How to fix Mach-O segment section to deobfuscate the binary

Question

When reversing a Mach-O crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments.

Loading file 'target' into database...
Detected file format: Mach-O file (EXECUTE). X86_64
...
Autoanalysis subsystem has been initialized.
Type library 'macosx64' loaded. Applying types...
Types applied to 0 names.
0x10000A6F0: section file offset invalid: (5242; expected A6F0); possibly the file was modified to hinder analysis!
  0. Creating a new segment  (000000010000A6F0-000000010044A776) ... ... OK
0x10044A776: section file offset invalid: (4460BF; expected 44A776); possibly the file was modified to hinder analysis!
  1. Creating a new segment  (000000010044A776-000000010044B5CE) ... ... OK
0x10044B5D0: section file offset invalid: (44ADC0; expected 44B5D0); possibly the file was modified to hinder analysis!
  2. Creating a new segment  (000000010044B5D0-000000010044CDB4) ... ... OK
0x10044CDB4: section file offset invalid: (44C84B; expected 44CDB4); possibly the file was modified to hinder analysis!

... etc [repeating]

After analysis, the MachO is properly disassembled and I can continue reversing process. The issue arise when I try to decompile the same binary under Ghidra.

For some reason, Ghidra, nor any other disassemble/decompiler software, does not demangle and decompile the binary properly. It shows a lot of idbs and undefined ASM calls. Upon researching further, I found out this technique is shown in MachO Tricks by qw as Mach-O obfuscation tricks. A issue is raised in Ghidra repository too.

How to fix those segments via Ghidra, or any other tool for that matter so that the disassemble code will be readable and reversible?

---

The binary is Hopper Disassembler which is ALLOWED to be reverse engineered. As per ToS presented.

Answer 1

Executable Mach-O files use segment load commands to represent loadable/mappable memory areas. They can be further split into sections.

IDA’s Mach-O loader does not use the file offset field in the section headers. The data from file is loaded into database only using segment headers and then split into sections based on the address fields of the section headers.