From 4bf13779d75176b6fba0c37fe3b614842bffa193 Mon Sep 17 00:00:00 2001 From: Mark Rowe Date: Fri, 27 Feb 2026 18:31:39 -0800 Subject: [MachO] Fix relocations from chained fixups not respecting addends The addends were correctly stored in the relocation info and displayed as offsets in linear view, but the relocation handlers never applied them. Reading from an address containing such a relocation would give an incorrect value. --- arch/arm64/arch_arm64.cpp | 4 ++-- arch/armv7/arch_armv7.cpp | 4 ++-- arch/x86/arch_x86.cpp | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/arch/arm64/arch_arm64.cpp b/arch/arm64/arch_arm64.cpp index fb623e4e..b71e79e8 100644 --- a/arch/arm64/arch_arm64.cpp +++ b/arch/arm64/arch_arm64.cpp @@ -2787,8 +2787,8 @@ class Arm64MachoRelocationHandler : public RelocationHandler // printf("reloc->GetAddress(): 0x%llX\n", reloc->GetAddress()); if (info.nativeType == BINARYNINJA_MANUAL_RELOCATION) - { // Magic number defined in MachOView.cpp for tagged pointers - *(uint64_t*)dest = info.target; + { // Magic number defined in MachOView.cpp for chained fixups + *(uint64_t*)dest = info.target + info.addend; } else if (info.nativeType == ARM64_RELOC_PAGE21) { diff --git a/arch/armv7/arch_armv7.cpp b/arch/armv7/arch_armv7.cpp index fdd1bad7..f9fc250e 100644 --- a/arch/armv7/arch_armv7.cpp +++ b/arch/armv7/arch_armv7.cpp @@ -2684,8 +2684,8 @@ public: { auto info = reloc->GetInfo(); if (info.nativeType == BINARYNINJA_MANUAL_RELOCATION) - { // Magic number defined in MachOView.cpp for tagged pointers - *(uint32_t*)dest = (uint32_t)info.target; + { // Magic number defined in MachOView.cpp for chained fixups + *(uint32_t*)dest = (uint32_t)(info.target + info.addend); } return true; diff --git a/arch/x86/arch_x86.cpp b/arch/x86/arch_x86.cpp index a79163da..f639040e 100644 --- a/arch/x86/arch_x86.cpp +++ b/arch/x86/arch_x86.cpp @@ -4117,10 +4117,10 @@ public: case (uint64_t)-1: // Magic number defined in MachOView.cpp // We need to write a jump absolute `jmp target` dest[0] = '\xe9'; - ((uint32_t*)&dest[1])[0] = target - (uint32_t)reloc->GetAddress() - 5; + ((uint32_t*)&dest[1])[0] = target + (uint32_t)info.addend - (uint32_t)reloc->GetAddress() - 5; break; case (uint64_t)-2: // Magic number defined in MachOView.cpp - dest32[0] = target; + dest32[0] = target + (uint32_t)info.addend; break; case GENERIC_RELOC_VANILLA: switch (info.size) @@ -4307,7 +4307,7 @@ public: dest64[0] = dest64[0] + info.next->target - target; break; case (uint64_t) -2: - dest64[0] = reloc->GetTarget(); + dest64[0] = info.target + info.addend; break; } return true; -- cgit v1.3.1