Help/Support Ghidra | Unable to find function offset (Mach-O Executable)

[Game Sphere 15 iPhone 14 Pro Max 16.0]

Hello everyone! I am having an issue when analyzing the Mach-O executable for the IOS Application: Subway Surfers inside of Ghidra. I will lay out the thread with the steps I have successfully taken, and outline where the issue that I am facing occurs. Any insight into why this issue could be occurring would be greatly appreciated, I'm here to learn, and if there are things that I am doing incorrectly, or could be doing differently, please let me know.

 

Steps Taken So Far:

1. Extracted the IPA File:

   • I have successfully extracted the Subway Surfers IPA to locate the key files, including the Mach-O executable and global-metadata.dat.

2. Confirmed Global-Metadata.dat:

   • Located the global-metadata.dat file in the Metadata folder, which is crucial for dumping the IL2CPP structures.

3. Dumped IL2CPP:

   • Used IL2CPP Dumper on both the Mach-O executable and global-metadata.dat to extract the dump.cs and script.json files.
   • These files include critical information about game methods, classes, and offsets, including the ColliderEnable property.

4. Imported the Mach-O Executable into Ghidra:

   • I have imported the Subway Surfers Mach-O executable into Ghidra for analysis. I set the processor language to AARCH64: AppleSilicon (default) and used the Mac OS X Mach-O format for import.

5. Attempted to Locate the Function Offset:

   • Based on the dump.cs output, I attempted to find the ColliderEnable function using its RVA (Relative Virtual Address) from IL2CPP Dumper:
     • get_ColliderEnable: RVA = 0x29E60
     • set_ColliderEnable: RVA = 0x29E80
   • I calculated the absolute memory address by adding the base address of 0x100000000 (as determined from the Memory Map in Ghidra) to these RVAs:
     • get_ColliderEnable: 0x100029E60
     • set_ColliderEnable: 0x100029E80
   • However, when using Ghidra’s “Go To” function to navigate to these addresses, we consistently receive a “no results” error.

6. Reanalyzed the Mach-O Executable:

   • I reanalyzed the file in Ghidra, enabling all necessary analysis passes (function identification, instruction decoding, etc.).
   • I also attempted to search for function names and program text (e.g., ColliderEnable) manually, but the function still could not be found.

7. Encountered Swift Demangler Issues:

   • Ghidra reported an error about missing Swift demangling tools, leading to the possibility that Ghidra is struggling with sections of the binary related to Swift. I considered that Swift dependencies might interfere with the analysis process and installed Swift onto my machine.

The Issue I am Facing in Ghidra:

• Despite importing the Mach-O binary correctly and reanalyzing the file, Ghidra is unable to locate the function offsets or names for ColliderEnable (or other related methods) based on the RVAs provided by IL2CPP Dumper.
• I have already verified that the base address and RVA calculation are correct (using the memory map), but Ghidra still returns “no results” when navigating to the calculated addresses.
• The Swift demangler error may be preventing full analysis or proper resolution of some sections of the binary, but the specific connection to this issue is unclear.

What I Need Help With:

• Understanding why Ghidra can’t find the function offset even though the base address and RVAs seem correct.
• Determining if the Swift-related errors could be affecting our ability to locate the function.
• Identifying any potential additional steps or configurations in Ghidra to resolve this issue (or if another tool might handle this better - I don't have IDA).

I appreciate any insight into why this issue could be occurring. If there is something that I am overlooking, I would greatly appreciate any additional information so that I can learn how to resolve this.

[Laxus 786.5k iPhone 5s 10.3.3]

You do not need to add 0x1000000 if the executable is the Frameworks

Just go to that RVA offset

[Game Sphere 15 iPhone 14 Pro Max 16.0]

  On 9/8/2024 at 1:36 PM, Laxus said:

You do not need to add 0x1000000 if the executable is the Frameworks

Just go to that RVA offset

Expand  

Interesting, I wasn't aware of this. I will give this a try. Thanks.

Edit: The issue still persists, I could only imagine that I am somehow importing the Mach-O for analyzation incorrectly.

Updated September 8, 2024 by Game Sphere
Update Result (Issue Persistence)

[Game Sphere 15 iPhone 14 Pro Max 16.0]

Bumping this as I still haven't been able to solve this issue. I'm a bit dumbfounded. For anyone that has read my original post, I have also tried importing the Mach-O Executable into Hopper, Ghidra, and Cutter. All of which I am having the same issues with. It leaves me with the thoughts that I must be importing incorrectly, or something along those lines, but any input would be appreciated as I'm stumped.