m4b / m4b/goblin

index out of bounds error when getting imports on arm64e MachO binaries

Open
#323 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
1.5k
Forks
202
PR merge metrics
No merged PRs in 30d

Description

Hello,

I am encountering a small issue when attempting to parse arm64e MachO binaries using goblin.
When I attempt to call the function imports() I get an index out of bounds error.
An example binary that triggers the error is: /usr/bin/lpoptions MD5: b916ce6df2551e4f9eb7e739b07a8d1d.
The file is a FAT binary. I also encounter the error when using the example file dyldinfo.rs
The x86_64 binary is parsed fine:

./dyldinfo -arch x86_64 -bind -lazy_bind /usr/bin/lpoptions
bind information:
segment section          address        type    addend dylib            symbol
__DATA  __got            0x100004008    pointer      0 libSystem        ___stack_chk_guard
__DATA  __got            0x100004010    pointer      0 libSystem        ___stderrp
__DATA  __got            0x100004018    pointer      0 libSystem        ___stdoutp
__DATA  __got            0x100004020    pointer      0 libSystem        dyld_stub_binder
lazy binding information (from lazy_bind part of dyld info):
segment section          address    index  dylib            symbol
__DATA  __la_symbol_ptr  0x100004028 0x0000 libSystem        ___error
__DATA  __la_symbol_ptr  0x100004030 0x000F libSystem        ___stack_chk_f
....

But if i try arm64e I get an error/crash

./dyldinfo -arch arm64e -bind -lazy_bind /usr/bin/lpoptions
thread 'main' panicked at 'index out of bounds: the len is 3 but the index is 17', src/mach/imports.rs:103:20
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

I am using macOS Monterey, Intel

let me know if any more information is needed, thanks.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in src/mach/imports.rs at line 103 and reproduce the panic with the arm64e slice of /usr/bin/lpoptions or the dyldinfo.rs example. Compare the arm64e and x86_64 import parsing paths, then verify that imports() handles the arm64e binary without an index-out-of-bounds panic while preserving the working x86_64 behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos, rust
Domain
operating-systems, reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.