m4b / m4b/goblin

mach relocation parsing doesn't handle big endian

Open
#205 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
1.5k
Forks
202
PR merge metrics
No merged PRs in 30d

Description

The relocation fields are bitfields, which makes the ordering all weird. Currently we only use the little endian ordering, but that won't work for big endian files.

LLVM has code to handle this difference, see [here](https://github.com/llvm-mirror/llvm/blob/2c4ca6832fa6b306ee6a7010bfb80a3f2596f824/lib/Object/MachOObjectFile.cpp#L141-L170).

Also related, we don't currently parse scattered relocations.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the relocation parsing implementation and the LLVM Mach-O reference linked in the issue, focusing on how bitfield ordering differs between little- and big-endian files. Verify behavior with big-endian Mach-O input, then assess the related scattered-relocation parsing gap; done means both relocation forms are parsed correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.