Page 1 of 1

MacOS Mach-O executable fails to save at WriteToFile

Posted: Thu Feb 01, 2018 7:46 am
by liamxx
I am attempting to protect a Mach-O executable VMProtect, but when it gets to the "saving startup code" stage it will fail with the output file disappearing at any arbitrary point in the process. I have attempted to fix this by testing a variety of settings with no luck. Currently, I have every protection setting turned to off (debugger, packing, etc.) but am still receiving the WriteToFile runtime error (it will successfully compile with no protected functions or strings, though). I am using VMProtect Professional v 3.1.2 build 830.

I am willing to share my program through private means. Thanks in advance.

Re: MacOS Mach-O executable fails to save at WriteToFile

Posted: Thu Feb 01, 2018 9:35 am
by liamxx
After careful investigation, I have discovered that my application will ONLY compile if all optimizations (-O2, in my case) and loader paths are not changed. Before I protect my application, I use install_name_tool to fix the loader paths to some libraries and -O2 to increase performance and decrease size, so I'd much rather prefer to be able to do both.

Re: MacOS Mach-O executable fails to save at WriteToFile

Posted: Thu Feb 01, 2018 9:50 am
by Admin
"Runtime error at WriteToFile" means that your binary has no enough space in the Mach-O header for adding a new segment.

Re: MacOS Mach-O executable fails to save at WriteToFile

Posted: Thu Feb 01, 2018 11:42 pm
by liamxx
After dissecting a working executable and the broken one, I can see what you mean:
Image

Optimizations definitely delete most of the free space in the header. It was only until I removed the -O2 flag for my program (replacing it with -O1 which only optimizes speed) that it was able to compile with enough free space in the header. It would be quite nice if VMProtect could allocate more header space automatically, but other than that my problem is solved.

Re: MacOS Mach-O executable fails to save at WriteToFile

Posted: Fri Feb 02, 2018 3:48 am
by Admin
VMProtect uses all free space between Mach-O header and the first section (in your case it's the "__text") for storing of new segments and sections. Please notice that the "__text" can't be moved in other part of file because this trick will "kill" all references between "__text" and other sections. Only compiler without size optimization can do it.

Re: MacOS Mach-O executable fails to save at WriteToFile

Posted: Mon Sep 03, 2018 5:42 pm
by Vlad
Надежный способ исправить проблему протекции "[Error] Runtime error at WriteToFile" — это использовать ключ линковщика -headerpad [size], где size - это количество байт, необходимых vmprotect.
Specifies the minimum space for future expansion of the load
commands. Only useful if intend to run install_name_tool to
alter the load commands later. Size is a hexadecimal number.
Пример: -headerpad 0x500.
Актуально для LD.

Re: MacOS Mach-O executable fails to save at WriteToFile

Posted: Tue Sep 04, 2018 3:43 am
by Admin
Проблема с определением размера, необходимого VMProtect в том, что размер заголовка напрямую зависит не только от размера нового сегмента и секций, но и для названия DLL, необходимых нашему рантайму/распаковщику. Т.е. размер можно подобрать только методом тыка :))