LC_DYLD_CHAINED_FIXUPS 支持不完整问题

[smallevilbeast]

从代码中可以看出，这个项目确实缺少对 LC_DYLD_CHAINED_FIXUPS 的完整处理。虽然 CHANGES.md 中提到在 v0.3.5 版本中"兼容了 LC_DYLD_CHAINED_FIXUPS 命令中的重定位"，但实际的实现并不完整。
当前实现的问题：
缺少链式修复处理：在 MachoLoader 的 _process_relocation 方法中，只处理了传统的重定位表（ARM64_RELOCATION.SUBTRACTOR 和 RelocationFixup），但没有处理 LC_DYLD_CHAINED_FIXUPS 命令。

[smallevilbeast]

binary.dyld_chained_fixups

[sledgeh4w]

感谢反馈

[smallevilbeast]

chained_fixups.py

    def _process_chained_fixups(
        self,
        binary: lief.MachO.Binary,
        module_base: int,
        symbols: List[Symbol],
    ) -> bool:
        """
        Process LC_DYLD_CHAINED_FIXUPS if present.

        Returns:
            True if chained fixups were processed, False otherwise
        """
        # Check if binary has chained fixups
        try:
            if not has_chained_fixups(binary):
                return False

            self.emu.logger.info("Detected LC_DYLD_CHAINED_FIXUPS")

            # Create a symbol resolver callback
            def resolve_symbol(symbol_name: str, lib_ordinal: int) -> Optional[int]:
                """Resolve a symbol address from import."""
                symbol_map = self.get_symbols()
                symbol_map.update({symbol.name: symbol for symbol in symbols})

                # Try to find the symbol
                reloc_addr = self._get_symbol_reloc_addr(symbol_map, symbol_name)

                if not reloc_addr:
                    # Check if we have a hook for this symbol
                    if self.emu.hooks.get(symbol_name):
                        # Create a trampoline for the hook
                        reloc_addr = self.emu.create_buffer(self.emu.arch.addr_size)
                        self.emu.add_interceptor(reloc_addr, self.emu.hooks[symbol_name])
                        self.emu.logger.info(
                            f'Hook import symbol "{symbol_name}" via chained fixups'
                        )

                return reloc_addr

            # Create processor and process fixups using LIEF's API
            processor = ChainedFixupsProcessor(
                emu=self.emu,
                binary=binary,
                module_base=module_base,
                get_symbol_address=resolve_symbol,
            )

            # Process all chained fixups
            processor.process_all()

            return True

        except AttributeError:
            # LIEF version doesn't support chained fixups or binary doesn't have them
            return False
        except Exception as e:
            self.emu.logger.warning(
                f"Error processing LC_DYLD_CHAINED_FIXUPS: {e}, falling back to legacy processing"
            )
            return False

[smallevilbeast]

大佬看看，ai修的有没有问题

[sledgeh4w]

我检查了一下目前的实现，其实是没有问题的。

关于你提到的 binary.dyld_chained_fixups，并不是必须通过它才能处理 LC_DYLD_CHAINED_FIXUPS，lief 本身就会把 binary.dyld_chained_fixups 相关的信息解析到 binary.relications 和 binary.bindings 中。

遍历 relocations:

for segment in binary.segments:
    for relocation in segment.relocations:
        if isinstance(relocation, RelocationFixup):
            pass

等价于

for entry in binary.dyld_chained_fixups.chained_starts_in_segments:
    for relocation in entry.segment.relocations:
        if isinstance(relocation, RelocationFixup):
            pass

遍历 bindings:

for binding in binary.bindings:
    pass

等价于

for binding in binary.dyld_chained_fixups.bindings:
    pass