fileinfo takes too much time to analyze attached Mach-O binaries

[s3rvac]

fileinfo takes too much time to analyze attached Mach-O binaries.

Input

Run

$ retdec-fileinfo -v FILE

where FILE is

• 19BE25BE101F645B63300728ED6DE006034D60FADB4A605173FF30C67B00B667
• 25B43F4D98BF7AE129D4DE3DE9FF24C7BB03E2D0434E6162F2040BD235C60DC8
• 3A7FF316CE9795CA293A4AE1114383D6862A243B9673B18F3BE2BA95E7FF48C1
• 3B1862F8DB0C0B1F035897A268C6E3C4C87D82D3DA88C3704C73B93968F4F904
• 3BE613F084579FBB5E401DCA8252775DBC11DC57910439ACCA3D5574E810BB79
• 440A47A511D55FADE3C5502B1C3DEDC20DEC58A6030F04D4BE1B77CB0B757782
• 716003C2EA012CFEB83320BB1BC563220DD8FA5F8EA52AD590581E301F7E5B94
• 7F9E1B1A7EC8BF0F18C5A745822F3573347EDA1D03F98EF7EFDB4447199681F0
• B0D07432655EA806BBD7FB3159825A7262743D6B8B9C3D2D980ABE9E39E16BEA
• E44B8A2279B2ADBCB8F89A4D9B71BF29D26EC457C77A8B9707A9A90E5B7E64C0
• F495732205EA173EC27EB0C4CFA1325338F6086E0D1D7FA16D2531FAFE65E832
• F9A3FE6171DBCDD66580209C5AF331FAC20EB79C25B685491D3912FD9A312F16
• FF80D71A8F60A4D322CF0DF1BA98932E291B8A867421C3E816404E5D3F5500F5

Output

fileinfo does not finish the analysis in a reasonable time (5 minutes).

Expected output

fileinfo finishes the analysis in a reasonable time (under 5 minutes, but preferably under 1 minute).

Configuration

• Commit: 1647e9f (current master)
• 64b Arch Linux, GCC 7.3.1, Debug build of RetDec

[PeterMatula]

Looks like a problem in YARA. Probably at Mach-O parsing? (Since I don't think it would cycle at rule matching).

This takes forever:

<retdec-build-dir>/deps/yara/yara/src/yara/yara <retdec-repo-dir>/support/yara_patterns/tools/macho/x86/compilers.yara 19be25be101f645b63300728ed6de006034d60fadb4a605173ff30c67b00b667

The same thing with the current YARA master:

git clone https://github.com/VirusTotal/yara.git
cd yara
git checkout cd4e507b8ff60cc68e00e140e01ca6a560f1db41
./bootstrap.sh
./configure --with-crypto --enable-profiling --enable-macho --enable-dotnet
make
yara <retdec-repo-dir>/support/yara_patterns/tools/macho/x86/compilers.yara 19be25be101f645b63300728ed6de006034d60fadb4a605173ff30c67b00b667

It cycles even when there are no rules in the file, and the only content is:

import "macho"

[PeterMatula]

Fixed in VirusTotal/yara#1263.
But we will probably have to wait for it to be merged.

[PeterMatula]

Fixed in VirusTotal/yara#1272 which was already merged to master.

[PeterMatula]

19be25be101f645b63300728ed6de006034d60fadb4a605173ff30c67b00b667 added to nightly tests as x86-macho-19be25be101f645b63300728ed6de006034d60fadb4a605173ff30c67b00b667-issue-283