Applications – Dealing with ‘Invalid Mach-O Header’ Error in UPX Compressed Binary on macOS

applicationscrashmacos

I'm trying to launch an older app in macOS Sierra. It worked fine in El Capitan, however since the update to Sierra it crashes immediately on launch with the error…

This UPX compressed binary contains an invalid Mach-O header and cannot be loaded.

Using Homebrew in El Capitan, I installed UPX and used it to try uncompressing the binary, however this tells me that the binary is not compressed in the first place.

$ upx -d /tmp/Run.app/Contents/MacOS/Run
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2013
UPX 3.91        Markus Oberhumer, Laszlo Molnar & John Reiser   Sep 30th 2013

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
upx: /tmp/Run.app/Contents/MacOS/Run: NotPackedException: not packed by UPX

Unpacked 0 files.

This is the crash log from opening the app in Sierra.

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_CRASH (SIGKILL)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Reason:    EXEC, [0xc] This UPX compressed binary contains an invalid Mach-O header and cannot be loaded.

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib          0x00007fffcffeabb2 __posix_spawn + 10
1   libsystem_kernel.dylib          0x00007fffcffe5ef2 posix_spawn + 386
2   xpcproxy                        0x000000010dbb2d75 0x10dbb0000 + 11637
3   xpcproxy                        0x000000010dbb3992 0x10dbb0000 + 14738
4   libdyld.dylib                   0x00007fffcfebc255 start + 1

How can I get this app to open in Sierra?

Best Answer

Revised answer:

For hiding traces, pirates zeroed the UPX markers out of the compressed binary, so it's not possible for macOS Sierra to decompress the binary. (Try with: hexdump -C YourApp.app/Contents/MacOS/YourApp | grep -C 1 UPX and see, that there is most likely no output.)

However, jreiser from UPX accepted the challenge and addressed this issue with implementing a more robust search for compressed code. v3.92 will be possible to make these apps running again when decompressing the executables with upx -d YourApp.app/Contents/MacOS/YourApp.

Related Question