avast / avast/retdec

Analysis of attached Mach-O binaries ends with "Error: Failed to parse the input file (it is probably corrupted)"

Open
#126 3 comments 0 reactions 0 assignees View on GitHub
C-fileinfo enhancement Q-question T-format-macho
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Analysis of these files:
- [5F6FB1751B88FC9697D5A06A0F86B69ADA45B1FFFADEB2CB96573BD665F3580E](https://www.virustotal.com/en/file/5F6FB1751B88FC9697D5A06A0F86B69ADA45B1FFFADEB2CB96573BD665F3580E/analysis/)
- [DDD52F2260AF389AB68896221BF036841054093175F6A7CED5A36B98F7ECD86A](https://www.virustotal.com/en/file/DDD52F2260AF389AB68896221BF036841054093175F6A7CED5A36B98F7ECD86A/analysis/)
- `15905B2A55A635182EF99255EB160FF910FBCF4A938467339A56928BB9DE2B09`
- `6C4D3FA4BB13865D6195F9082A62D4FD625965B8BC14B0878E3589388E86EDD1`

Ends with:
```
Error: Failed to parse the input file (it is probably corrupted). Detected format is: Mach-O.
```

Execution:
```
retdec-fileinfo
```

Are these files really corrupted? Even if they are, can we analyze them without crashing `retdec-fileinfo`?

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the failure with retdec-fileinfo using the four Mach-O samples linked in the issue and compare whether the inputs are actually corrupted. Trace the Mach-O parsing path from that entry point; done means the files' validity is established and retdec-fileinfo handles the failure without crashing.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.