avast / avast/retdec

Fileformat does not generate section-table hashes for Mach-O binaries

Open
#289 0 comments 0 reactions 0 assignees View on GitHub
C-fileformat C-fileinfo new-feature T-format-macho
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Would it be possible to add generation of section-table hashes for Mach-O binaries? Currently, when I run `retdec-fileinfo` over a Mach-O binary, there are no section-table hashes:
```
Section table
-------------
Number of sections: 9

i name offset fsize address memsize align relocOff relocNum
----------------------------------------------------------------------------------------------------
0 __text 0x0ee0 0xa1 0x1ee0 0xa1 0x10 0 0
1 __symbol_stub 0x0f82 0x0c 0x1f82 0x0c 0x02 0 0
2 __stub_helper 0x0f90 0x16 0x1f90 0x16 0x04 0 0
3 __cstring 0x0fa6 0x0c 0x1fa6 0x0c 0x01 0 0
...
```
Compare this to the following output from an analysis of an ELF binary:
```
Section table
-------------
Number of sections: 29
CRC32 : 7f7080e1
MD5 : d54f028be9ff528389730a58f437950e
SHA256 : fc680d95d2e4499723fea9ee9eddb2054ded629b8bbe37a40944869cf2fdb92e

i name type flags offset fsize address align esize link other crc32
--------------------------------------------------------------------------------------------------------------------------------
0 NULL 0 0 0 0 0 0 0
1 .interp PROGBITS a 0x0134 0x013 0x8048134 0x01 0 0 0 3dba3c5d
2 .note.ABI-tag NOTE a 0x0148 0x020 0x8048148 0x04 0 0 0 d8bb9246
3 .hash HASH a 0x0168 0x034 0x8048168 0x04 0x04 4 0 aa525de3
...
```
and PE binary:
```
Section table
-------------
Number of sections: 14
CRC32 : 7b4c4bb2
MD5 : e33b8f42e41248a4b1b2c0b69f13096b
SHA256 : a2efa828cdc7b5b074f0bfd34c14ba4770f9782debb17568aa9300bafc2b84ac

i name flags offset fsize address memsize relocOff relocNum linesOff linesNum crc32
--------------------------------------------------------------------------------------------------------------------------------
0 .text Eixr 0x0400 0x6800 0x401000 0x6794 0 0 0 0 00ec207c
1 .data irw 0x6c00 0x0200 0x408000 0x0050 0 0 0 0 d33b8874
2 .rdata ir 0x6e00 0x0800 0x409000 0x0644 0 0 0 0 21d8e32e
3 .bss urw 0 0 0x40a000 0x0dac 0 0 0 0
...
```
In both cases, `retdec-fileinfo` generated section-table hashes.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the retdec-fileinfo output path for Mach-O section tables and compare it with the existing ELF and PE section-table hash output. Run retdec-fileinfo on a representative Mach-O binary; done means the section table includes hashes comparable to those shown for ELF and PE.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.