Skip to content

[MachO] Recognize arm64e.x1 and other new Mach-O slice variants #8572

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bdash merged 1 commit into from
Sep 22, 2026
+69 −2
Merged

[MachO] Recognize arm64e.x1 and other new Mach-O slice variants #8572

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions plugins/bntl_utils/src/tbd.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,15 @@ pub enum TbdArchitecture {
Armv7s,
Armv7k,
Arm64,
#[serde(rename = "arm64.x1")]
Arm64X1,
#[serde(rename = "arm64.x2")]
Arm64X2,
Arm64e,
#[serde(rename = "arm64e.x1")]
Arm64eX1,
#[serde(rename = "arm64e.x2")]
Arm64eX2,
}

impl TbdArchitecture {
Expand All @@ -217,7 +225,11 @@ impl TbdArchitecture {
TbdArchitecture::Armv7s => CoreArchitecture::by_name("armv7"),
TbdArchitecture::Armv7k => CoreArchitecture::by_name("armv7"),
TbdArchitecture::Arm64 => CoreArchitecture::by_name("aarch64"),
TbdArchitecture::Arm64X1 => CoreArchitecture::by_name("aarch64"),
TbdArchitecture::Arm64X2 => CoreArchitecture::by_name("aarch64"),
TbdArchitecture::Arm64e => CoreArchitecture::by_name("aarch64"),
TbdArchitecture::Arm64eX1 => CoreArchitecture::by_name("aarch64"),
TbdArchitecture::Arm64eX2 => CoreArchitecture::by_name("aarch64"),
}
}
}
Expand All @@ -234,7 +246,11 @@ impl FromStr for TbdArchitecture {
"armv7s" => Ok(TbdArchitecture::Armv7s),
"armv7k" => Ok(TbdArchitecture::Armv7k),
"arm64" => Ok(TbdArchitecture::Arm64),
"arm64.x1" => Ok(TbdArchitecture::Arm64X1),
"arm64.x2" => Ok(TbdArchitecture::Arm64X2),
"arm64e" => Ok(TbdArchitecture::Arm64e),
"arm64e.x1" => Ok(TbdArchitecture::Arm64eX1),
"arm64e.x2" => Ok(TbdArchitecture::Arm64eX2),
_ => Err(format!("Unknown architecture: {}", s)),
}
}
Expand Down Expand Up @@ -394,6 +410,19 @@ exports:
- targets: [ x86_64-macos, arm64-macos ]
symbols: [ _VTCompressionSessionCreate, _VTDecompressionSessionCreate ]
...
"#;

const V4_TBD_ARM64E_X1: &str = r#"
--- !tapi-tbd
tbd-version: 4
targets: [ x86_64-macos, x86_64-maccatalyst, arm64e-macos, arm64e-maccatalyst,
arm64e.x1-macos, arm64e.x1-maccatalyst ]
install-name: '/usr/lib/libz.1.dylib'
current-version: 1.2.12
exports:
- targets: [ x86_64-macos, arm64e-macos, arm64e.x1-macos ]
symbols: [ _deflate, _inflate ]
...
"#;

#[test]
Expand Down Expand Up @@ -430,6 +459,25 @@ exports:
assert!(has_arm64_macos);
}

#[test]
fn test_parse_v4_tbd_arm64e_x1() {
let mut cursor = Cursor::new(V4_TBD_ARM64E_X1);
let result = parse_tbd_info(&mut cursor).expect("Should parse V4 TBD with arm64e.x1");

let info = &result[0];
assert_eq!(info.targets.len(), 6);
let has_arm64e_x1_macos = info
.targets
.iter()
.any(|t| t.arch == TbdArchitecture::Arm64eX1 && t.platform == TbdPlatform::Macos);
assert!(has_arm64e_x1_macos);
let export = &info.exports[0];
assert!(export
.targets
.iter()
.any(|t| t.arch == TbdArchitecture::Arm64eX1));
}

#[test]
fn test_multi_document_parsing() {
// TBD v3+ supports multiple YAML documents in one file
Expand Down
13 changes: 12 additions & 1 deletion view/macho/fatmachoview.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,9 +49,13 @@ static bool FindMostSpecificCpuTypeSubtype(cpu_type_t cputype, cpu_subtype_t cpu
}
}
// Then, any -all arch that matches
auto allSubtypeItr = g_allSubtypeMap.find(cputype);
if (allSubtypeItr == g_allSubtypeMap.end())
return false;

for (const auto& type : *g_recognizedFatTypes)
{
if (type.cputype == cputype && type.cpusubtype == g_allSubtypeMap.at(cputype))
if (type.cputype == cputype && type.cpusubtype == allSubtypeItr->second)
{
outType = type.cpusubtype;
return true;
Expand Down Expand Up @@ -137,6 +141,9 @@ static bool ExtractFatArchForCPU(BinaryView* data, fat_arch_64& arch, cpu_type_t
continue;
}

// Mask away cpu subtype capability bits
iarch.cpusubtype &= ~MACHO_CPU_SUBTYPE_MASK;

// Make sure the passed subtype is the most specific, otherwise two different views
// will try to display the same slice
cpu_subtype_t mostSpecific;
Expand Down Expand Up @@ -227,7 +234,11 @@ void BinaryNinja::InitFatMachoViewType()
{"Fat Mach-O x86_64", "Fat Mach-O x86_64", MACHO_CPU_TYPE_X86_64, MACHO_CPU_SUBTYPE_X86_64_ALL},
{"Fat Mach-O x86", "Fat Mach-O x86", MACHO_CPU_TYPE_X86, MACHO_CPU_SUBTYPE_X86_ALL},

{"Fat Mach-O arm64e.x2", "Fat Mach-O arm64e.x2", MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64E_X2},
{"Fat Mach-O arm64e.x1", "Fat Mach-O arm64e.x1", MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64E_X1},
{"Fat Mach-O arm64e", "Fat Mach-O arm64e", MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64E},
{"Fat Mach-O arm64.x2", "Fat Mach-O arm64.x2", MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64_X2},
{"Fat Mach-O arm64.x1", "Fat Mach-O arm64.x1", MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64_X1},
{"Fat Mach-O arm64v8", "Fat Mach-O arm64v8", MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64_V8},
{"Fat Mach-O arm64", "Fat Mach-O arm64", MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64_ALL},
{"Fat Mach-O arm64_32", "Fat Mach-O arm64_32", MACHO_CPU_TYPE_ARM64_32, MACHO_CPU_SUBTYPE_ARM64_32_V8},
Expand Down
4 changes: 4 additions & 0 deletions view/macho/machoview.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,10 @@ typedef int vm_prot_t;
#define MACHO_CPU_SUBTYPE_ARM64_ALL ((cpu_subtype_t) 0)
#define MACHO_CPU_SUBTYPE_ARM64_V8 ((cpu_subtype_t) 1)
#define MACHO_CPU_SUBTYPE_ARM64E ((cpu_subtype_t) 2)
#define MACHO_CPU_SUBTYPE_ARM64_X1 ((cpu_subtype_t) 3)
#define MACHO_CPU_SUBTYPE_ARM64_X2 ((cpu_subtype_t) 4)
#define MACHO_CPU_SUBTYPE_ARM64E_X1 ((cpu_subtype_t) 12)
#define MACHO_CPU_SUBTYPE_ARM64E_X2 ((cpu_subtype_t) 13)

#define MACHO_CPU_SUBTYPE_ARM64_32_ALL ((cpu_subtype_t) 0)
#define MACHO_CPU_SUBTYPE_ARM64_32_V8 ((cpu_subtype_t) 1)
Expand Down
4 changes: 4 additions & 0 deletions view/macho/universaltransform.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,10 @@ const map<pair<cpu_type_t, cpu_subtype_t>, string>& UniversalTransform::GetArchi
{{MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64_ALL}, "arm64"},
{{MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64_V8}, "arm64v8"},
{{MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64E}, "arm64e"},
{{MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64_X1}, "arm64.x1"},
{{MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64_X2}, "arm64.x2"},
{{MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64E_X1}, "arm64e.x1"},
{{MACHO_CPU_TYPE_ARM64, MACHO_CPU_SUBTYPE_ARM64E_X2}, "arm64e.x2"},
{{MACHO_CPU_TYPE_ARM64_32, MACHO_CPU_SUBTYPE_ARM64_32_ALL}, "arm64_32"},
{{MACHO_CPU_TYPE_ARM64_32, MACHO_CPU_SUBTYPE_ARM64_32_V8}, "arm64_32v8"},
{{MACHO_CPU_TYPE_MC88000, 0}, "mc88000"},
Expand Down
2 changes: 1 addition & 1 deletion view/sharedcache/core/SharedCacheView.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ bool SharedCacheView::Init()
magic[16] = 0;

if (std::string(magic) == "dyld_v1 arm64" || std::string(magic) == "dyld_v1 arm64e"
|| std::string(magic) == "dyld_v1arm64_32")
|| std::string(magic) == "dyld_v1arm64ex1" || std::string(magic) == "dyld_v1arm64_32")
{
arch = "aarch64";
}
Expand Down
Loading