m4b / m4b/rdr

mach fat binaries mess up rdr map symbol disassembly

Open
#1 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
OCaml
Stars
86
Forks
10
PR merge metrics
No merged PRs in 30d

Description

When a mach map is built:

`rdr -m -f _printf -D`

will incorrectly disassemble the wrong area, as rdr sucks out the 64-bit binary and all offsets are not relative to the original fat binary. To fix this, simply have all mach binary analysis use a base?

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the issue with `rdr -m -f _printf -D` on a Mach-O fat binary, then trace the Mach binary analysis that extracts the 64-bit binary and applies offsets. Done means symbol disassembly uses offsets relative to the original fat binary rather than the extracted slice.

Written by the indexing model from the issue text.

Assessment

Tech stack
ocaml
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.