When reversing a Mach-O
crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments.
Loading file 'target' into database... Detected file format: Mach-O file (EXECUTE). X86_64 ... Autoanalysis subsystem has been initialized. Type library 'macosx64' loaded. Applying types... Types applied to 0 names. 0x10000A6F0: section file offset invalid: (5242; expected A6F0); possibly the file was modified to hinder analysis! 0. Creating a new segment (000000010000A6F0-000000010044A776) ... ... OK 0x10044A776: section file offset invalid: (4460BF; expected 44A776); possibly the file was modified to hinder analysis! 1. Creating a new segment (000000010044A776-000000010044B5CE) ... ... OK 0x10044B5D0: section file offset invalid: (44ADC0; expected 44B5D0); possibly the file was modified to hinder analysis! 2. Creating a new segment (000000010044B5D0-000000010044CDB4) ... ... OK 0x10044CDB4: section file offset invalid: (44C84B; expected 44CDB4); possibly the file was modified to hinder analysis! ... etc [repeating]
After analysis, the MachO is properly disassembled and I can continue reversing process. The issue arise when I try to decompile the same binary under Ghidra.
For some reason, Ghidra, nor any other disassemble/decompiler software, does not demangle and decompile the binary properly. It shows a lot of idbs and undefined ASM calls. Upon researching further, I found out this technique is shown in MachO Tricks by qw as Mach-O obfuscation tricks. A issue is raised in Ghidra repository too.
How to fix those segments via Ghidra, or any other tool for that matter so that the disassemble code will be readable and reversible?
The binary is Hopper Disassembler which is ALLOWED to be reverse engineered. As per ToS presented.