macho icon indicating copy to clipboard operation
go-macho copied to clipboard

Mac OS X Fragile Compatibility

Open t0rr3sp3dr0 opened this issue 1 year ago • 6 comments

Is your feature request related to a problem? Please describe.

The current implementation of go-macho only properly supports the non-fragile version of the Mac OS X Objective-C Runtime. Code that targeting the fragile version of the runtime may not be parsed correctly. In clang, the runtime can be defined through the -fobjc-runtime=${OBJC_RUNTIME} flag (https://clang.llvm.org/doxygen/classclang_1_1ObjCRuntime.html#af19fe070a7073df4ecc666b44137c4e5).

Describe the solution you'd like

Have a solution that is able to handle both runtime variants. If possible to distinguish the runtime used from the binary, implement full support, otherwise prioritize compatibility with the non-fragile runtime.

Describe alternatives you've considered

Not implement support for the Mac OS X Fragile Runtime and explicitly state that go-macho support the non-fragile runtime only. If possible, reject or warn about binaries using incompatible runtimes.

Search

  • [x] I did search for other open and closed issues before opening this

Code of Conduct

  • [x] I agree to follow this project's Code of Conduct

Additional context

No response

t0rr3sp3dr0 avatar May 01 '24 04:05 t0rr3sp3dr0

Can you include 2 binaries compiled in the 2 different ways?

blacktop avatar May 02 '24 16:05 blacktop

Take a look at these files, I've complied them with gcc for all architectures supported during the transition from PowerPC to Intel. class-dump is able to parse the gcc-compiled binaries without a problem, but go-macho fails with different errors.

I also compiled the same thing with the latest version clang using different Objective-C runtimes. Strangely, even when using the default Objective-C runtime, go-macho is failing to decode types.

t0rr3sp3dr0 avatar May 05 '24 09:05 t0rr3sp3dr0

Btw, I was under the impression that older versions of Xcode used the GNU runtime by default, but that's not the case. On those versions, Xcode uses what LLVM calls the Mac OS X Fragile runtime. I couldn't make clang or gcc use runtimes that were not NeXT-like. It looks like no one ever bothered to support GNU-like runtimes on macOS, I've only been able to use them on Linux. But since those binaries are ELFs not Mach-Os, supporting them is definitely out of the scope of this project and we should focus on the NeXT-like runtimes.

t0rr3sp3dr0 avatar May 05 '24 09:05 t0rr3sp3dr0

Actually, I just figured out the ObjFW Runtime has a compiler of its own and was able to use it on macOS. It doesn't support cross-compilation though, so I could only generate binaries for Intel and Apple Silicon.

t0rr3sp3dr0 avatar May 05 '24 10:05 t0rr3sp3dr0

For extra reference, sharing two binaries from the Mac OS X 10.0 Public Beta. I think they will be the worst case we will ever see. go-macho, MachOExplorer, and MachOView have no idea how to parse them, but class-dump is able to process these binaries normally.

t0rr3sp3dr0 avatar May 05 '24 20:05 t0rr3sp3dr0