Skip to content

[MachO] Handle chained imports with addends #6604

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from

Conversation

bdash
Copy link
Contributor

@bdash bdash commented Apr 9, 2025

They show up in some macOS system executables.

They show up in some macOS system executables.
@bdash
Copy link
Contributor Author

bdash commented Apr 9, 2025

I noticed this in a few executables, mostly for references to type info symbols from libc++. The unapplied imports prevent the RTTI analysis from handling these types.

For instance, in /usr/libexec/syspolicyd there are four std::exception subclasses with RTTI that references __ZTVN10__cxxabiv120__si_class_type_infoE + 0x10:

mrowe@dragon:~$ dyld_info -arch arm64e -fixups /usr/libexec/syspolicyd  | grep ' + '
__DATA_CONST    __const          0x100101B60      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)
__DATA_CONST    __const          0x100101BB0      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)
__DATA_CONST    __const          0x100101C00      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)
__DATA_CONST    __const          0x100101C18      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)

@emesare emesare added this to the H milestone Apr 16, 2025
@emesare emesare added File Format: Mach-O Impact: Medium Issue is impactful with a bad, or no, workaround labels Apr 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
File Format: Mach-O Impact: Medium Issue is impactful with a bad, or no, workaround
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants