-2

When reversing a Mach-O crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments.

Loading file 'target' into database...
Detected file format: Mach-O file (EXECUTE). X86_64
...
Autoanalysis subsystem has been initialized.
Type library 'macosx64' loaded. Applying types...
Types applied to 0 names.
0x10000A6F0: section file offset invalid: (5242; expected A6F0); possibly the file was modified to hinder analysis!
  0. Creating a new segment  (000000010000A6F0-000000010044A776) ... ... OK
0x10044A776: section file offset invalid: (4460BF; expected 44A776); possibly the file was modified to hinder analysis!
  1. Creating a new segment  (000000010044A776-000000010044B5CE) ... ... OK
0x10044B5D0: section file offset invalid: (44ADC0; expected 44B5D0); possibly the file was modified to hinder analysis!
  2. Creating a new segment  (000000010044B5D0-000000010044CDB4) ... ... OK
0x10044CDB4: section file offset invalid: (44C84B; expected 44CDB4); possibly the file was modified to hinder analysis!

... etc [repeating]

After analysis, the MachO is properly disassembled and I can continue reversing process. The issue arise when I try to decompile the same binary under Ghidra.

For some reason, Ghidra, nor any other disassemble/decompiler software, does not demangle and decompile the binary properly. It shows a lot of idbs and undefined ASM calls. Upon researching further, I found out this technique is shown in MachO Tricks by qw as Mach-O obfuscation tricks. A issue is raised in Ghidra repository too.

How to fix those segments via Ghidra, or any other tool for that matter so that the disassemble code will be readable and reversible?


The binary is Hopper Disassembler which is ALLOWED to be reverse engineered. As per ToS presented.

1

Executable Mach-O files use segment load commands to represent loadable/mappable memory areas. They can be further split into sections.

IDA’s Mach-O loader does not use the file offset field in the section headers. The data from file is loaded into database only using segment headers and then split into sections based on the address fields of the section headers.

2
  • Thank Igor. I'm aware of load_commands in segments. Although quite informative, this answer does not help with my last question from the thread: how can we manually refix those segments so we can continue reversing in r2/lldb. Wish IDA had a way to export MachO binaries.
    – sensation
    May 11 '20 at 6:59
  • 1
    the question title was about IDA so I answered that part
    – Igor Skochinsky
    May 11 '20 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.