Skip to content

Add a CaRT-wrapped Mach-O executable - #190

Open
zardus wants to merge 2 commits into
masterfrom
feature/cart-macho-fixture
Open

Add a CaRT-wrapped Mach-O executable#190
zardus wants to merge 2 commits into
masterfrom
feature/cart-macho-fixture

Conversation

@zardus

@zardus zardus commented Aug 24, 2026

Copy link
Copy Markdown
Member

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Problem

cle asserts that a Mach-O MH_EXECUTE is the loader's main binary. That is false for one loaded as a container child: the container registers itself as the main object while the child loads, so the child sees is_main_bin=False and trips the assertion before the loader can promote it. No fixture in the repository reaches that path — tests/x86_64/ has CaRT-wrapped PE and ELF objects but no Mach-O.

Root cause

Not a defect here — a gap. The two existing .cart fixtures cover the backends whose assertions happen to tolerate being loaded as a child.

Fix

tests/x86_64/fauxware.macho.cart is the existing tests/x86_64/fauxware.macho wrapped in a CaRT container with the same ARC4 key as the two .cart fixtures already here. It unpacks byte for byte to that file, so it introduces no new binary content — only a new container around content the repository already ships.

Testing

angr/binaries has no test suite of its own, so the assertion is the consumer's. With binaries at master the consumer's tests/test_cart.py::test_cart_macho fails on the missing file; with this branch the whole file passes, including the placement and entry assertions that match the direct load in test_macho.py. Both runs are in the comment below, with cle held at one head. Consumed by angr/cle#780

Validation: #190 (comment)

session: sharpen

@zardus
zardus force-pushed the feature/cart-macho-fixture branch 2 times, most recently from 78732a8 to ede0e1d Compare August 28, 2026 01:37
@zardus

zardus commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Validation record for head ede0e1d90b850a44f5732518bba37214713ae843 against baseline 3bfd1de09dd357deafbe29b4075aa55a9379ce50.

  • Fixture: tests/x86_64/fauxware.macho.cart, 1773 bytes, sha256 a8d90dd88e49b6e0…
  • Provenance: the existing tests/x86_64/fauxware.macho wrapped with the public CaRT container format; no new source binary is introduced
  • Consumer: Load a Mach-O MH_EXECUTE that a container backend owns cle#780, whose MachO container-backend test loads this file; the test fails on binaries master with the file absent and passes with this branch checked out
  • Repository suites: binaries carries no test suite of its own, so there is nothing here to run; the assertion above is the consumer's

Caveat: this fixture is exercised only through its consumer. Until angr/cle#780 merges, nothing on binaries master reads it.

@zardus

zardus commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

What this fixture moves, shown through its consumer. angr/cle#780 is held at cd51b1125 for both runs; only angr/binaries changes.

Before — the container test cannot run, because the file it loads does not exist:

angr/binaries master (3bfd1de)
$ python -m pytest -q tests/test_cart.py
FAILED tests/test_cart.py::test_cart_macho - cle.errors.CLEFileNotFoundError: ...
1 failed, 5 passed in 0.52s

After — the Mach-O MH_EXECUTE loads out of the CaRT container and the assertions on its placement and entry hold:

with this change (ede0e1d)
$ python -m pytest -q tests/test_cart.py
6 passed in 0.24s

The other five cases in that file are the pre-existing PE and ELF containers, unchanged by this branch; they are shown to make clear the delta is the one new case.

One note for anyone reproducing by hand rather than through the suite: every .cart fixture in this repository needs its ARC4 key passed as main_opts={"arc4_key": ...}. Loading one without it raises CLEInvalidEncryptionError, and this one raises CLEInvalidFileFormatError, which looks like a malformed fixture and is not.

@zardus
zardus force-pushed the feature/cart-macho-fixture branch 2 times, most recently from e8b6f82 to f4e232d Compare August 29, 2026 19:12
tests/x86_64/fauxware.macho.cart is tests/x86_64/fauxware.macho wrapped in a
CaRT container with the same ARC4 key the other .cart fixtures in that
directory use. cle needs a Mach-O MH_EXECUTE inside a container backend to
cover loading one as a container child.
@zardus
zardus force-pushed the feature/cart-macho-fixture branch from f4e232d to f3dd719 Compare August 30, 2026 03:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant