MachObfuscator icon indicating copy to clipboard operation
MachObfuscator copied to clipboard
verified publisher icon kam800

Nothing obfuscated in macOS binary

Open arielelkin opened this issue 3 years ago • 5 comments

I'm trying to obfuscate a universal binary (arm64+x86) for macOS, but running MachObfuscator has no effect. Here's the output:

$ ./foldername/App/MachObfuscator -v ./foldername/App/MyApp.app
Will obfuscate file:///Users/username/MyApp-macOS/foldername/App/MyApp.app/
Looking for dependencies...
WARN: Unable to resolve dylib path /usr/lib/libc++.1.dylib
WARN: Unable to resolve dylib path /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
WARN: Unable to resolve dylib path /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
WARN: Unable to resolve dylib path /usr/lib/libobjc.A.dylib
WARN: Unable to resolve dylib path /usr/lib/libSystem.B.dylib
WARN: Unable to resolve dylib path /System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation
WARN: Unable to resolve dylib path /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
WARN: Unable to resolve dylib path /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
WARN: Unable to resolve dylib path /System/Library/Frameworks/Combine.framework/Versions/A/Combine
WARN: Unable to resolve dylib path /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
WARN: Unable to resolve dylib path /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
WARN: Unable to resolve dylib path /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
WARN: Unable to resolve dylib path /System/Library/Frameworks/CoreMedia.framework/Versions/A/CoreMedia
WARN: Unable to resolve dylib path /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
WARN: Unable to resolve dylib path /System/Library/Frameworks/Security.framework/Versions/A/Security
WARN: Unable to resolve dylib path /System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement
WARN: Unable to resolve dylib path /System/Library/Frameworks/StoreKit.framework/Versions/A/StoreKit
WARN: Unable to resolve dylib path /System/Library/Frameworks/SwiftUI.framework/Versions/A/SwiftUI
WARN: Unable to resolve dylib path /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
WARN: Unable to resolve dylib path /usr/lib/libsqlite3.dylib
WARN: Unable to resolve dylib path /usr/lib/libz.1.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftAVFoundation.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftAppKit.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCore.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreAudio.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreData.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreFoundation.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreGraphics.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreImage.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreMIDI.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreMedia.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftDarwin.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftDispatch.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftFoundation.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftIOKit.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftMetal.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftObjectiveC.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftQuartzCore.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftUniformTypeIdentifiers.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftXPC.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftos.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftsimd.dylib
WARN: Unable to resolve dylib path /usr/lib/libc++.1.dylib
WARN: Unable to resolve dylib path /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
WARN: Unable to resolve dylib path /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
WARN: Unable to resolve dylib path /usr/lib/libobjc.A.dylib
WARN: Unable to resolve dylib path /usr/lib/libSystem.B.dylib
WARN: Unable to resolve dylib path /System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation
WARN: Unable to resolve dylib path /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
WARN: Unable to resolve dylib path /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
WARN: Unable to resolve dylib path /System/Library/Frameworks/Combine.framework/Versions/A/Combine
WARN: Unable to resolve dylib path /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
WARN: Unable to resolve dylib path /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
WARN: Unable to resolve dylib path /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
WARN: Unable to resolve dylib path /System/Library/Frameworks/CoreMedia.framework/Versions/A/CoreMedia
WARN: Unable to resolve dylib path /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
WARN: Unable to resolve dylib path /System/Library/Frameworks/Security.framework/Versions/A/Security
WARN: Unable to resolve dylib path /System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement
WARN: Unable to resolve dylib path /System/Library/Frameworks/StoreKit.framework/Versions/A/StoreKit
WARN: Unable to resolve dylib path /System/Library/Frameworks/SwiftUI.framework/Versions/A/SwiftUI
WARN: Unable to resolve dylib path /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
WARN: Unable to resolve dylib path /usr/lib/libsqlite3.dylib
WARN: Unable to resolve dylib path /usr/lib/libz.1.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftAVFoundation.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftAppKit.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCore.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreAudio.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreData.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreFoundation.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreGraphics.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreImage.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreMIDI.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreMedia.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftDarwin.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftDispatch.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftFoundation.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftIOKit.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftMetal.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftObjectiveC.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftQuartzCore.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftUniformTypeIdentifiers.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftXPC.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftos.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftsimd.dylib
WARN: Unable to resolve dylib path /usr/lib/libSystem.B.dylib
WARN: Unable to resolve dylib path /usr/lib/libSystem.B.dylib
WARN: Unable to resolve dylib path /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
WARN: Unable to resolve dylib path /usr/lib/libc++.1.dylib
WARN: Unable to resolve dylib path /usr/lib/libSystem.B.dylib
WARN: Unable to resolve dylib path /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
WARN: Unable to resolve dylib path /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
WARN: Unable to resolve dylib path /usr/lib/libc++.1.dylib
WARN: Unable to resolve dylib path /usr/lib/libSystem.B.dylib
WARN: Unable to resolve dylib path /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
WARN: Unable to resolve dylib path /usr/lib/libc++.1.dylib
WARN: Unable to resolve dylib path /usr/lib/libSystem.B.dylib
WARN: Unable to resolve dylib path /usr/lib/libc++.1.dylib
WARN: Unable to resolve dylib path /usr/lib/libSystem.B.dylib
WARN: Unable to resolve dylib path /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
WARN: Unable to resolve dylib path /usr/lib/libobjc.A.dylib
WARN: Unable to resolve dylib path /usr/lib/libSystem.B.dylib
WARN: Unable to resolve dylib path /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
WARN: Unable to resolve dylib path @rpath/libswiftAppKit.dylib
WARN: Unable to resolve dylib path @rpath/libswiftCloudKit.dylib
WARN: Unable to resolve dylib path @rpath/libswiftCore.dylib
WARN: Unable to resolve dylib path @rpath/libswiftCoreData.dylib
WARN: Unable to resolve dylib path @rpath/libswiftCoreFoundation.dylib
WARN: Unable to resolve dylib path @rpath/libswiftCoreGraphics.dylib
WARN: Unable to resolve dylib path @rpath/libswiftCoreImage.dylib
WARN: Unable to resolve dylib path @rpath/libswiftCoreLocation.dylib
WARN: Unable to resolve dylib path @rpath/libswiftDarwin.dylib
WARN: Unable to resolve dylib path @rpath/libswiftDispatch.dylib
WARN: Unable to resolve dylib path @rpath/libswiftFoundation.dylib
WARN: Unable to resolve dylib path @rpath/libswiftIOKit.dylib
WARN: Unable to resolve dylib path @rpath/libswiftMetal.dylib
WARN: Unable to resolve dylib path @rpath/libswiftObjectiveC.dylib
WARN: Unable to resolve dylib path @rpath/libswiftQuartzCore.dylib
WARN: Unable to resolve dylib path @rpath/libswiftXPC.dylib
WARN: Unable to resolve dylib path /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
WARN: Unable to resolve dylib path /usr/lib/libobjc.A.dylib
WARN: Unable to resolve dylib path /usr/lib/libSystem.B.dylib
WARN: Unable to resolve dylib path /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftAppKit.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCloudKit.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCore.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreData.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreFoundation.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreGraphics.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreImage.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftCoreLocation.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftDarwin.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftDispatch.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftFoundation.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftIOKit.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftMetal.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftObjectiveC.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftQuartzCore.dylib
WARN: Unable to resolve dylib path /usr/lib/swift/libswiftXPC.dylib
#Looking for dependencies - execution took 0.21558105945587158 seconds
5 obfuscable images
0 obfuscable NIBs
Collecting symbols...
#systemSources - execution took 6.079673767089844e-06 seconds
#userSources - execution took 0.02683401107788086 seconds
#systemHeaderSymbols - execution took 5.3048133850097656e-05 seconds
#Build obfuscation symbols - execution took 0.23432302474975586 seconds
2624 obfuscable selectors
0 obfuscable classes
24824 unobfuscable selectors
12447 unobfuscable classes
Mangling symbols...
2534 mangled selectors
0 mangled classes
Obfuscating file:///Users/username/MyApp-macOS/foldername/App/MyApp.app/Contents/Frameworks/MyAppMiddleware.framework/Versions/A/Frameworks/libMyApp-middleware.dylib
App/Mach+Replacing.swift:67: Fatal error
zsh: illegal hardware instruction  ./foldername/App/MachObfuscator -v ./foldername/App/MyApp.app

Despite the output saying that there "2534 mangled selectors", I can still see them in cleartext if I check the binary on MachOView.

Related to https://github.com/kam800/MachObfuscator/issues/115 ?

arielelkin avatar Mar 21 '22 09:03 arielelkin

@kam800 any thoughts?

arielelkin avatar Mar 24 '22 12:03 arielelkin

Thanks @arielelkin for reporting that.

Look like MachObfuscator crashes:

App/Mach+Replacing.swift:67: Fatal error
zsh: illegal hardware instruction  ./foldername/App/MachObfuscator -v ./foldername/App/MyApp.app

Unfortunately I identified two problems.

First problem MachObfuscator does not recognize new export trie command (LC_DYLD_EXPORTS_TRIE). MachObfuscator currently only recognizes old LC_DYLD_INFO_ONLY command. This involves implementing new export trie format parsing. The simple workaround for this seems to be choosing older Deployment Target: 11.X should does the job.

Second problem These all WARN: Unable to resolve dylib path are caused by system libraries being moved to a single shared dyld cache file. MachObfuscator does not use dyld shared cache in this moment. There is no simple workaround now. I need to implement dyld cache parsing in MachObfuscator.

I will update README.md that MachObfuscator:

  • does not support binaries with minimum Deployment Target >= 12.X,
  • does not run on macOS Deployment Target >= 12.X.

I will try to fix both problems, but I can not provide you any timeline.

kam800 avatar Mar 27 '22 22:03 kam800

@kam800 thanks for looking into this. Note that our app is already targeting macOS 11.0, so it could be that the issue has to do with some other factor...

arielelkin avatar Mar 28 '22 10:03 arielelkin

Interesting. I will start with solving the Second problem. I the mean time I will reverify the deployment target workaround. Thank you for writing this.

kam800 avatar Mar 28 '22 21:03 kam800

Hello @kam800 any updates on the deployment target workaround?

arielelkin avatar Apr 12 '22 16:04 arielelkin