search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
52.24k stars 5.92k forks source link

Ghidra 10.2 throws exception when opening a MacOS KDK #4724

Closed blackdog64 closed 2 years ago

blackdog64 commented 2 years ago

Up until Ghidra 10.1.5, I was able to open a kernel image from the MacOS KDK. With Ghidra 10.2, the following exception is thrown when attempting to open a kernel cache, e.g. /Library/Developer/KDKs/KDK_12.4_21F79.kdk/System/Library/Kernels/kernel.release.t8020:

ghidra.util.exception.NotFoundException: __LINKEDIT <no section> was not found as child of __LINKEDIT
java.io.IOException: ghidra.util.exception.NotFoundException: __LINKEDIT <no section> was not found as child of __LINKEDIT
    at ghidra.app.util.opinion.MachoLoader.load(MachoLoader.java:109)
    at ghidra.app.util.opinion.AbstractLibrarySupportLoader.doLoad(AbstractLibrarySupportLoader.java:724)
    at ghidra.app.util.opinion.AbstractLibrarySupportLoader.loadProgram(AbstractLibrarySupportLoader.java:98)
    at ghidra.app.util.opinion.AbstractProgramLoader.load(AbstractProgramLoader.java:126)
    at ghidra.plugin.importer.ImporterUtilities.importSingleFile(ImporterUtilities.java:368)
    at ghidra.plugin.importer.ImporterDialog.lambda$okCallback$7(ImporterDialog.java:351)
    at ghidra.util.task.TaskBuilder$TaskBuilderTask.run(TaskBuilder.java:306)
    at ghidra.util.task.Task.monitoredRun(Task.java:134)
    at ghidra.util.task.TaskRunner.lambda$startTaskThread$0(TaskRunner.java:106)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
    at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: ghidra.util.exception.NotFoundException: __LINKEDIT <no section> was not found as child of __LINKEDIT
    at ghidra.program.database.module.ModuleDB.reparent(ModuleDB.java:557)
    at ghidra.app.util.opinion.MachoProgramBuilder.fixupProgramTree(MachoProgramBuilder.java:431)
    at ghidra.app.util.opinion.MachoProgramBuilder.build(MachoProgramBuilder.java:128)
    at ghidra.app.util.opinion.MachoPrelinkProgramBuilder.build(MachoPrelinkProgramBuilder.java:85)
    at ghidra.app.util.opinion.MachoPrelinkProgramBuilder.buildProgram(MachoPrelinkProgramBuilder.java:78)
    at ghidra.app.util.opinion.MachoLoader.load(MachoLoader.java:94)
    ... 11 more

---------------------------------------------------
Build Date: 2022-Nov-01 1334 EDT
Ghidra Version: 10.2
Java Home: /Library/Java/JavaVirtualMachines/temurin-18.jdk/Contents/Home
JVM Version: Eclipse Adoptium 18.0.2
OS: Mac OS X 13.0 aarch64
ryanmkurtz commented 2 years ago

Thanks, I'll get right on this.