NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
49.06k stars 5.65k forks source link

Docs: Add instruction for MacOS to avoid unverified developer error #6625

Open alexdevsec opened 2 weeks ago

alexdevsec commented 2 weeks ago

If MacOS users run this one line before installation, they can avoid the whole "unverified binaries" error.

The following situation exists for MacOS users:

MacOS is doing what it should. Browsers (like Safari/Chrome) mark downloaded zip files with the "com.apple.quarantine" extended attribute. On unpacking, programs like unzip or MacOS archive (but not tar) then mark all files within with that flag. MacOS blocks running those binaries, causing decompilation, etc to block.

Yes, the user can go to Preferences->Security & Privacy and allow the override. This is awkward because you need to go through this process for each time a new binary is encountered.

Removing the com.apple.quarantine attribute on the zip file before unpacking solves all of this.

error

alexdevsec commented 2 weeks ago

This is my first time doing a pull request for Ghidra.