Skip to content

Conversation

@bdash
Copy link
Contributor

@bdash bdash commented Apr 9, 2025

They show up in some macOS system executables.

@bdash
Copy link
Contributor Author

bdash commented Apr 9, 2025

I noticed this in a few executables, mostly for references to type info symbols from libc++. The unapplied imports prevent the RTTI analysis from handling these types.

For instance, in /usr/libexec/syspolicyd there are four std::exception subclasses with RTTI that references __ZTVN10__cxxabiv120__si_class_type_infoE + 0x10:

mrowe@dragon:~$ dyld_info -arch arm64e -fixups /usr/libexec/syspolicyd  | grep ' + '
__DATA_CONST    __const          0x100101B60      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)
__DATA_CONST    __const          0x100101BB0      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)
__DATA_CONST    __const          0x100101C00      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)
__DATA_CONST    __const          0x100101C18      auth-bind  libc++/__ZTVN10__cxxabiv120__si_class_type_infoE + 0x10 (div=0x0000 ad=0 key=DA)

@emesare emesare added this to the H milestone Apr 16, 2025
@emesare emesare added File Format: Mach-O Impact: Medium Issue is impactful with a bad, or no, workaround labels Apr 16, 2025
@0cyn 0cyn self-assigned this Apr 25, 2025
They show up in some macOS system executables.
@0cyn 0cyn force-pushed the macho-chained-import-addends branch from e205fc7 to 080495b Compare April 28, 2025 18:40
@0cyn 0cyn merged commit 080495b into Vector35:dev Apr 28, 2025
1 check passed
@0cyn
Copy link
Member

0cyn commented Apr 28, 2025

Thank you for the PR (and the premade bash for tracking down binaries with this format!)

@bdash bdash deleted the macho-chained-import-addends branch July 11, 2025 02:26
@CouleeApps CouleeApps modified the milestones: Future, Helion Jul 23, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

File Format: Mach-O Impact: Medium Issue is impactful with a bad, or no, workaround

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants