Mach-O Binary Support about fq

[Akaame]

I actually wanted to copy elf decoder and change necessary bits until it works for mach-o binaries (and archives) over the New Year's break. Should I wait for the improved decoder or get to work?

[wader]

Ok nice! Dont thank i will work much on the elf decoder the next few days, away skiiing! You can find the elf improvments WIP PR here #40

[Akaame]

@zhangkaizhao Hello, we are getting there with the overall macho support.

You can however test the impl in the PR: #51

by simply fetching the repo and running

go run fq.go . mdbook

[wader]

Hi, yes that is the plan. Im currently working on an improved elf decoder and i hope other executable formats wont be that much different. Is it something you would like to help work on?

[wader]

The tricky part for elf is that you have to do some kind of two-pass as the string tables might come after they are used

[zhangkaizhao]

I ran the fq cli on the mdbook cli and got strange output on macOS Monterey 12.1 x86_64:

uname -mrs
Darwin 21.2.0 x86_64
$ fq --version
0.0.3
$ mdbook --version
mdbook v0.4.15
$ file fq
fq: Mach-O 64-bit executable x86_64
$ file mdbook
mdbook: Mach-O 64-bit executable x86_64
$ fq . mdbook
        |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d|0123456789abcd|.{}: mdbook (mp3)
        |                                         |              |  headers[0:0]:
0x000000|cf fa ed fe 07 00 00 01 03 00 00 00 02 00|..............|  unknown0: raw bits
*       |until 0x64ac.7 (25773)                   |              |
0x0064a0|                                       ff|             .|  frames[0:2]:
0x0064ae|e2 a8 01 0f 85 31 09 00 00 44 8b bd c8 fa|.....1...D....|
*       |until 0x8926.7 (9338)                    |              |
0x006b76|                  00 00 00 48 8d b5 30 fc|      ...H..0.|  unknown1: raw bits
0x006b84|ff ff 48 89 b5 48 fd ff ff 48 c7 85 50 fd|..H..H...H..P.|
*       |until 0x86d7.7 (7004)                    |              |
        |                                         |              |  footers[0:0]:
0x00891a|                                       a5|             .|  unknown2: raw bits
0x008928|48 fd ff ff 48 c7 85 50 fd ff ff 00 00 00|H...H..P......|
*       |until 0xabf3cf.7 (end) (11233961)        |              |

The binary of the fq cli is downloaded and extracted from https://github.com/wader/fq/releases/download/v0.0.3/fq_0.0.3_macos_amd64.tar.gz.
The binary of the mdbook cli is downloaded and extracted from https://github.com/rust-lang/mdBook/releases/download/v0.4.15/mdbook-v0.4.15-x86_64-apple-darwin.tar.gz.

[wader]

Hi, version 0.0.3 does not have macho support, hopefully maybe next release or so. What you'r seeing is that the mp3 decoder falsely thinks it has decoded a mp3 file, that should probably be corrected somehow. Sadly mp3 is a quite hard format to detect without false positives as mp3 frames has few unique characteristics (depending on how broken mp3s you wan to allow).

If this would happen with a format fq supports you could do -d <format> to override.

[wader]

Fixed by #51