Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ghidra appearing to not find referenced libraries #110

Closed
Kreeblah opened this issue Mar 8, 2019 · 3 comments
Closed

Ghidra appearing to not find referenced libraries #110

Kreeblah opened this issue Mar 8, 2019 · 3 comments
Assignees
Labels
Feature: Loader/Mach-O Status: Internal This is being tracked internally by the Ghidra team Type: Bug Something isn't working
Milestone

Comments

@Kreeblah
Copy link
Contributor

Kreeblah commented Mar 8, 2019

Describe the bug
When I try to import certain binaries, Ghidra warns that it can't find some referenced library files. Except, when I look at the locations where it says they weren't found, they're there.

To Reproduce
Steps to reproduce the behavior:

  1. Use Homebrew to install xz (brew install xz)
  2. Create a new project in Ghira
  3. Import the xz binary into Ghira
  4. Leave the default import settings
  5. See the below error:

----- Loading /usr/local/Cellar/xz/5.2.4/bin/xz -----
Skipping segment: __PAGEZERO (xz)
[/usr/local/Cellar/xz/5.2.4/lib/liblzma.5.dylib] -> not found
[/usr/lib/libSystem.B.dylib] -> not found

  1. Look for the referenced libraries:

$ ls -l /usr/local/Cellar/xz/5.2.4/lib/liblzma.5.dylib
-r--r--r-- 1 user staff 134356 Feb 9 17:06 /usr/local/Cellar/xz/5.2.4/lib/liblzma.5.dylib

$ ls -l /usr/lib/libSystem.B.dylib
-rwxr-xr-x 1 root wheel 60880 Jan 15 17:21 /usr/lib/libSystem.B.dylib

Expected behavior
I'd expect that warning to not show up, and for the import to finish cleanly.

Environment (please complete the following information):

  • OS: macOS 10.14.3
  • Java: OpenJDK 11.0.2+9
  • Ghidra: 9.0_PUBLIC_20190228
  • xz binary version: 5.2.4

Additional context
I'm also wondering whether this could be related to the following errors I receive after analyzing the binary using the default analysis settings:

Failed to create "no return" function __la_symbol_ptr::___stack_chk_fail at 10000c078
Failed to create "no return" function __la_symbol_ptr::_exit at 10000c0a0

@Kreeblah Kreeblah added the Type: Bug Something isn't working label Mar 8, 2019
@zhangbo
Copy link

zhangbo commented Mar 12, 2019

Same issue.

Skipping segment: __PAGEZERO (Base)
[/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore] -> not found
[/System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa] -> not found
[@rpath/Sparkle.framework/Versions/A/Sparkle] -> not found
[/System/Library/Frameworks/Security.framework/Versions/A/Security] -> not found
[/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation] -> not found
[/usr/lib/libobjc.A.dylib] -> not found
[/usr/lib/libSystem.B.dylib] -> not found
[/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit] -> not found
[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation] -> not found
[/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics] -> not found

@ryanmkurtz
Copy link
Collaborator

Possibly related to #136

@adamopolous
Copy link
Contributor

Turns out this is a different animal than #136; that one describes a failure to properly parse universal binaries. This ticket is the result of failing to properly recurse through the dependencies of the external libraries being loaded. As @Kreeblah noted, the libraries exist but we don't process them.

And I don't believe this is specific to any particular binary type (at least it shouldn't be).

@ryanmkurtz ryanmkurtz self-assigned this Aug 30, 2022
@ryanmkurtz ryanmkurtz added the Status: Internal This is being tracked internally by the Ghidra team label Aug 30, 2022
@ryanmkurtz ryanmkurtz added this to the 10.2 milestone Aug 31, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: Loader/Mach-O Status: Internal This is being tracked internally by the Ghidra team Type: Bug Something isn't working
Projects
None yet
Development

No branches or pull requests

4 participants