From bb5727f6c194e3e359ea2fb70855b6400479a1c9 Mon Sep 17 00:00:00 2001 From: JGZ_YES Date: Tue, 4 Aug 2026 02:31:01 +0800 Subject: [PATCH] fix(macos): set CS_ADHOC flag in ad-hoc code signature CodeDirectory flags was 0, causing codesign to treat the binary as requiring a real CMS certificate signature. With no signature blob present, codesign reports 'code object is not signed at all' and the macOS kernel SIGKILLs the process on exec (exit 137 / 'zsh: killed'). Setting CS_ADHOC (0x2) marks the signature as ad-hoc (codesign -s -), which is accepted without a certificate. Verified locally: SuperBlob, CodeDirectory, codeLimit, and all code-page SHA-256 hashes are correct; flags now reads 0x2. --- src/PazeE.Compiler/Binary/MachOCodeSignature.cs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/PazeE.Compiler/Binary/MachOCodeSignature.cs b/src/PazeE.Compiler/Binary/MachOCodeSignature.cs index dd1794c..5626d35 100644 --- a/src/PazeE.Compiler/Binary/MachOCodeSignature.cs +++ b/src/PazeE.Compiler/Binary/MachOCodeSignature.cs @@ -16,6 +16,10 @@ internal static class MachOCodeSignature private const byte CS_HASHTYPE_SHA256 = 2; private const byte CS_HASHSIZE_SHA256 = 32; private const string DefaultIdentifier = "paze-compiled"; + // CodeDirectory flags：CS_ADHOC=0x2 表示无证书的临时签名（codesign -s - 生成）。 + // 缺少此位时 codesign 视为需要真实 CMS 证书签名，找不到签名 blob 即判 + // "code object is not signed at all"，macOS 内核执行时直接 SIGKILL（exit 137）。 + private const uint CS_ADHOC = 0x2; // CodeDirectory 固定部分（version 0x20001，无 scatterOffset/teamOffset） private const int CdFixedLen = 44; @@ -49,7 +53,7 @@ internal static class MachOCodeSignature Write32BE(cd, CSMAGIC_CODEDIRECTORY); // magic Write32BE(cd, (uint)cdLength); // length Write32BE(cd, 0x20001); // version - Write32BE(cd, 0); // flags (ad-hoc) + Write32BE(cd, CS_ADHOC); // flags：ad-hoc 签名（无证书） Write32BE(cd, (uint)hashOffset); // hashOffset Write32BE(cd, (uint)identOffset); // identOffset Write32BE(cd, 0); // nSpecialSlots