In-memory Dwarf Execution - #2
Open
sfc-gh-rwincey wants to merge 6 commits into
Open
Conversation
- Patched ImageLoaderMachO to skip __PAGEZERO in assignSegmentAddresses, mapSegments vm_copy, and mapSegments segProtect - Removed MH_EXECUTE rejection in instantiateFromMemory - Added custom_dlopen_executable_from_memory() and custom_dlget_entry() APIs - Implemented doApplyChainedFixupsManual() for UNSIGN_TOLERANT mode: supports DYLD_CHAINED_PTR_64_OFFSET, DYLD_CHAINED_PTR_64, and ARM64E formats - Uses resolve() for proper two-level namespace symbol resolution - PoC_exec: test harness with forked/in-process modes, fat binary extraction - Tested: custom binaries (with/without chained fixups), Homebrew binaries (jq)
- Fix PAC instruction detection masks for BRAA/BRAB/BLRAA/BLRAB (Group 4): mask was clearing the distinguishing bit, causing zero matches - Fix PAC detection for BLRAAZ/BLRABZ (Group 3): mask preserved BL flag, preventing BLR auth-Z variants from matching - Fix BL flag extraction: was checking bit 25 (always 1 in branch-register encoding group) instead of bit 21 (actual BR vs BLR discriminator) - Fix ARM64E chained fixup chain walk: next field is at bits 51-61 (shift by 51), not bits 52-62 (shift by 52). The off-by-one caused the first fixup to compute next=1024 instead of 1, skipping all remaining entries in __auth_got/__got Tested: whoami, id, ls, ps, uname, hostname, echo — all arm64e system binaries now load and execute correctly from memory
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proof of concept for loading and executing Mach-O executables (MH_EXECUTE) entirely from memory, analogous to what ulexecve does for ELF binaries on Linux.
This extends the existing ReflectiveLoader (which handles dylibs/bundles) to also support standalone executables.