Artificial MachO binary processed by llvm-objcopy/strip is not accepted by codesign #117723

RIscRIpt · 2024-11-26T15:19:56Z

Symptom

Artificial MachO binary processed by llvm-objcopy/strip is not accepted by codesign.

codesign fails with error:

main executable failed strict validation

Investigation

According to Darling/libsecurity_utilities/lib/macho++.cpp

libsecurity_utilities/lib/macho++.cpp|238 col 3| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|617 col 7| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|629 col 7| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|635 col 8| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|643 col 6| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|654 col 5| mSuspicious = true;

According to MachO::validateStructure

The sum of the last LoadCommand and its size must equal to the total size of "fat" component,
which sometimes corresponds to the end of file.

According to Universal::Universal

Alignment of "fat" components must be less than 2^30, and
The gap size between "fat" components must be less than its alignment.
The gap must be filled with zero bytes.
No junk shall be past end of file or "fat" component.

Relevant requirement

From the above there should be no data in MachO past contents of a load command with the largest offset+size.

Problem description

llvm-objcopy does not update indirectsymoff field if the resulting IndirectSymTable (after stripping) is empty [1]. As a result indirectsymoff keeps old value, which is garbage, and can point past offset+size of the last load command. As a result totalSize() returns size that is larger than the actual stripped MachO [2].

This clearly violates one of the checks mentioned above (there are zero-bytes filled past offset+size of the last load command.

[1]

llvm-project/llvm/lib/ObjCopy/MachO/MachOLayoutBuilder.cpp

Lines 364 to 368 in ec41462

    
           if (!O.IndirectSymTable.Symbols.empty()) { 
        
             MLC.dysymtab_command_data.indirectsymoff = StartOfIndirectSymbols; 
        
             MLC.dysymtab_command_data.nindirectsyms = 
        
                 O.IndirectSymTable.Symbols.size(); 
        
           }

[2]

llvm-project/llvm/lib/ObjCopy/MachO/MachOWriter.cpp

Lines 92 to 94 in ec41462

    
           if (DySymTabCommand.indirectsymoff) 
        
             Ends.push_back(DySymTabCommand.indirectsymoff + 
        
                            sizeof(uint32_t) * O.IndirectSymTable.Symbols.size());

The text was updated successfully, but these errors were encountered:

llvmbot · 2024-11-26T15:20:14Z

@llvm/issue-subscribers-bug

Author: Richard Dzenis (RIscRIpt)

## Symptom

Artificial MachO binary processed by llvm-objcopy/strip is not accepted by codesign.

codesign fails with error:

> main executable failed strict validation

Investigation

According to Darling/libsecurity_utilities/lib/macho++.cpp

libsecurity_utilities/lib/macho++.cpp|238 col 3| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|617 col 7| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|629 col 7| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|635 col 8| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|643 col 6| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|654 col 5| mSuspicious = true;

According to MachO::validateStructure

The sum of the last LoadCommand and its size must equal to the total size of "fat" component,
which sometimes corresponds to the end of file.

According to Universal::Universal

Alignment of "fat" components must be less than 2^30, and
The gap size between "fat" components must be less than its alignment.
The gap must be filled with zero bytes.
No junk shall be past end of file or "fat" component.

Relevant requirement

From the above there should be no data in MachO past contents of a load command with the largest offset+size.

Problem description

llvm-objcopy does not update indirectsymoff field if the resulting IndirectSymTable (after stripping) is empty [1]. As a result indirectsymoff keeps old value, which is garbage, and can point past offset+size of the last load command. As a result totalSize() returns size that is larger than the actual stripped MachO [2].

This clearly violates one of the checks mentioned above (there are zero-bytes filled past offset+size of the last load command.

[1]

llvm-project/llvm/lib/ObjCopy/MachO/MachOLayoutBuilder.cpp

Lines 364 to 368 in ec41462

    
           if (!O.IndirectSymTable.Symbols.empty()) { 
        
             MLC.dysymtab_command_data.indirectsymoff = StartOfIndirectSymbols; 
        
             MLC.dysymtab_command_data.nindirectsyms = 
        
                 O.IndirectSymTable.Symbols.size(); 
        
           }

[2]

llvm-project/llvm/lib/ObjCopy/MachO/MachOWriter.cpp

Lines 92 to 94 in ec41462

    
           if (DySymTabCommand.indirectsymoff) 
        
             Ends.push_back(DySymTabCommand.indirectsymoff + 
        
                            sizeof(uint32_t) * O.IndirectSymTable.Symbols.size());

llvmbot · 2024-11-26T15:20:15Z

@llvm/issue-subscribers-tools-llvm-objcopy-strip

Author: Richard Dzenis (RIscRIpt)

## Symptom

Artificial MachO binary processed by llvm-objcopy/strip is not accepted by codesign.

codesign fails with error:

> main executable failed strict validation

Investigation

According to Darling/libsecurity_utilities/lib/macho++.cpp

libsecurity_utilities/lib/macho++.cpp|238 col 3| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|617 col 7| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|629 col 7| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|635 col 8| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|643 col 6| mSuspicious = true;
libsecurity_utilities/lib/macho++.cpp|654 col 5| mSuspicious = true;

According to MachO::validateStructure

The sum of the last LoadCommand and its size must equal to the total size of "fat" component,
which sometimes corresponds to the end of file.

According to Universal::Universal

Alignment of "fat" components must be less than 2^30, and
The gap size between "fat" components must be less than its alignment.
The gap must be filled with zero bytes.
No junk shall be past end of file or "fat" component.

Relevant requirement

From the above there should be no data in MachO past contents of a load command with the largest offset+size.

Problem description

llvm-objcopy does not update indirectsymoff field if the resulting IndirectSymTable (after stripping) is empty [1]. As a result indirectsymoff keeps old value, which is garbage, and can point past offset+size of the last load command. As a result totalSize() returns size that is larger than the actual stripped MachO [2].

This clearly violates one of the checks mentioned above (there are zero-bytes filled past offset+size of the last load command.

[1]

llvm-project/llvm/lib/ObjCopy/MachO/MachOLayoutBuilder.cpp

Lines 364 to 368 in ec41462

    
           if (!O.IndirectSymTable.Symbols.empty()) { 
        
             MLC.dysymtab_command_data.indirectsymoff = StartOfIndirectSymbols; 
        
             MLC.dysymtab_command_data.nindirectsyms = 
        
                 O.IndirectSymTable.Symbols.size(); 
        
           }

[2]

llvm-project/llvm/lib/ObjCopy/MachO/MachOWriter.cpp

Lines 92 to 94 in ec41462

    
           if (DySymTabCommand.indirectsymoff) 
        
             Ends.push_back(DySymTabCommand.indirectsymoff + 
        
                            sizeof(uint32_t) * O.IndirectSymTable.Symbols.size());

Let's say we've run llvm-strip over some MachO. The resulting MachO became smaller and there are no indirect symbols anymore. Then according to previous code we would not update indirectsymoff field. This would lead to `MachOWriter::totalSize()` report size that is larger than the new MachO. As a result we would get MachO that has zero bytes past contents of the very last load command. Codesign has a strict check that size of MachO file must be equal to lastLoadCommand.offset + lastLoadCommand.size If this is not satisfied codesign reports the following error main executable failed strict validation Fixes llvm#117723

Let's say we've run llvm-strip over some MachO. The resulting MachO became smaller and there are no indirect symbols anymore. Then according to previous code we would not update indirectsymoff field. This would lead to `MachOWriter::totalSize()` report size that is larger than the new MachO. As a result we would get MachO that has zero bytes past contents of the very last load command. Codesign has a strict check that size of MachO file must be equal to lastLoadCommand.offset + lastLoadCommand.size If this is not satisfied codesign reports the following error main executable failed strict validation Fixes #117723

RIscRIpt added bug Indicates an unexpected problem or unintended behavior platform:macos tools:llvm-objcopy/strip labels Nov 26, 2024

RIscRIpt self-assigned this Nov 26, 2024

RIscRIpt added the llvm:binary-utilities label Nov 26, 2024

RIscRIpt linked a pull request Nov 26, 2024 that will close this issue

[llvm-objcopy] Always update indirectsymoff in MachO #117726

Merged

RIscRIpt mentioned this issue Nov 26, 2024

[llvm-objcopy] Always update indirectsymoff in MachO #117726

Merged

EugeneZelenko removed the llvm:binary-utilities label Nov 26, 2024

RIscRIpt closed this as completed in #117726 Nov 29, 2024

EugeneZelenko removed the bug Indicates an unexpected problem or unintended behavior label Nov 29, 2024

jieyouxu mentioned this issue Mar 9, 2025

iOS binaries crash with latest nightly rust-lang/rust#138212

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Artificial MachO binary processed by llvm-objcopy/strip is not accepted by codesign #117723

Artificial MachO binary processed by llvm-objcopy/strip is not accepted by codesign #117723

RIscRIpt commented Nov 26, 2024

llvmbot commented Nov 26, 2024

Investigation

Relevant requirement

Problem description

llvmbot commented Nov 26, 2024

Investigation

Relevant requirement

Problem description

Artificial MachO binary processed by llvm-objcopy/strip is not accepted by codesign #117723

Artificial MachO binary processed by llvm-objcopy/strip is not accepted by codesign #117723

Comments

RIscRIpt commented Nov 26, 2024

Symptom

Investigation

Relevant requirement

Problem description

llvmbot commented Nov 26, 2024

Investigation

Relevant requirement

Problem description

llvmbot commented Nov 26, 2024

Investigation

Relevant requirement

Problem description