From 2b7156c7cc52a9302b6b4669fe783bd56afd6855 Mon Sep 17 00:00:00 2001 From: Karmaz <51202595+Karmaz95@users.noreply.github.com> Date: Tue, 15 Aug 2023 18:47:26 +0200 Subject: [PATCH] Update macho_analysis.py - SYMBOLS STRIPPED False Negative (#2234) * Update macho_analysis.py PR for this issue: https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/2233 * Update macho_analysis.py Co-authored-by: Ajin Abraham --- mobsf/StaticAnalyzer/views/ios/macho_analysis.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mobsf/StaticAnalyzer/views/ios/macho_analysis.py b/mobsf/StaticAnalyzer/views/ios/macho_analysis.py index d7c562f0..7a929886 100644 --- a/mobsf/StaticAnalyzer/views/ios/macho_analysis.py +++ b/mobsf/StaticAnalyzer/views/ios/macho_analysis.py @@ -224,9 +224,12 @@ class Checksec: return bool(self.macho.encryption_info.crypt_id) def is_symbols_stripped(self): - filter_symbol = 'radr://5614542' + filter_symbols = ['radr://5614542', '__mh_execute_header'] for i in self.macho.symbols: - if (i.type & 0xe0) > 0 and i.name.lower().strip() != filter_symbol: + strip_bool = i.type & 0xe0 + strip_type = i.type in [0x0e, 0x1e, 0x0f] + sym = i.name.lower().strip() + if (strip_bool > 0 or strip_type) and sym not in filter_symbols: return False return True