Skip to content

Commit

Permalink
Added support for MachO
Browse files Browse the repository at this point in the history
  • Loading branch information
dhondta committed Sep 29, 2023
1 parent 8bac681 commit 4526a33
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 8 deletions.
Binary file modified docs/logo.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 1 addition & 1 deletion src/reminder/VERSION.txt
Original file line number Diff line number Diff line change
@@ -1 +1 @@
1.1.0
1.1.1
17 changes: 10 additions & 7 deletions src/reminder/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@
THRESHOLDS = {
'default': 6.85,
'PE': 6.85,
#'ELF': TODO
#'MACHO': TODO
}


Expand All @@ -23,17 +25,18 @@ def _get_ep_and_section(self):
:param binary: LIEF-parsed binary object
:return: (binary_type, ep_file_offset, name_of_ep_section)
"""
btype, fn = str(type(self.binary)).split(".")[1], os.path.basename(self.binary.name)
bn = self.binary
btype, fn = bn.format.name, os.path.basename(bn.name)
try:
if btype == "ELF":
ep = self.binary.virtual_address_to_offset(self.binary.entrypoint)
if btype in ["ELF", "MACHO"]:
ep = bn.virtual_address_to_offset(bn.entrypoint)
# e.g. with UPX, the section table header gets packed too, hence LIEF gives 0 section parsed
ep_section = self.binary.section_from_offset(ep) if len(self.binary.sections) > 0 else None
ep_section = bn.section_from_offset(ep) if len(bn.sections) > 0 else None
# when #sections=0, the sample will be considered as packed anyway, so set wflag=False
wflag = ep_section.has(lief.ELF.SECTION_FLAGS.WRITE) if len(self.binary.sections) > 0 else False
wflag = ep_section.has(lief.ELF.SECTION_FLAGS.WRITE) if len(bn.sections) > 0 else False
elif btype == "PE":
ep = self.binary.rva_to_offset(self.binary.optional_header.addressof_entrypoint)
ep_section = self.binary.section_from_rva(self.binary.optional_header.addressof_entrypoint)
ep_addr = bn.optional_header.addressof_entrypoint
ep, ep_section = bn.rva_to_offset(ep_addr), bn.section_from_rva(ep_addr)
wflag = ep_section.has_characteristic(lief.PE.SECTION_CHARACTERISTICS.MEM_WRITE)
else:
if self.logger:
Expand Down

0 comments on commit 4526a33

Please sign in to comment.