Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mach-O: problems of parsing HPPA and SPARC sub-binaries of the universal binary #4359

Open
XVilka opened this issue Mar 15, 2024 · 0 comments

Comments

@XVilka
Copy link
Member

XVilka commented Mar 15, 2024

ℤ file 2048-NeXTSTEP
2048-NeXTSTEP: Mach-O universal binary with 4 architectures: [m68k:
- Mach-O executable m68k] [i386:
- Mach-O executable i386] [hppa 7100:
- Mach-O executable hppa 7100] [SPARC:
- Mach-O executable SPARC]
2048-NeXTSTEP (for architecture m68k):	Mach-O executable m68k
2048-NeXTSTEP (for architecture i386):	Mach-O executable i386
2048-NeXTSTEP (for architecture hppa):	Mach-O executable hppa 7100
2048-NeXTSTEP (for architecture sparc):	Mach-O executable SPARC
ℤ rizin 2048-NeXTSTEP
ERROR: unknown thread state structure
ERROR: mach0: Cannot parse thread
 -- Use '-e bin.strings=false' to disable automatic string search when loading the binary.
[0x00002000]> i
fd       3
file     2048-NeXTSTEP
size     0x30000
humansz  192K
mode     r-x
format   mach0
iorw     false
block    0x100
packet   xtr.fatmach0
type     Executable file
arch     arm
cpu      N/A
baddr    0x00002000
binsz    0x0000e000
bintype  mach0
bits     64
class    MACH0
compiler N/A
dbg_file N/A
endian   LE
hdr.csum N/A
guid     N/A
intrp    N/A
laddr    0x00000000
lang     c
machine  mc68030
maxopsz  4
minopsz  4
os       darwin
cc       N/A
pcalign  4
rpath    N/A
subsys   unknown
stripped false
crypto   false
havecode true
va       true
sanitiz  false
static   true
linenum  false
lsyms    false
canary   false
PIE      false
RELROCS  false
NX       false
[0x00002000]>
rz-bin -i -f hppa 2048-NeXTSTEP
ERROR: unknown thread state structure
ERROR: mach0: Cannot parse thread
WARNING: rz_bin_file_find_by_arch_bits: assertion 'bin && arch' failed (line 157)
WARNING: rz_bin_file_set_obj: assertion 'bin && bf' failed (line 253)
[Archs]
offset     size  arch       machine
-------------------------------------
0x00002000 49152 mc680x0_32 mc68030
0x0000e000 40960 x86_32     386
0x00018000 49152 hppa_32    hppa7100
0x00024000 49152 sparc_32   all

[Imports]
nth vaddr bind type lib name

If you extract subbins with rz-bin -x command, then open them individually, you will see that HPPA and SPARC binaries are poorly parsed/analyzed

2048-NeXTSTEP.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant