10

I'm trying to launch an older app in macOS Sierra. It worked fine in El Capitan, however since the update to Sierra it crashes immediately on launch with the error…

This UPX compressed binary contains an invalid Mach-O header and cannot be loaded.

Using Homebrew in El Capitan, I installed UPX and used it to try uncompressing the binary, however this tells me that the binary is not compressed in the first place.

$ upx -d /tmp/Run.app/Contents/MacOS/Run
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2013
UPX 3.91        Markus Oberhumer, Laszlo Molnar & John Reiser   Sep 30th 2013

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
upx: /tmp/Run.app/Contents/MacOS/Run: NotPackedException: not packed by UPX

Unpacked 0 files.

This is the crash log from opening the app in Sierra.

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_CRASH (SIGKILL)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Reason:    EXEC, [0xc] This UPX compressed binary contains an invalid Mach-O header and cannot be loaded.

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib          0x00007fffcffeabb2 __posix_spawn + 10
1   libsystem_kernel.dylib          0x00007fffcffe5ef2 posix_spawn + 386
2   xpcproxy                        0x000000010dbb2d75 0x10dbb0000 + 11637
3   xpcproxy                        0x000000010dbb3992 0x10dbb0000 + 14738
4   libdyld.dylib                   0x00007fffcfebc255 start + 1

How can I get this app to open in Sierra?

  • 1
    I have the very same issue. – ɹoƃı Sep 21 '16 at 11:07
  • 2
    The unfortunate part about Apple's thinking here is assuming everyone uses UPX in a standardized way. Since UPX is an open source project it can be modified in particular ways to suit those of the developer. There was once such a thing as apps being allowed to be distributed outside the Mac App Store. Setting restrictions on such is naive and overreaching, however, it's becoming evident the idea of that is seemingly eroding away update after update. – l'L'l Sep 22 '16 at 14:43
  • Solution – grg Sep 24 '16 at 18:31
9

Revised answer:

For hiding traces, pirates zeroed the UPX markers out of the compressed binary, so it's not possible for macOS Sierra to decompress the binary. (Try with: hexdump -C YourApp.app/Contents/MacOS/YourApp | grep -C 1 UPX and see, that there is most likely no output.)

However, jreiser from UPX accepted the challenge and addressed this issue with implementing a more robust search for compressed code. v3.92 will be possible to make these apps running again when decompressing the executables with upx -d YourApp.app/Contents/MacOS/YourApp.

  • It's something Apple should fix actually, since they obviously broke what worked for apparently no reason. – l'L'l Sep 22 '16 at 14:48
  • Someone meddled with a binary (with most likely questionably content) after compressing it so it doesn't start anymore on Sierra and Apple should fix it? Well yes, absolutely right... you please tell them. :) – RyuX51 Sep 22 '16 at 15:16
  • Hey, meddling is the foundation of computing... without meddling what have we got? :p – l'L'l Sep 22 '16 at 15:23
  • Feel free to meddle with everything. But you can’t just blame everything on Apple (though from time to time it really DID become very appealing to do so). – RyuX51 Sep 22 '16 at 15:29
  • Yes that's a great point, and I understand what you are saying, however, what is the reasoning behind the now restrictive behavior one might ask. It's highly unlikely they've accomplished much in the process other than wasting a lot of everyone's time (including their own at some expense). – l'L'l Sep 22 '16 at 15:34
4

3.92-BETA revision 3 works in Sierra and works for i386!

https://www.dropbox.com/s/x765t3i42p7hr8b/upx.out?dl=0 now works for I386, too.

jreiser on github.com/upx #4 comment

3.92 supports compressing binaries in Sierra such that they can be run in Sierra, and also supports decompressing binaries in Sierra. 3.92-BETA also supports decompressing binaries which have been modified after compression such as with a code signature.

Decompressing the app's binary using the -d option works great!

$ chmod +x upx.out 
$ ./upx.out -d /tmp/Run.app/Contents/MacOS/Run
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2016
UPX 3.92-BETA   Markus Oberhumer, Laszlo Molnar & John Reiser   Sep 22nd 2016

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
     57444 <-     24576   42.78%   macho/i386    Run

Unpacked 1 file.
  • Re: "Ran it on the app binary and it worked!", does this include packed binaries — as in do packed binaries launch now or do we have to unpack everything we expect to run? – l'L'l Sep 24 '16 at 21:33
  • @l'L'l I'm not entirely sure what you mean — binaries compressed with upx prior to 3.92 need decompressing with -d path once using 3.92-BETAr3 or later so that they can be run. – grg Sep 24 '16 at 21:58
  • What I'm asking is can you launch a compressed binary as of now using the latest beta you've mentioned. – l'L'l Sep 24 '16 at 21:59
  • @l'L'l Sorry, I'm not exactly following, I think the answer to your question is: Yes but you must decompress them first. Once decompressed using this new version of UPX, they can be run, or compressed again using this new version and still run whilst compressed. – grg Sep 24 '16 at 22:06
  • Yes, that is what I was asking, although when trying run something packed ( with the latest BETA ) the app crashed (10.11.6). I'm not sure if you've tried packing anything and running it, but it seems there's still some issue there. – l'L'l Sep 24 '16 at 22:11
4
brew install upx

upx -d YourApp.app/Contents/MacOS/YourApp

worked for me.

1

I don't recognise your code in particular although this is a common issue with a new OS release (legacy software compatibility).

  • First step, look at the developers website for an indication they will be patching for Sierra. They may have posted a beta patch already that's not available through Software Update.

  • Send the Dev an email asking them directly. It can take them a while to catch-up particularly if they have multiple applications on multiple platforms.

  • Consider having a dual boot Mac. I generally keep a clone of my current system on another drive (or partition) after a new OS installation, then I can quickly re-boot and continue to use the software. I actually keep a legacy Mac these days running 10.6 and 10.8 just for this support.

  • Consider a virtual machine. You can use an emulator on OSX and install the OS version you prefer (including Windows). Not sure if emulators are released for Sierra yet though.

1

The issue has been reported as UPX is way, way broken by Darwin 16 / OS X Sierra. #4.

It looks like upx 3.92 will address this issue.

  • 1
    It will most likely not, because the executable is most probably not packed by UPX. – RyuX51 Sep 21 '16 at 17:45
  • But error message indicates so. There is also thing with certificatea etc. that also gets in the way of decompression. – ɹoƃı Sep 21 '16 at 18:40
  • 2
    It does, but it is obviously wrong. Run hexdump -C YourApp.app/Contents/MacOS/YourApp | grep -C 1 UPX and see for yourself. As for the certificates: Read your link thoroughly and you'll see that it makes no difference if the binary is signed or not when decompressing. – RyuX51 Sep 21 '16 at 19:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .