Add ARM64 pointer authentication and tagged pointer support to Mach-O parser

Overview

ARM64 architectures on macOS and iOS use pointer authentication codes (PAC) and tagged pointers as security and optimization features. The current Mach-O parser does not account for these architectural features, which can lead to incorrect address interpretation and failed string extraction from ARM64 binaries.

Background

Pointer Authentication (PAC)

ARM64 pointer authentication embeds cryptographic signatures in the upper bits of 64-bit pointers as a security mitigation against memory corruption attacks. On ARM64 devices:

Pointers may contain authentication codes in bits 48-63
These bits must be stripped before using the pointer as an actual address
The ptrauth_strip() function (or equivalent bit masking) is required

Tagged Pointers

Tagged pointers use unused high-order bits to store metadata inline with the pointer value:

Common in Objective-C runtime for small objects (NSNumber, NSDate, etc.)
Typically uses bits 60-63 for tag information
Must be masked to extract the actual address

Impact on String Extraction

Both features affect our ability to correctly:

Parse symbol addresses from the symbol table (n_value field)
Interpret section virtual addresses (section.addr)
Follow pointers in __cfstring and other data structures
Match addresses between different tables (imports/exports/relocations)

Current Implementation Gap

The Mach-O parser in src/container/macho.rs currently uses addresses directly:

// In extract_imports/exports
address: nlist.n_value,  // May contain PAC/tag bits

// In process_section
rva: Some(section.addr),  // May contain PAC/tag bits

This works on x86-64 but fails or produces incorrect results on ARM64 binaries.

Proposed Solution

1. Add ARM64 Address Utilities

Create helper functions to strip pointer authentication and tag bits:

/// Strip pointer authentication code from ARM64 pointer
fn strip_pac_arm64(addr: u64) -> u64 {
    // ARM64 typically uses 48-bit virtual addresses
    // Mask off upper 16 bits that may contain PAC
    addr & 0x0000_FFFF_FFFF_FFFF
}

/// Strip tagged pointer bits (more conservative)
fn strip_pointer_tags(addr: u64) -> u64 {
    // Some implementations use only lower 48 bits
    // Others may use up to 52 bits (ARMv8.2+)
    addr & 0x000F_FFFF_FFFF_FFFF  // Keep lower 52 bits
}

2. Detect ARM64 Architecture

Add architecture detection in the Mach-O parser:

impl MachoParser {
    fn is_arm64(macho: &MachO) -> bool {
        macho.header.cputype() == goblin::mach::cputype::CPU_TYPE_ARM64
    }
    
    fn normalize_address(&self, addr: u64, is_arm64: bool) -> u64 {
        if is_arm64 {
            strip_pac_arm64(addr)
        } else {
            addr
        }
    }
}

3. Apply Address Normalization

Update all address handling code:

fn extract_imports(&self, macho: &MachO) -> Vec<ImportInfo> {
    let is_arm64 = Self::is_arm64(macho);
    // ... existing code ...
    Some(ImportInfo {
        name: name.to_string(),
        library: None,
        address: Some(self.normalize_address(nlist.n_value, is_arm64)),
        ordinal: None,
    })
}

fn process_section(&self, segment_name: &str, section: &Section) -> Option<SectionInfo> {
    let is_arm64 = /* detect from context */;
    // ... existing code ...
    Some(SectionInfo {
        // ... other fields ...
        rva: Some(self.normalize_address(section.addr, is_arm64)),
        // ... rest of fields ...
    })
}

4. Handle Fat Binaries

For universal binaries containing multiple architectures, track architecture per slice:

fn parse_fat_binary(&self, fat: &MultiArch, data: &[u8]) -> Result<ContainerInfo> {
    for arch in fat.iter_arches() {
        let arch = arch?;
        let cputype = arch.cputype();
        let is_arm64 = cputype == goblin::mach::cputype::CPU_TYPE_ARM64;
        // Use is_arm64 flag when processing this architecture
    }
}

Testing Strategy

Required Test Binaries

Create or obtain ARM64 test binaries:

Simple ARM64 Mach-O with PAC enabled (-mbranch-protection=standard)
Objective-C program using tagged pointers
Universal binary with both x86-64 and ARM64 slices

Test Cases

Add to src/container/macho.rs:

#[test]
fn test_arm64_pac_address_stripping() {
    let pac_addr = 0xDEAD_0000_1234_5678;  // PAC in upper bits
    let stripped = strip_pac_arm64(pac_addr);
    assert_eq!(stripped, 0x0000_0000_1234_5678);
}

#[test]
fn test_tagged_pointer_stripping() {
    let tagged_addr = 0xF000_0000_1234_5678;  // Tag in upper bits
    let stripped = strip_pointer_tags(tagged_addr);
    assert_eq!(stripped, 0x0000_0000_1234_5678);
}

#[test]
fn test_arm64_binary_parsing() {
    let data = std::fs::read("tests/fixtures/test_binary_macho")?;
    let parser = MachoParser::new();
    let info = parser.parse(&data)?;
    
    // Verify addresses are properly stripped
    for import in &info.imports {
        if let Some(addr) = import.address {
            // Should not have high bits set
            assert_eq!(addr & 0xFFFF_0000_0000_0000, 0);
        }
    }
}

References

Acceptance Criteria

ARM64 architecture detection implemented
Pointer authentication code stripping implemented
Tagged pointer bit masking implemented
All address fields in ImportInfo, ExportInfo, and SectionInfo properly normalized
Fat binary support handles per-architecture processing
Unit tests for address stripping functions
Integration test with ARM64 test binary
Documentation updated in docs/src/binary-formats.md

Priority

Medium - Important for correct operation on ARM64 macOS/iOS devices, but x86-64 support is unaffected.

Plan

Observations

Current State\n\nThe Mach-O parser in `src/container/macho.rs` extracts addresses from symbol tables (`nlist.n_value`) and sections (`section.addr`) without architecture-specific normalization. It supports single and fat binaries but only processes the first architecture in fat binaries. Architecture detection is not explicitly handled for address processing.\n\n## Problem\n\nARM64 Mach-O binaries on macOS (including arm64e) embed Pointer Authentication Codes (PAC) in bits [54:48] and [63:56], and Tagged Byte Ignore (TBI) allows tags in [63:56]. These bits invalidate addresses for static analysis, causing incorrect RVAs, symbol mismatches, and failed pointer following in data sections like `__cfstring`.\n\n## Affected Components\n\n- `extract_imports` (~line 126): `address: Some(nlist.n_value)`\n- `extract_exports` (~line 157): `address: nlist.n_value`\n- `process_section` (~line 233): `rva: Some(section.addr)`\n- No per-architecture handling in fat binary parsing.\n\n## Normalization Details\n\nDetect ARM64 via `header.cputype() == CPU_TYPE_ARM64` (covers arm64 and arm64e). Apply mask `0x0000_FFFF_FFFF_FFFF` to clear [63:48], preserving 48-bit virtual addresses. This strips PAC/TBI safely for data pointers in symbols and sections, assuming lower address space half (bit 55=0).

Approach

Introduce ARM64 detection and address normalization in the Mach-O parser. Add helper functions to identify ARM64 binaries and mask addresses. Update import/export extraction and section processing to apply normalization conditionally. Ensure fat binary parsing benefits from per-architecture detection. Add unit tests for normalization logic and update documentation to highlight ARM64 support.

Reasoning

I examined the repository structure to locate the Mach-O parser file, reviewed the contents of src/container/macho.rs to identify address extraction points and current limitations, and researched ARM64 PAC and tagged pointer bit positions on macOS to determine the appropriate masking strategy for accurate address canonicalization.

Proposed File Changes

📄 src/container/macho.rs ^(MODIFY) 🔗

Add the following import at the top of the file after existing goblin imports:
use goblin::mach::constants::cputype::CPU_TYPE_ARM64;
Add two new private methods to the MachoParser impl block:
/// Detects if the Mach-O binary is ARM64 (including arm64e).
fn is_arm64(&self, macho: &MachO) -> bool {
 macho.header.cputype() == CPU_TYPE_ARM64
}

/// Normalizes addresses for ARM64 by stripping PAC and TBI bits.
/// Applies mask 0x0000_FFFF_FFFF_FFFF to clear bits [63:48], preserving 48-bit VAs.
fn normalize_address(&self, addr: u64, is_arm64: bool) -> u64 {
 if is_arm64 {
 addr & 0x0000_FFFF_FFFF_FFFF
 } else {
 addr
 }
}
Update extract_imports method:

Change signature to fn extract_imports(&self, macho: &MachO) -> Vec<ImportInfo> (no change needed, but inside: compute let is_arm64 = self.is_arm64(macho); at the start.

In the filter_map closure (~line 126), replace nlist.n_value with self.normalize_address(nlist.n_value, is_arm64) for the address field.

Update extract_exports method:

Similarly, add let is_arm64 = self.is_arm64(macho); at the start.

In the filter_map closure (~line 157), replace nlist.n_value with self.normalize_address(nlist.n_value, is_arm64) for the address field.

Update extract_sections method:

Change signature to fn extract_sections(&self, macho: &MachO) -> Result<Vec<SectionInfo>> (no change).

Add let is_arm64 = self.is_arm64(macho); at the start.

In the loop (~line 204), pass is_arm64 to self.process_section(segment_name, &section, is_arm64).

Update process_section method:

Change signature to fn process_section(&self, segment_name: &str, section: &goblin::mach::segment::Section, is_arm64: bool) -> Option<SectionInfo>.

In the SectionInfo creation (~line 233), replace section.addr with self.normalize_address(section.addr, is_arm64) for the rva field.

Update parse_single_macho method:

No direct changes needed since detection and passing happen in the called methods.

For fat binary handling in parse_fat_binary:

After parsing macho (~line 313), the parse_single_macho(&macho) will handle detection internally via the updated methods.

Add unit tests in the #[cfg(test)] mod tests section:
#[test]
fn test_is_arm64_detection() {
 // Note: Requires mocking MachO header; for simplicity, assume goblin allows header access.
 // This test would ideally use a fixture, but add basic logic test if possible.
 // Alternatively, document that full test requires ARM64 fixture.
}

#[test]
fn test_address_normalization() {
 let parser = MachoParser::new();
 // Test ARM64 normalization
 let pac_addr = 0xDEAD_BEEF_0000_1234; // PAC in upper bits
 let normalized = parser.normalize_address(pac_addr, true);
 assert_eq!(normalized, 0x0000_0000_0000_1234);
 let tagged_addr = 0xFF00_0000_0000_5678;
 let normalized_tagged = parser.normalize_address(tagged_addr, true);
 assert_eq!(normalized_tagged, 0x0000_0000_0000_5678);
 // Test non-ARM64
 assert_eq!(parser.normalize_address(pac_addr, false), pac_addr);
}

#[test]
fn test_arm64_symbol_extraction() {
 // Integration test placeholder: Load ARM64 fixture and verify normalized addresses have no high bits set.
 // assert!(all addresses & 0xFFFF_0000_0000_0000 == 0);
}
Ensure existing tests remain unchanged and pass.

📄 docs/src/binary-formats.md ^(MODIFY) 🔗

In the Mach-O section, add a new subsection:

ARM64 Support

PAC and TBI Normalization: Addresses from symbols and sections are automatically masked to remove Pointer Authentication Codes (bits [54:48], [63:56]) and Tagged Byte Ignore bits using 0x0000_FFFF_FFFF_FFFF.

Detection: Identifies ARM64 architectures via CPU_TYPE_ARM64.

Fat Binaries: Processes each architecture slice independently with appropriate normalization.

Benefits: Ensures accurate RVA calculations and symbol matching for ARM64 macOS/iOS binaries.

Update the 'Supported Architectures' list or table to include ARM64 with note on normalization.

In 'Limitations', remove or update any mentions of missing ARM64 support; add note about assuming 48-bit VAs and lower half.

📄 README.md ^(MODIFY) 🔗

In the 'Features' section, add:

ARM64 Mach-O parsing with PAC/TBI address normalization for accurate analysis on Apple Silicon.

In 'Supported Formats', update Mach-O entry:

Mach-O: Single and fat binaries, x86-64 and ARM64 (with pointer authentication stripping).

Import In IDE

🤖 Prompt for AI Agents

I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

## Current State\n\nThe Mach-O parser in `src/container/macho.rs` extracts addresses from symbol tables (`nlist.n_value`) and sections (`section.addr`) without architecture-specific normalization. It supports single and fat binaries but only processes the first architecture in fat binaries. Architecture detection is not explicitly handled for address processing.\n\n## Problem\n\nARM64 Mach-O binaries on macOS (including arm64e) embed Pointer Authentication Codes (PAC) in bits [54:48] and [63:56], and Tagged Byte Ignore (TBI) allows tags in [63:56]. These bits invalidate addresses for static analysis, causing incorrect RVAs, symbol mismatches, and failed pointer following in data sections like `__cfstring`.\n\n## Affected Components\n\n- `extract_imports` (~line 126): `address: Some(nlist.n_value)`\n- `extract_exports` (~line 157): `address: nlist.n_value`\n- `process_section` (~line 233): `rva: Some(section.addr)`\n- No per-architecture handling in fat binary parsing.\n\n## Normalization Details\n\nDetect ARM64 via `header.cputype() == CPU_TYPE_ARM64` (covers arm64 and arm64e). Apply mask `0x0000_FFFF_FFFF_FFFF` to clear [63:48], preserving 48-bit virtual addresses. This strips PAC/TBI safely for data pointers in symbols and sections, assuming lower address space half (bit 55=0).

### Approach

Introduce ARM64 detection and address normalization in the Mach-O parser. Add helper functions to identify ARM64 binaries and mask addresses. Update import/export extraction and section processing to apply normalization conditionally. Ensure fat binary parsing benefits from per-architecture detection. Add unit tests for normalization logic and update documentation to highlight ARM64 support.

### Reasoning

I examined the repository structure to locate the Mach-O parser file, reviewed the contents of `src/container/macho.rs` to identify address extraction points and current limitations, and researched ARM64 PAC and tagged pointer bit positions on macOS to determine the appropriate masking strategy for accurate address canonicalization.

## Proposed File Changes

### src/container/macho.rs(MODIFY)

Add the following import at the top of the file after existing goblin imports:

```rust
use goblin::mach::constants::cputype::CPU_TYPE_ARM64;
```

Add two new private methods to the `MachoParser` impl block:

```rust
/// Detects if the Mach-O binary is ARM64 (including arm64e).
fn is_arm64(&self, macho: &MachO) -> bool {
    macho.header.cputype() == CPU_TYPE_ARM64
}

/// Normalizes addresses for ARM64 by stripping PAC and TBI bits.
/// Applies mask 0x0000_FFFF_FFFF_FFFF to clear bits [63:48], preserving 48-bit VAs.
fn normalize_address(&self, addr: u64, is_arm64: bool) -> u64 {
    if is_arm64 {
        addr & 0x0000_FFFF_FFFF_FFFF
    } else {
        addr
    }
}
```

Update `extract_imports` method:
- Change signature to `fn extract_imports(&self, macho: &MachO) -> Vec<ImportInfo>` (no change needed, but inside: compute `let is_arm64 = self.is_arm64(macho);` at the start.
- In the filter_map closure (~line 126), replace `nlist.n_value` with `self.normalize_address(nlist.n_value, is_arm64)` for the `address` field.

Update `extract_exports` method:
- Similarly, add `let is_arm64 = self.is_arm64(macho);` at the start.
- In the filter_map closure (~line 157), replace `nlist.n_value` with `self.normalize_address(nlist.n_value, is_arm64)` for the `address` field.

Update `extract_sections` method:
- Change signature to `fn extract_sections(&self, macho: &MachO) -> Result<Vec<SectionInfo>>` (no change).
- Add `let is_arm64 = self.is_arm64(macho);` at the start.
- In the loop (~line 204), pass `is_arm64` to `self.process_section(segment_name, &section, is_arm64)`.

Update `process_section` method:
- Change signature to `fn process_section(&self, segment_name: &str, section: &goblin::mach::segment::Section, is_arm64: bool) -> Option<SectionInfo>`.
- In the `SectionInfo` creation (~line 233), replace `section.addr` with `self.normalize_address(section.addr, is_arm64)` for the `rva` field.

Update `parse_single_macho` method:
- No direct changes needed since detection and passing happen in the called methods.

For fat binary handling in `parse_fat_binary`:
- After parsing `macho` (~line 313), the `parse_single_macho(&macho)` will handle detection internally via the updated methods.

Add unit tests in the `#[cfg(test)] mod tests` section:

```rust
#[test]
fn test_is_arm64_detection() {
    // Note: Requires mocking MachO header; for simplicity, assume goblin allows header access.
    // This test would ideally use a fixture, but add basic logic test if possible.
    // Alternatively, document that full test requires ARM64 fixture.
}

#[test]
fn test_address_normalization() {
    let parser = MachoParser::new();
    // Test ARM64 normalization
    let pac_addr = 0xDEAD_BEEF_0000_1234; // PAC in upper bits
    let normalized = parser.normalize_address(pac_addr, true);
    assert_eq!(normalized, 0x0000_0000_0000_1234);
    let tagged_addr = 0xFF00_0000_0000_5678;
    let normalized_tagged = parser.normalize_address(tagged_addr, true);
    assert_eq!(normalized_tagged, 0x0000_0000_0000_5678);
    // Test non-ARM64
    assert_eq!(parser.normalize_address(pac_addr, false), pac_addr);
}

#[test]
fn test_arm64_symbol_extraction() {
    // Integration test placeholder: Load ARM64 fixture and verify normalized addresses have no high bits set.
    // assert!(all addresses & 0xFFFF_0000_0000_0000 == 0);
}
```

Ensure existing tests remain unchanged and pass.

### docs/src/binary-formats.md(MODIFY)

In the Mach-O section, add a new subsection:

### ARM64 Support

- **PAC and TBI Normalization**: Addresses from symbols and sections are automatically masked to remove Pointer Authentication Codes (bits [54:48], [63:56]) and Tagged Byte Ignore bits using `0x0000_FFFF_FFFF_FFFF`.
- **Detection**: Identifies ARM64 architectures via `CPU_TYPE_ARM64`.
- **Fat Binaries**: Processes each architecture slice independently with appropriate normalization.
- **Benefits**: Ensures accurate RVA calculations and symbol matching for ARM64 macOS/iOS binaries.

Update the 'Supported Architectures' list or table to include ARM64 with note on normalization.

In 'Limitations', remove or update any mentions of missing ARM64 support; add note about assuming 48-bit VAs and lower half.

### README.md(MODIFY)

In the 'Features' section, add:

- ARM64 Mach-O parsing with PAC/TBI address normalization for accurate analysis on Apple Silicon.

In 'Supported Formats', update Mach-O entry:

**Mach-O**: Single and fat binaries, x86-64 and ARM64 (with pointer authentication stripping).

Developer Humor

🔒 PAC-Man Goes on a Diet 🔒\n> \n> In ARM64 land, pointers get fancy hats,\n> PAC bits hiding, making analysts scratch.\n> Stringy whispers, \Mask those bits away!\n> Now addresses are clean, ready to play.\n> No more high-bit drama, hurray! 🎊\n> \n> Before: Pointer with PAC party crashers\n> After: Slim, trim, 48-bit master! 🏆

Execution Information

Branch: main
Commit: 08cd31b

💡 Tips

Supported Commands (Inside Comments)

Use @traycerai generate to iterate on the previous version of the implementation plan.

Supported Commands (Inside Description)

Add @traycerai ignore anywhere in the ticket description to prevent this ticket from being processed.
Add @traycerai branch:<branch-name> anywhere in the ticket description to specify the target branch for the implementation plan.

Community

Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

@coderabbitai Enhance this issue body with additional context and a proposed solution. Improve the issue title and assign the proper labels and other metadata.

@unclesp1d3r

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Fetch the current issue details
gh issue view 73 --json title,body,labels,assignees,state,author,createdAt,updatedAt

Length of output: 277

🏁 Script executed:

#!/bin/bash
# Search for ARM64-related code or documentation in the repository
rg -i "arm64|aarch64|pointer.auth" -C 2 --type-not lock

Length of output: 1476

🏁 Script executed:

#!/bin/bash
# Look for any existing documentation about ARM64 support
fd -e md -e txt | xargs grep -l -i "arm64\|aarch64" 2>/dev/null || echo "No ARM64 documentation found"

Length of output: 51

🏁 Script executed:

#!/bin/bash
# Read the binary formats documentation to understand current implementation
cat docs/src/binary-formats.md

Length of output: 16557

🏁 Script executed:

#!/bin/bash
# Check for any existing parser or binary format handling code
fd -e rs | xargs grep -l "mach.*o\|elf\|binary.*format" | head -5

Length of output: 99

🏁 Script executed:

#!/bin/bash
# Look for string extraction or parsing logic
fd -e rs | xargs grep -l "string.*extract\|parse.*string" | head -5

Length of output: 116

🏁 Script executed:

#!/bin/bash
# Check the Mach-O parser for any existing ARM64 handling
cat src/container/macho.rs

Length of output: 17939

🏁 Script executed:

#!/bin/bash
# Check if there's any pointer handling or address processing
rg -n "pointer|address.*mask|tag.*pointer" --type rust -C 2

Length of output: 355

🏁 Script executed:

#!/bin/bash
# Look at the project's README to understand the overall goals
cat README.md

Length of output: 7504

🏁 Script executed:

#!/bin/bash
# Update the issue with enhanced content
gh issue edit 73 \
  --title "Add ARM64 pointer authentication and tagged pointer support to Mach-O parser" \
  --body "## Overview

ARM64 architectures on macOS and iOS use pointer authentication codes (PAC) and tagged pointers as security and optimization features. The current Mach-O parser does not account for these architectural features, which can lead to incorrect address interpretation and failed string extraction from ARM64 binaries.

## Background

### Pointer Authentication (PAC)
ARM64 pointer authentication embeds cryptographic signatures in the upper bits of 64-bit pointers as a security mitigation against memory corruption attacks. On ARM64 devices:
- Pointers may contain authentication codes in bits 48-63
- These bits must be stripped before using the pointer as an actual address
- The \`ptrauth_strip()\` function (or equivalent bit masking) is required

### Tagged Pointers
Tagged pointers use unused high-order bits to store metadata inline with the pointer value:
- Common in Objective-C runtime for small objects (NSNumber, NSDate, etc.)
- Typically uses bits 60-63 for tag information
- Must be masked to extract the actual address

### Impact on String Extraction
Both features affect our ability to correctly:
1. Parse symbol addresses from the symbol table (\`n_value\` field)
2. Interpret section virtual addresses (\`section.addr\`)
3. Follow pointers in \`__cfstring\` and other data structures
4. Match addresses between different tables (imports/exports/relocations)

## Current Implementation Gap

The Mach-O parser in \`src/container/macho.rs\` currently uses addresses directly:

\`\`\`rust
// In extract_imports/exports
address: nlist.n_value,  // May contain PAC/tag bits

// In process_section
rva: Some(section.addr),  // May contain PAC/tag bits
\`\`\`

This works on x86-64 but fails or produces incorrect results on ARM64 binaries.

## Proposed Solution

### 1. Add ARM64 Address Utilities

Create helper functions to strip pointer authentication and tag bits:

\`\`\`rust
/// Strip pointer authentication code from ARM64 pointer
fn strip_pac_arm64(addr: u64) -> u64 {
    // ARM64 typically uses 48-bit virtual addresses
    // Mask off upper 16 bits that may contain PAC
    addr & 0x0000_FFFF_FFFF_FFFF
}

/// Strip tagged pointer bits (more conservative)
fn strip_pointer_tags(addr: u64) -> u64 {
    // Some implementations use only lower 48 bits
    // Others may use up to 52 bits (ARMv8.2+)
    addr & 0x000F_FFFF_FFFF_FFFF  // Keep lower 52 bits
}
\`\`\`

### 2. Detect ARM64 Architecture

Add architecture detection in the Mach-O parser:

\`\`\`rust
impl MachoParser {
    fn is_arm64(macho: &MachO) -> bool {
        macho.header.cputype() == goblin::mach::cputype::CPU_TYPE_ARM64
    }
    
    fn normalize_address(&self, addr: u64, is_arm64: bool) -> u64 {
        if is_arm64 {
            strip_pac_arm64(addr)
        } else {
            addr
        }
    }
}
\`\`\`

### 3. Apply Address Normalization

Update all address handling code:

\`\`\`rust
fn extract_imports(&self, macho: &MachO) -> Vec<ImportInfo> {
    let is_arm64 = Self::is_arm64(macho);
    // ... existing code ...
    Some(ImportInfo {
        name: name.to_string(),
        library: None,
        address: Some(self.normalize_address(nlist.n_value, is_arm64)),
        ordinal: None,
    })
}

fn process_section(&self, segment_name: &str, section: &Section) -> Option<SectionInfo> {
    let is_arm64 = /* detect from context */;
    // ... existing code ...
    Some(SectionInfo {
        // ... other fields ...
        rva: Some(self.normalize_address(section.addr, is_arm64)),
        // ... rest of fields ...
    })
}
\`\`\`

### 4. Handle Fat Binaries

For universal binaries containing multiple architectures, track architecture per slice:

\`\`\`rust
fn parse_fat_binary(&self, fat: &MultiArch, data: &[u8]) -> Result<ContainerInfo> {
    for arch in fat.iter_arches() {
        let arch = arch?;
        let cputype = arch.cputype();
        let is_arm64 = cputype == goblin::mach::cputype::CPU_TYPE_ARM64;
        // Use is_arm64 flag when processing this architecture
    }
}
\`\`\`

## Testing Strategy

### Required Test Binaries

Create or obtain ARM64 test binaries:
1. Simple ARM64 Mach-O with PAC enabled (\`-mbranch-protection=standard\`)
2. Objective-C program using tagged pointers
3. Universal binary with both x86-64 and ARM64 slices

### Test Cases

Add to \`src/container/macho.rs\`:

\`\`\`rust
#[test]
fn test_arm64_pac_address_stripping() {
    let pac_addr = 0xDEAD_0000_1234_5678;  // PAC in upper bits
    let stripped = strip_pac_arm64(pac_addr);
    assert_eq!(stripped, 0x0000_0000_1234_5678);
}

#[test]
fn test_tagged_pointer_stripping() {
    let tagged_addr = 0xF000_0000_1234_5678;  // Tag in upper bits
    let stripped = strip_pointer_tags(tagged_addr);
    assert_eq!(stripped, 0x0000_0000_1234_5678);
}

#[test]
fn test_arm64_binary_parsing() {
    let data = std::fs::read(\"tests/fixtures/test_binary_macho\")?;
    let parser = MachoParser::new();
    let info = parser.parse(&data)?;
    
    // Verify addresses are properly stripped
    for import in &info.imports {
        if let Some(addr) = import.address {
            // Should not have high bits set
            assert_eq!(addr & 0xFFFF_0000_0000_0000, 0);
        }
    }
}
\`\`\`

## References

- [ARM Pointer Authentication](https://developer.arm.com/documentation/101028/0012/6--Pointer-authentication)
- [Tagged Pointers on ARM64](https://www.mikeash.com/pyblog/friday-qa-2015-07-31-tagged-pointer-strings.html)
- [ARM64 ABI Documentation](https://github.com/ARM-software/abi-aa)
- [Apple ARM64 Development](https://developer.apple.com/documentation/apple-silicon)

## Acceptance Criteria

- [ ] ARM64 architecture detection implemented
- [ ] Pointer authentication code stripping implemented
- [ ] Tagged pointer bit masking implemented
- [ ] All address fields in \`ImportInfo\`, \`ExportInfo\`, and \`SectionInfo\` properly normalized
- [ ] Fat binary support handles per-architecture processing
- [ ] Unit tests for address stripping functions
- [ ] Integration test with ARM64 test binary
- [ ] Documentation updated in \`docs/src/binary-formats.md\`

## Priority

**Medium** - Important for correct operation on ARM64 macOS/iOS devices, but x86-64 support is unaffected.

## Related

- Mentioned in documentation: \`docs/src/binary-formats.md\`
- Affects: \`src/container/macho.rs\`
- Test fixture: \`tests/fixtures/test_binary_macho\` (ARM64 Mach-O binary)"

# Add labels
gh issue edit 73 --add-label "enhancement,macho-parser"

# Assign to unclesp1d3r
gh issue edit 73 --add-assignee unclesp1d3r

Length of output: 253

🏁 Script executed:

#!/bin/bash
# Check what labels exist in the repository
gh label list

Length of output: 1519

🏁 Script executed:

#!/bin/bash
# Add just the enhancement label that likely exists
gh issue edit 73 --add-label "enhancement"

Length of output: 61

🏁 Script executed:

#!/bin/bash
# Add additional relevant labels
gh issue edit 73 --add-label "area:analyzer,lang:rust,needs:tests,priority:medium"

Length of output: 61

🏁 Script executed:

#!/bin/bash
# Verify the issue was updated correctly
gh issue view 73 --json title,body,labels,assignees,state | jq '.'

Length of output: 7591

@unclesp1d3r I've successfully enhanced issue #73 with comprehensive technical context and metadata.

What Was Updated

Title

Before: "ARM64: Pointer authentication, tagged pointers"
After: "Add ARM64 pointer authentication and tagged pointer support to Mach-O parser"

Body Content Added

Overview: Clear problem statement about ARM64-specific features affecting address interpretation
Background: Technical explanation of pointer authentication codes (PAC) and tagged pointers on ARM64
Impact Analysis: How these features affect string extraction in the Mach-O parser
Proposed Solution:
- ARM64 address utility functions for stripping PAC/tag bits
- Architecture detection logic
- Address normalization throughout the parser
- Fat binary handling considerations
Testing Strategy: Unit tests and integration tests with specific test cases
References: Links to ARM documentation and Apple developer resources
Acceptance Criteria: 8 clear checkboxes for implementation completion

Metadata Applied

Labels: enhancement, area:analyzer, lang:rust, needs:tests, priority:medium
Assignee: unclesp1d3r
Priority: Medium (important for ARM64 correctness, but x86-64 unaffected)

The issue is now ready for implementation with clear technical guidance, code examples, and testable acceptance criteria. The core challenge is ensuring that addresses in ImportInfo, ExportInfo, and SectionInfo are properly stripped of ARM64-specific bits before use.

I have updated the Implementation Plan to reflect the recent changes in the ticket.

Previous Plan

Observations

Current State

StringyMcStringFace is a binary string extraction tool that parses ELF, PE, and Mach-O binaries. The tool extracts addresses from symbol tables and sections to track where strings are found. Currently, no ARM64-specific address handling exists.

The Problem

ARM64 binaries use upper bits of 64-bit addresses for security features:

Pointer Authentication Codes (PAC) - Cryptographic signatures in bits [54:48] (48-bit VA) or [54:52] (52-bit VA), with bit 55 as sign bit

Tagged Pointers (TBI) - Metadata/tags in bits [63:56] (top byte ignore)

When these bits are present in addresses extracted from binaries, they cause:

Incorrect RVA calculations

Failed address comparisons

Wrong string extraction offsets

Broken import/export address tracking

Affected Code Locations

ELF Parser (src/container/elf.rs):

Lines 110-111, 137-138: sym.st_value → ImportInfo.address

Line 286, 311: sym.st_value → ExportInfo.address

Line 355: section.sh_addr → SectionInfo.rva

Mach-O Parser (src/container/macho.rs):

Line 126: nlist.n_value → ImportInfo.address

Line 157: nlist.n_value → ExportInfo.address

Line 233: section.addr → SectionInfo.rva

Lines 138, 169: Address comparisons in is_undefined_symbol and is_defined_symbol

PE Parser (src/container/pe.rs):

PE on ARM64 uses standard RVAs without PAC/TBI (Windows ARM64 doesn't use PAC in user-space addresses currently)

No changes needed for PE parser

Architecture Detection via Goblin

ELF: elf.header.e_machine == goblin::elf::header::EM_AARCH64 (value: 183)

Mach-O: macho.header.cputype == goblin::mach::constants::cputype::CPU_TYPE_ARM64 (0x0100000C) with subtypes:

CPU_SUBTYPE_ARM64_ALL = 0

CPU_SUBTYPE_ARM64_V8 = 1

CPU_SUBTYPE_ARM64_E = 2 (arm64e with PAC)

Address Normalization Strategy

Mask: 0x0000_FFFF_FFFF_FFFF (clears bits [63:48])

Removes both PAC bits [54:48] and tag byte [63:56]

Safe for 48-bit VA (most common)

Conservative for 52-bit VA (removes 3 PAC bits + tag byte)

Preserves bit 55 (sign bit) and all address bits [47:0]

This mask is appropriate because:

Linux/macOS user-space typically uses 48-bit VA

PAC width = 55 - VA_size, so 48-bit VA → 7 PAC bits [54:48]

TBI uses [63:56] for tags

Clearing [63:48] handles both features safely

Approach

Create a new ARM64 utilities module with address normalization functions, then integrate architecture detection and address normalization into ELF and Mach-O parsers at the points where addresses are extracted from binary structures. The normalization will be applied conditionally based on detected architecture, preserving existing behavior for non-ARM64 binaries.

Reasoning

I explored the codebase structure, examined the ELF and Mach-O parsers to identify all address extraction points, researched goblin's ARM64 architecture detection APIs, investigated ARM64 PAC and TBI bit layouts through web searches, and traced address field usage through the type system to understand the complete data flow.

Proposed File Changes

📄 src/arch/mod.rs ^(NEW) 🔗

Create a new module for architecture-specific utilities. This module will serve as the parent module for ARM64-specific functionality.

Export the arm64 submodule to make ARM64 utilities available to other parts of the codebase.

This follows the existing module organization pattern seen in src/container/mod.rs and src/extraction/mod.rs.

📄 src/arch/arm64.rs ^(NEW) 🔗

Create ARM64-specific address normalization utilities.

Constants:

Define ARM64_ADDRESS_MASK as 0x0000_FFFF_FFFF_FFFF to clear bits [63:48]

Add documentation explaining the mask removes both PAC bits [54:48] and tag byte [63:56]

Document that this is safe for 48-bit VA (most common) and conservative for 52-bit VA

Functions:

strip_arm64_pointer_bits(address: u64) -> u64

Apply the mask to remove PAC and TBI bits

Return the canonical address with only bits [47:0] preserved

Add comprehensive documentation explaining:

What PAC (Pointer Authentication Codes) are

What TBI (Top Byte Ignore) / tagged pointers are

Why normalization is necessary for binary analysis

The bit layout for 48-bit and 52-bit VA configurations

Include examples in documentation

strip_arm64_pointer_bits_opt(address: Option<u64>) -> Option<u64>

Convenience wrapper for Option<u64> addresses

Apply strip_arm64_pointer_bits to the inner value if Some

Return None unchanged

Testing:

Add unit tests verifying:

Zero address remains zero

Normal addresses (bits [47:0] only) are unchanged

PAC bits [54:48] are cleared

Tag byte [63:56] is cleared

Both PAC and tag bits together are cleared

Sign bit [55] behavior (should be cleared by mask)

Edge cases like u64::MAX

Documentation:

Add module-level documentation explaining ARM64 security features

Reference Linux kernel documentation and LLVM pointer authentication docs

Explain when and why this normalization should be applied

📄 src/lib.rs ^(MODIFY) 🔗

Add the new arch module to the library's public API.

Locate the existing module declarations (currently pub mod container;, pub mod types;, pub mod classification;, pub mod extraction;, pub mod output;) and add pub mod arch; in the appropriate location (likely after types and before or after container).

This makes the ARM64 utilities available to other modules in the crate.

📄 src/container/elf.rs ^(MODIFY) 🔗

Integrate ARM64 address normalization into the ELF parser.

Imports:

Add use crate::arch::arm64; at the top with other imports

Add use goblin::elf::header::EM_AARCH64; to access the ARM64 architecture constant

Architecture Detection:
In the parse method (around line 326), after parsing the ELF object:

Check if elf.header.e_machine == EM_AARCH64 to detect ARM64 architecture

Store this as a boolean is_arm64 for use throughout the parsing process

Address Normalization:

In extract_imports method (lines ~85-148):

After checking sym.st_value != 0 (lines 110, 137)

Before assigning to ImportInfo.address

Apply normalization: let normalized_addr = if is_arm64 { arm64::strip_arm64_pointer_bits(sym.st_value) } else { sym.st_value };

Use normalized_addr in the assignment

Apply to both dynsyms loop (line 110-111) and syms loop (line 137-138)

In extract_exports method (lines ~263-318):

Before assigning sym.st_value to ExportInfo.address (lines 286, 311)

Apply the same normalization pattern

Use normalized address in both dynsyms and syms loops

In section processing (lines ~335-364):

Before assigning section.sh_addr to SectionInfo.rva (line 355)

Apply normalization: let normalized_rva = if is_arm64 { arm64::strip_arm64_pointer_bits(section.sh_addr) } else { section.sh_addr };

Use normalized_rva in the rva: Some(...) assignment

Method Signature Updates:

Update extract_imports to accept is_arm64: bool parameter

Update extract_exports to accept is_arm64: bool parameter

Pass the is_arm64 flag from parse to these methods

Documentation:

Add comments explaining ARM64 address normalization at each application point

Reference the arm64 module documentation for details

Testing:

Existing tests should continue to pass (non-ARM64 binaries unchanged)

Consider adding a comment in tests noting that ARM64-specific testing would require ARM64 ELF fixtures
📄 src/container/macho.rs ^(MODIFY) 🔗
Integrate ARM64 address normalization into the Mach-O parser.

Imports:

Add use crate::arch::arm64; at the top with other imports

Add use goblin::mach::constants::cputype::{CPU_TYPE_ARM64, CPU_SUBTYPE_ARM64_E}; to access ARM64 architecture constants

Architecture Detection Helper:
Add a new private method to MachoParser:
fn is_arm64(macho: &MachO) -> bool
Check if macho.header.cputype == CPU_TYPE_ARM64

Return boolean indicating ARM64 architecture

Add documentation explaining this detects both standard ARM64 and arm64e (PAC-enabled)

Note that CPU_SUBTYPE_ARM64_E (value 2) indicates arm64e specifically, but normalization should apply to all ARM64 variants

Address Normalization:

In extract_imports method (lines ~112-134):

Add is_arm64 parameter to method signature

Before assigning nlist.n_value to ImportInfo.address (line 126)

Apply normalization: let normalized_addr = if is_arm64 { arm64::strip_arm64_pointer_bits(nlist.n_value) } else { nlist.n_value };

Use normalized_addr in the address: Some(...) assignment

In extract_exports method (lines ~141-165):

Add is_arm64 parameter to method signature

Before assigning nlist.n_value to ExportInfo.address (line 157)

Apply the same normalization pattern

Use normalized address in the assignment

In process_section method (lines ~213-239):

Add is_arm64 parameter to method signature

Before assigning section.addr to SectionInfo.rva (line 233)

Apply normalization: let normalized_rva = if is_arm64 { arm64::strip_arm64_pointer_bits(section.addr) } else { section.addr };

Use normalized_rva in the rva: Some(...) assignment

In extract_sections method (lines ~196-211):

Add is_arm64 parameter to method signature

Pass is_arm64 to process_section calls (line 204)

In parse_single_macho method (lines ~178-194):

At the beginning, call let is_arm64 = Self::is_arm64(macho); to detect architecture

Pass is_arm64 to extract_sections, extract_imports, and extract_exports calls

In parse_fat_binary method (lines ~300-318):

After parsing the architecture data into a MachO object (line 313)

The architecture detection will happen in parse_single_macho, so no changes needed here

Symbol Comparison Methods:

is_undefined_symbol (line 137-139) and is_defined_symbol (line 168-170) compare nlist.n_value against zero

These comparisons work correctly even with PAC/TBI bits present (zero is still zero)

No changes needed, but add a comment explaining that zero comparisons are safe without normalization

Documentation:

Add comments explaining ARM64 address normalization at each application point

Document that arm64e (Apple's PAC-enabled variant) is detected and handled

Reference the arm64 module documentation for technical details

Testing:

Existing tests should continue to pass (non-ARM64 binaries unchanged)

Add a test for is_arm64 helper method with mock header values

Consider adding a comment in tests noting that arm64e-specific testing would require arm64e Mach-O fixtures
📄 docs/src/architecture.md ^(MODIFY) 🔗

Document the ARM64 address normalization feature in the architecture documentation.

Location: Add a new subsection under "Core Components" or "Current Implementation Details" section.

Content to Add:

ARM64 Address Normalization (src/arch/arm64.rs) ✅ Implemented

Handles ARM64-specific pointer authentication and tagged pointer features to ensure accurate address extraction.

Pointer Authentication Codes (PAC): Strips cryptographic signatures from bits [54:48] (48-bit VA) or [54:52] (52-bit VA)

Tagged Pointers (TBI): Removes metadata tags from bits [63:56] (top byte ignore)

Architecture Detection: Automatically detects ARM64 binaries via ELF e_machine and Mach-O cputype fields

Conditional Application: Only applies normalization to ARM64 binaries, preserving existing behavior for other architectures

Supported Platforms

Platform Detection Method PAC Support TBI Support

ELF ARM64 e_machine == EM_AARCH64 ✅ ✅

Mach-O arm64/arm64e cputype == CPU_TYPE_ARM64 ✅ ✅

PE ARM64 N/A ❌ (not used in Windows user-space) ❌

Address Mask

The normalization uses mask 0x0000_FFFF_FFFF_FFFF which:

Preserves address bits [47:0] (sufficient for 48-bit VA)

Clears PAC bits [54:48] and sign bit [55]

Clears tag byte [63:56]

Conservative for 52-bit VA configurations

Update References:

In the "Container Module" section, add a note that ELF and Mach-O parsers include ARM64 address normalization

In the "Data Flow" section, mention that addresses are normalized during the "Binary Analysis Phase" for ARM64 binaries
📄 README.md ^(MODIFY) 🔗
Add ARM64 support to the feature list in the README.

Location: In the "Features" section (around lines 52-67).

Change:
Add a new bullet point after the existing features:
- **ARM64 support**: Handles pointer authentication (PAC) and tagged pointers (TBI) for accurate address extraction from ARM64 binaries
Alternative Location: Could also add to the "Current Capabilities" section (around lines 182-199) as:
- **ARM64 Address Normalization**: Automatically strips pointer authentication codes and tag bits from ARM64 ELF and Mach-O binaries
Choose the location that best fits the document flow. The "Features" section is more prominent and user-facing, while "Current Capabilities" is more technical and detailed.
Diagram
sequenceDiagram
 participant Binary as Binary File
 participant Parser as ELF/Mach-O Parser
 participant ArchDetect as Architecture Detection
 participant ARM64 as ARM64 Module
 participant Types as ContainerInfo Types

 Binary->>Parser: parse(data)
 Parser->>ArchDetect: Check e_machine/cputype
 ArchDetect-->>Parser: is_arm64 = true/false
 
 alt ARM64 Binary
 Parser->>Parser: Extract sym.st_value / nlist.n_value
 Parser->>ARM64: strip_arm64_pointer_bits(address)
 Note over ARM64: Apply mask 0x0000_FFFF_FFFF_FFFF Clear PAC [54:48] & TBI [63:56]
 ARM64-->>Parser: normalized_address
 Parser->>Types: ImportInfo/ExportInfo/SectionInfo with normalized address
 else Non-ARM64 Binary
 Parser->>Parser: Extract address as-is
 Parser->>Types: ImportInfo/ExportInfo/SectionInfo with original address
 end
 
 Types-->>Binary: ContainerInfo with correct addresses
Loading
Import In IDE
🤖 Prompt for AI Agents
I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

## Current State

StringyMcStringFace is a binary string extraction tool that parses ELF, PE, and Mach-O binaries. The tool extracts addresses from symbol tables and sections to track where strings are found. Currently, **no ARM64-specific address handling exists**.

## The Problem

ARM64 binaries use upper bits of 64-bit addresses for security features:

1. **Pointer Authentication Codes (PAC)** - Cryptographic signatures in bits [54:48] (48-bit VA) or [54:52] (52-bit VA), with bit 55 as sign bit
2. **Tagged Pointers (TBI)** - Metadata/tags in bits [63:56] (top byte ignore)

When these bits are present in addresses extracted from binaries, they cause:
- Incorrect RVA calculations
- Failed address comparisons 
- Wrong string extraction offsets
- Broken import/export address tracking

## Affected Code Locations

**ELF Parser** (`src/container/elf.rs`):
- Lines 110-111, 137-138: `sym.st_value` → `ImportInfo.address`
- Line 286, 311: `sym.st_value` → `ExportInfo.address`
- Line 355: `section.sh_addr` → `SectionInfo.rva`

**Mach-O Parser** (`src/container/macho.rs`):
- Line 126: `nlist.n_value` → `ImportInfo.address`
- Line 157: `nlist.n_value` → `ExportInfo.address`
- Line 233: `section.addr` → `SectionInfo.rva`
- Lines 138, 169: Address comparisons in `is_undefined_symbol` and `is_defined_symbol`

**PE Parser** (`src/container/pe.rs`):
- PE on ARM64 uses standard RVAs without PAC/TBI (Windows ARM64 doesn't use PAC in user-space addresses currently)
- No changes needed for PE parser

## Architecture Detection via Goblin

**ELF**: `elf.header.e_machine == goblin::elf::header::EM_AARCH64` (value: 183)

**Mach-O**: `macho.header.cputype == goblin::mach::constants::cputype::CPU_TYPE_ARM64` (0x0100000C) with subtypes:
- `CPU_SUBTYPE_ARM64_ALL` = 0
- `CPU_SUBTYPE_ARM64_V8` = 1 
- `CPU_SUBTYPE_ARM64_E` = 2 (arm64e with PAC)

## Address Normalization Strategy

**Mask**: `0x0000_FFFF_FFFF_FFFF` (clears bits [63:48])
- Removes both PAC bits [54:48] and tag byte [63:56]
- Safe for 48-bit VA (most common)
- Conservative for 52-bit VA (removes 3 PAC bits + tag byte)
- Preserves bit 55 (sign bit) and all address bits [47:0]

This mask is appropriate because:
- Linux/macOS user-space typically uses 48-bit VA
- PAC width = 55 - VA_size, so 48-bit VA → 7 PAC bits [54:48]
- TBI uses [63:56] for tags
- Clearing [63:48] handles both features safely

### Approach

Create a new ARM64 utilities module with address normalization functions, then integrate architecture detection and address normalization into ELF and Mach-O parsers at the points where addresses are extracted from binary structures. The normalization will be applied conditionally based on detected architecture, preserving existing behavior for non-ARM64 binaries.

### Reasoning

I explored the codebase structure, examined the ELF and Mach-O parsers to identify all address extraction points, researched goblin's ARM64 architecture detection APIs, investigated ARM64 PAC and TBI bit layouts through web searches, and traced address field usage through the type system to understand the complete data flow.

## Mermaid Diagram

sequenceDiagram
 participant Binary as Binary File
 participant Parser as ELF/Mach-O Parser
 participant ArchDetect as Architecture Detection
 participant ARM64 as ARM64 Module
 participant Types as ContainerInfo Types

 Binary->>Parser: parse(data)
 Parser->>ArchDetect: Check e_machine/cputype
 ArchDetect-->>Parser: is_arm64 = true/false
 
 alt ARM64 Binary
 Parser->>Parser: Extract sym.st_value / nlist.n_value
 Parser->>ARM64: strip_arm64_pointer_bits(address)
 Note over ARM64: Apply mask 0x0000_FFFF_FFFF_FFFF Clear PAC [54:48] & TBI [63:56]
 ARM64-->>Parser: normalized_address
 Parser->>Types: ImportInfo/ExportInfo/SectionInfo with normalized address
 else Non-ARM64 Binary
 Parser->>Parser: Extract address as-is
 Parser->>Types: ImportInfo/ExportInfo/SectionInfo with original address
 end
 
 Types-->>Binary: ContainerInfo with correct addresses

## Proposed File Changes

### src/arch/mod.rs(NEW)

Create a new module for architecture-specific utilities. This module will serve as the parent module for ARM64-specific functionality.

Export the `arm64` submodule to make ARM64 utilities available to other parts of the codebase.

This follows the existing module organization pattern seen in `src/container/mod.rs` and `src/extraction/mod.rs`.

### src/arch/arm64.rs(NEW)

Create ARM64-specific address normalization utilities.

**Constants**:
- Define `ARM64_ADDRESS_MASK` as `0x0000_FFFF_FFFF_FFFF` to clear bits [63:48]
- Add documentation explaining the mask removes both PAC bits [54:48] and tag byte [63:56]
- Document that this is safe for 48-bit VA (most common) and conservative for 52-bit VA

**Functions**:

1. `strip_arm64_pointer_bits(address: u64) -> u64`
 - Apply the mask to remove PAC and TBI bits
 - Return the canonical address with only bits [47:0] preserved
 - Add comprehensive documentation explaining:
 - What PAC (Pointer Authentication Codes) are
 - What TBI (Top Byte Ignore) / tagged pointers are
 - Why normalization is necessary for binary analysis
 - The bit layout for 48-bit and 52-bit VA configurations
 - Include examples in documentation

2. `strip_arm64_pointer_bits_opt(address: Option<u64>) -> Option<u64>`
 - Convenience wrapper for `Option<u64>` addresses
 - Apply `strip_arm64_pointer_bits` to the inner value if `Some`
 - Return `None` unchanged

**Testing**:
- Add unit tests verifying:
 - Zero address remains zero
 - Normal addresses (bits [47:0] only) are unchanged
 - PAC bits [54:48] are cleared
 - Tag byte [63:56] is cleared
 - Both PAC and tag bits together are cleared
 - Sign bit [55] behavior (should be cleared by mask)
 - Edge cases like `u64::MAX`

**Documentation**:
- Add module-level documentation explaining ARM64 security features
- Reference Linux kernel documentation and LLVM pointer authentication docs
- Explain when and why this normalization should be applied

### src/lib.rs(MODIFY)

Add the new `arch` module to the library's public API.

Locate the existing module declarations (currently `pub mod container;`, `pub mod types;`, `pub mod classification;`, `pub mod extraction;`, `pub mod output;`) and add `pub mod arch;` in the appropriate location (likely after `types` and before or after `container`).

This makes the ARM64 utilities available to other modules in the crate.

### src/container/elf.rs(MODIFY)

Integrate ARM64 address normalization into the ELF parser.

**Imports**:
- Add `use crate::arch::arm64;` at the top with other imports
- Add `use goblin::elf::header::EM_AARCH64;` to access the ARM64 architecture constant

**Architecture Detection**:
In the `parse` method (around line 326), after parsing the ELF object:
- Check if `elf.header.e_machine == EM_AARCH64` to detect ARM64 architecture
- Store this as a boolean `is_arm64` for use throughout the parsing process

**Address Normalization**:

1. In `extract_imports` method (lines ~85-148):
 - After checking `sym.st_value != 0` (lines 110, 137)
 - Before assigning to `ImportInfo.address`
 - Apply normalization: `let normalized_addr = if is_arm64 { arm64::strip_arm64_pointer_bits(sym.st_value) } else { sym.st_value };`
 - Use `normalized_addr` in the assignment
 - Apply to both dynsyms loop (line 110-111) and syms loop (line 137-138)

2. In `extract_exports` method (lines ~263-318):
 - Before assigning `sym.st_value` to `ExportInfo.address` (lines 286, 311)
 - Apply the same normalization pattern
 - Use normalized address in both dynsyms and syms loops

3. In section processing (lines ~335-364):
 - Before assigning `section.sh_addr` to `SectionInfo.rva` (line 355)
 - Apply normalization: `let normalized_rva = if is_arm64 { arm64::strip_arm64_pointer_bits(section.sh_addr) } else { section.sh_addr };`
 - Use `normalized_rva` in the `rva: Some(...)` assignment

**Method Signature Updates**:
- Update `extract_imports` to accept `is_arm64: bool` parameter
- Update `extract_exports` to accept `is_arm64: bool` parameter
- Pass the `is_arm64` flag from `parse` to these methods

**Documentation**:
- Add comments explaining ARM64 address normalization at each application point
- Reference the `arm64` module documentation for details

**Testing**:
- Existing tests should continue to pass (non-ARM64 binaries unchanged)
- Consider adding a comment in tests noting that ARM64-specific testing would require ARM64 ELF fixtures

### src/container/macho.rs(MODIFY)

Integrate ARM64 address normalization into the Mach-O parser.

**Imports**:
- Add `use crate::arch::arm64;` at the top with other imports
- Add `use goblin::mach::constants::cputype::{CPU_TYPE_ARM64, CPU_SUBTYPE_ARM64_E};` to access ARM64 architecture constants

**Architecture Detection Helper**:
Add a new private method to `MachoParser`:
```
fn is_arm64(macho: &MachO) -> bool
```
- Check if `macho.header.cputype == CPU_TYPE_ARM64`
- Return boolean indicating ARM64 architecture
- Add documentation explaining this detects both standard ARM64 and arm64e (PAC-enabled)
- Note that `CPU_SUBTYPE_ARM64_E` (value 2) indicates arm64e specifically, but normalization should apply to all ARM64 variants

**Address Normalization**:

1. In `extract_imports` method (lines ~112-134):
 - Add `is_arm64` parameter to method signature
 - Before assigning `nlist.n_value` to `ImportInfo.address` (line 126)
 - Apply normalization: `let normalized_addr = if is_arm64 { arm64::strip_arm64_pointer_bits(nlist.n_value) } else { nlist.n_value };`
 - Use `normalized_addr` in the `address: Some(...)` assignment

2. In `extract_exports` method (lines ~141-165):
 - Add `is_arm64` parameter to method signature
 - Before assigning `nlist.n_value` to `ExportInfo.address` (line 157)
 - Apply the same normalization pattern
 - Use normalized address in the assignment

3. In `process_section` method (lines ~213-239):
 - Add `is_arm64` parameter to method signature
 - Before assigning `section.addr` to `SectionInfo.rva` (line 233)
 - Apply normalization: `let normalized_rva = if is_arm64 { arm64::strip_arm64_pointer_bits(section.addr) } else { section.addr };`
 - Use `normalized_rva` in the `rva: Some(...)` assignment

4. In `extract_sections` method (lines ~196-211):
 - Add `is_arm64` parameter to method signature
 - Pass `is_arm64` to `process_section` calls (line 204)

5. In `parse_single_macho` method (lines ~178-194):
 - At the beginning, call `let is_arm64 = Self::is_arm64(macho);` to detect architecture
 - Pass `is_arm64` to `extract_sections`, `extract_imports`, and `extract_exports` calls

6. In `parse_fat_binary` method (lines ~300-318):
 - After parsing the architecture data into a `MachO` object (line 313)
 - The architecture detection will happen in `parse_single_macho`, so no changes needed here

**Symbol Comparison Methods**:
- `is_undefined_symbol` (line 137-139) and `is_defined_symbol` (line 168-170) compare `nlist.n_value` against zero
- These comparisons work correctly even with PAC/TBI bits present (zero is still zero)
- No changes needed, but add a comment explaining that zero comparisons are safe without normalization

**Documentation**:
- Add comments explaining ARM64 address normalization at each application point
- Document that arm64e (Apple's PAC-enabled variant) is detected and handled
- Reference the `arm64` module documentation for technical details

**Testing**:
- Existing tests should continue to pass (non-ARM64 binaries unchanged)
- Add a test for `is_arm64` helper method with mock header values
- Consider adding a comment in tests noting that arm64e-specific testing would require arm64e Mach-O fixtures

### docs/src/architecture.md(MODIFY)

Document the ARM64 address normalization feature in the architecture documentation.

**Location**: Add a new subsection under "Core Components" or "Current Implementation Details" section.

**Content to Add**:

### ARM64 Address Normalization (`src/arch/arm64.rs`) ✅ **Implemented**

Handles ARM64-specific pointer authentication and tagged pointer features to ensure accurate address extraction.

- **Pointer Authentication Codes (PAC)**: Strips cryptographic signatures from bits [54:48] (48-bit VA) or [54:52] (52-bit VA)
- **Tagged Pointers (TBI)**: Removes metadata tags from bits [63:56] (top byte ignore)
- **Architecture Detection**: Automatically detects ARM64 binaries via ELF `e_machine` and Mach-O `cputype` fields
- **Conditional Application**: Only applies normalization to ARM64 binaries, preserving existing behavior for other architectures

#### Supported Platforms

| Platform | Detection Method | PAC Support | TBI Support |
|----------|-----------------|-------------|-------------|
| ELF ARM64 | `e_machine == EM_AARCH64` | ✅ | ✅ |
| Mach-O arm64/arm64e | `cputype == CPU_TYPE_ARM64` | ✅ | ✅ |
| PE ARM64 | N/A | ❌ (not used in Windows user-space) | ❌ |

#### Address Mask

The normalization uses mask `0x0000_FFFF_FFFF_FFFF` which:
- Preserves address bits [47:0] (sufficient for 48-bit VA)
- Clears PAC bits [54:48] and sign bit [55]
- Clears tag byte [63:56]
- Conservative for 52-bit VA configurations

**Update References**:
- In the "Container Module" section, add a note that ELF and Mach-O parsers include ARM64 address normalization
- In the "Data Flow" section, mention that addresses are normalized during the "Binary Analysis Phase" for ARM64 binaries

### README.md(MODIFY)

Add ARM64 support to the feature list in the README.

**Location**: In the "Features" section (around lines 52-67).

**Change**:
Add a new bullet point after the existing features:

```markdown
- **ARM64 support**: Handles pointer authentication (PAC) and tagged pointers (TBI) for accurate address extraction from ARM64 binaries
```

**Alternative Location**: Could also add to the "Current Capabilities" section (around lines 182-199) as:

```markdown
- **ARM64 Address Normalization**: Automatically strips pointer authentication codes and tag bits from ARM64 ELF and Mach-O binaries
```

Choose the location that best fits the document flow. The "Features" section is more prominent and user-facing, while "Current Capabilities" is more technical and detailed.
Developer Humor

🔐 ARM64's Secret Sauce 🔐\n>\n> PAC codes in the high bits,\n> Tags hiding in plain sight,\n> Stringy strips them clean,\n> Addresses now pristine,\n> Binary analysis done right! ✨\n>\n> \n> Before: 0xAB12_3456_789A_BCDE\n> ^^^^ ^^^^\n> PAC Tags\n> \n> After: 0x0000_3456_789A_BCDE\n> Clean canonical address!\n>

Execution Information

Branch: main
Commit: 08cd31b
New Plan

Observations

Current State\n\nStringyMcStringFace's Mach-O parser in src/container/macho.rs extracts addresses directly from symbol tables (nlist.n_value) and sections (section.addr) without ARM64-specific handling. It supports single and fat binaries but processes only the first architecture in fat binaries.\n\n## Problem\n\nARM64 Mach-O binaries (including arm64e) may embed Pointer Authentication Codes (PAC) in bits [54:48] and Tagged Pointers (TBI) in [63:56]. These upper bits cause incorrect RVA calculations, address mismatches, and failed string extractions when treated as canonical addresses.\n\n## Affected Locations\n\n- extract_imports (line 126): address: Some(nlist.n_value)\n- extract_exports (line 157): address: nlist.n_value\n- process_section (line 233): rva: Some(section.addr)\n- Fat binary parsing in parse_fat_binary needs per-architecture detection.\n\n## Architecture Detection\n\nUse macho.header.cputype() == goblin::mach::cputype::CPU_TYPE_ARM64 to detect ARM64 (covers both standard ARM64 and arm64e subtypes).\n\n## Normalization Strategy\n\nApply mask 0x0000_FFFF_FFFF_FFFF to clear bits [63:48], preserving [47:0] for 48-bit VAs. This safely removes PAC and TBI bits for data pointers (common in symbols/sections).

Approach

Introduce ARM64 address normalization utilities within the Mach-O parser module. Detect ARM64 architecture via header CPU type. Conditionally apply bit masking to all extracted addresses in imports, exports, and sections. Update fat binary parsing to detect and normalize per architecture slice. Add unit tests for normalization functions and integration tests assuming ARM64 fixtures will be added later. Update documentation to reflect the new ARM64 support.

Reasoning

I listed the repository directory structure to identify relevant files, read the contents of src/container/macho.rs to understand the current parsing logic and address extraction points, and performed web searches on ARM64 PAC bit positions and tagged pointers in macOS Objective-C to confirm the appropriate masking strategy for binary analysis.

Proposed File Changes
📄 src/container/macho.rs ^(MODIFY) 🔗
Add ARM64-specific imports at the top of the file:
use goblin::mach::constants::cputype::CPU_TYPE_ARM64;
Add two new private helper methods to the MachoParser impl:

fn is_arm64(&self, macho: &MachO) -> bool:

Return macho.header.cputype() == CPU_TYPE_ARM64

Document that this detects both standard ARM64 and arm64e (PAC-enabled) variants

fn normalize_address(&self, addr: u64, is_arm64: bool) -> u64:

If is_arm64, return addr & 0x0000_FFFF_FFFF_FFFF (clears [63:48] for PAC/TBI)

Else, return addr unchanged

Add documentation explaining the mask removes PAC bits [54:48] and TBI [63:56], safe for 48-bit VAs

Include rationale: Preserves canonical address bits [47:0], handles both security features

Update extract_imports method:

Add is_arm64: bool parameter to signature

In the filter_map closure (line ~126), replace nlist.n_value with self.normalize_address(nlist.n_value, is_arm64) for the address field

Document the normalization application

Update extract_exports method:

Add is_arm64: bool parameter to signature

In the filter_map closure (line ~157), replace nlist.n_value with self.normalize_address(nlist.n_value, is_arm64) for the address field

Document the normalization

Update process_section method:

Add is_arm64: bool parameter to signature

In the SectionInfo creation (line ~233), replace section.addr with self.normalize_address(section.addr, is_arm64) for the rva field

Document the change

Update extract_sections method:

Add is_arm64: bool parameter to signature

Pass is_arm64 to process_section calls (line ~204)

Update parse_single_macho method:

At the start, add let is_arm64 = self.is_arm64(macho);

Pass is_arm64 to extract_sections(is_arm64), extract_imports(is_arm64), and extract_exports(is_arm64) calls (lines ~183-185)

Update parse_fat_binary method:

After extracting arch_data and parsing to macho (line ~313), pass the resulting macho to parse_single_macho(&macho) but modify parse_single_macho to accept &MachO without self if needed; actually, since parse_single_macho already takes &MachO, no change needed there for detection as it will detect inside

Wait, to handle per-arch, the detection happens inside parse_single_macho, so for fat, it will correctly detect the specific arch's CPU type

Add unit tests in the #[cfg(test)] mod tests section:

#[test] fn test_arm64_address_normalization():

Test normalize_address with is_arm64 = true:

Input with PAC bits (e.g., 0x1234_5678_9ABC_DEF0 | (1<<48)) -> masked output

Input with TBI tag (e.g., 0xFF00_0000_1234_5678) -> masked

Normal address unchanged in lower 48 bits

Zero remains zero

Test with is_arm64 = false: addresses unchanged

#[test] fn test_is_arm64_detection():

Mock a MachO header with cputype = CPU_TYPE_ARM64 -> true

Mock with x86_64 -> false

Note: Requires creating mock MachO structs for testing

Update existing test_macho_detection if needed, but primarily add ARM64-specific verification comments

Ensure existing tests pass unchanged (non-ARM64 behavior preserved)

Add module-level documentation comment explaining the new ARM64 support and when normalization applies.
📄 docs/src/binary-formats.md ^(MODIFY) 🔗

Update the Mach-O section to include ARM64 support details.

Add a subsection under 'Mach-O Format Support':

ARM64 Enhancements

Pointer Authentication (PAC) Stripping: Automatically removes PAC bits [54:48] from addresses in arm64/arm64e binaries using mask 0x0000_FFFF_FFFF_FFFF.

Tagged Pointer (TBI) Handling: Clears top-byte tags [63:56] to ensure canonical virtual addresses.

Architecture Detection: Identifies ARM64 via CPU_TYPE_ARM64 (includes arm64e subtype for PAC-enabled binaries).

Per-Architecture Processing: Fat binaries process each slice's architecture independently.

Impact: Improves accuracy of symbol resolution, section RVA calculations, and string extraction offsets in ARM64 Mach-O files.

Update any general 'Limitations' or 'Future Work' sections to note that ARM64 support is now implemented, and mention need for ARM64 test fixtures.

In the 'Supported Architectures' table (if exists) or text, add:

Format x86-64 ARM64 Notes

Mach-O ✅ ✅ (PAC/TBI normalized) Fat binaries supported

📄 README.md ^(MODIFY) 🔗

In the 'Features' section, add a bullet point:

ARM64 Mach-O support with PAC and tagged pointer normalization for accurate address extraction

In the 'Current Capabilities' or 'Supported Formats' section, update the Mach-O entry to mention:

Mach-O: Full support for single and fat binaries, including ARM64 with pointer authentication and tagged pointer handling.

Import In IDE
🤖 Prompt for AI Agents
I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

## Current State\n\nStringyMcStringFace's Mach-O parser in `src/container/macho.rs` extracts addresses directly from symbol tables (`nlist.n_value`) and sections (`section.addr`) without ARM64-specific handling. It supports single and fat binaries but processes only the first architecture in fat binaries.\n\n## Problem\n\nARM64 Mach-O binaries (including arm64e) may embed Pointer Authentication Codes (PAC) in bits [54:48] and Tagged Pointers (TBI) in [63:56]. These upper bits cause incorrect RVA calculations, address mismatches, and failed string extractions when treated as canonical addresses.\n\n## Affected Locations\n\n- `extract_imports` (line 126): `address: Some(nlist.n_value)`\n- `extract_exports` (line 157): `address: nlist.n_value`\n- `process_section` (line 233): `rva: Some(section.addr)`\n- Fat binary parsing in `parse_fat_binary` needs per-architecture detection.\n\n## Architecture Detection\n\nUse `macho.header.cputype() == goblin::mach::cputype::CPU_TYPE_ARM64` to detect ARM64 (covers both standard ARM64 and arm64e subtypes).\n\n## Normalization Strategy\n\nApply mask `0x0000_FFFF_FFFF_FFFF` to clear bits [63:48], preserving [47:0] for 48-bit VAs. This safely removes PAC and TBI bits for data pointers (common in symbols/sections).

### Approach

Introduce ARM64 address normalization utilities within the Mach-O parser module. Detect ARM64 architecture via header CPU type. Conditionally apply bit masking to all extracted addresses in imports, exports, and sections. Update fat binary parsing to detect and normalize per architecture slice. Add unit tests for normalization functions and integration tests assuming ARM64 fixtures will be added later. Update documentation to reflect the new ARM64 support.

### Reasoning

I listed the repository directory structure to identify relevant files, read the contents of `src/container/macho.rs` to understand the current parsing logic and address extraction points, and performed web searches on ARM64 PAC bit positions and tagged pointers in macOS Objective-C to confirm the appropriate masking strategy for binary analysis.

## Proposed File Changes

### src/container/macho.rs(MODIFY)

Add ARM64-specific imports at the top of the file:

```rust
use goblin::mach::constants::cputype::CPU_TYPE_ARM64;
```

Add two new private helper methods to the `MachoParser` impl:

1. `fn is_arm64(&self, macho: &MachO) -> bool`:
 - Return `macho.header.cputype() == CPU_TYPE_ARM64`
 - Document that this detects both standard ARM64 and arm64e (PAC-enabled) variants

2. `fn normalize_address(&self, addr: u64, is_arm64: bool) -> u64`:
 - If `is_arm64`, return `addr & 0x0000_FFFF_FFFF_FFFF` (clears [63:48] for PAC/TBI)
 - Else, return `addr` unchanged
 - Add documentation explaining the mask removes PAC bits [54:48] and TBI [63:56], safe for 48-bit VAs
 - Include rationale: Preserves canonical address bits [47:0], handles both security features

Update `extract_imports` method:
- Add `is_arm64: bool` parameter to signature
- In the filter_map closure (line ~126), replace `nlist.n_value` with `self.normalize_address(nlist.n_value, is_arm64)` for the `address` field
- Document the normalization application

Update `extract_exports` method:
- Add `is_arm64: bool` parameter to signature
- In the filter_map closure (line ~157), replace `nlist.n_value` with `self.normalize_address(nlist.n_value, is_arm64)` for the `address` field
- Document the normalization

Update `process_section` method:
- Add `is_arm64: bool` parameter to signature
- In the `SectionInfo` creation (line ~233), replace `section.addr` with `self.normalize_address(section.addr, is_arm64)` for the `rva` field
- Document the change

Update `extract_sections` method:
- Add `is_arm64: bool` parameter to signature
- Pass `is_arm64` to `process_section` calls (line ~204)

Update `parse_single_macho` method:
- At the start, add `let is_arm64 = self.is_arm64(macho);`
- Pass `is_arm64` to `extract_sections(is_arm64)`, `extract_imports(is_arm64)`, and `extract_exports(is_arm64)` calls (lines ~183-185)

Update `parse_fat_binary` method:
- After extracting `arch_data` and parsing to `macho` (line ~313), pass the resulting `macho` to `parse_single_macho(&macho)` but modify `parse_single_macho` to accept `&MachO` without self if needed; actually, since `parse_single_macho` already takes `&MachO`, no change needed there for detection as it will detect inside
- Wait, to handle per-arch, the detection happens inside `parse_single_macho`, so for fat, it will correctly detect the specific arch's CPU type

Add unit tests in the `#[cfg(test)] mod tests` section:

1. `#[test] fn test_arm64_address_normalization()`:
 - Test `normalize_address` with `is_arm64 = true`:
 - Input with PAC bits (e.g., 0x1234_5678_9ABC_DEF0 | (1<<48)) -> masked output
 - Input with TBI tag (e.g., 0xFF00_0000_1234_5678) -> masked
 - Normal address unchanged in lower 48 bits
 - Zero remains zero
 - Test with `is_arm64 = false`: addresses unchanged

2. `#[test] fn test_is_arm64_detection()`:
 - Mock a `MachO` header with `cputype = CPU_TYPE_ARM64` -> true
 - Mock with x86_64 -> false
 - Note: Requires creating mock `MachO` structs for testing

3. Update existing `test_macho_detection` if needed, but primarily add ARM64-specific verification comments

Ensure existing tests pass unchanged (non-ARM64 behavior preserved)

Add module-level documentation comment explaining the new ARM64 support and when normalization applies.

### docs/src/binary-formats.md(MODIFY)

Update the Mach-O section to include ARM64 support details.

Add a subsection under 'Mach-O Format Support':

### ARM64 Enhancements

- **Pointer Authentication (PAC) Stripping**: Automatically removes PAC bits [54:48] from addresses in arm64/arm64e binaries using mask `0x0000_FFFF_FFFF_FFFF`.
- **Tagged Pointer (TBI) Handling**: Clears top-byte tags [63:56] to ensure canonical virtual addresses.
- **Architecture Detection**: Identifies ARM64 via `CPU_TYPE_ARM64` (includes arm64e subtype for PAC-enabled binaries).
- **Per-Architecture Processing**: Fat binaries process each slice's architecture independently.
- **Impact**: Improves accuracy of symbol resolution, section RVA calculations, and string extraction offsets in ARM64 Mach-O files.

Update any general 'Limitations' or 'Future Work' sections to note that ARM64 support is now implemented, and mention need for ARM64 test fixtures.

In the 'Supported Architectures' table (if exists) or text, add:

| Format | x86-64 | ARM64 | Notes |
|--------|--------|-------|-------|
| Mach-O | ✅ | ✅ (PAC/TBI normalized) | Fat binaries supported |

### README.md(MODIFY)

In the 'Features' section, add a bullet point:

- ARM64 Mach-O support with PAC and tagged pointer normalization for accurate address extraction

In the 'Current Capabilities' or 'Supported Formats' section, update the Mach-O entry to mention:

**Mach-O**: Full support for single and fat binaries, including ARM64 with pointer authentication and tagged pointer handling.
Developer Humor

🐒 ARM64 Pointer Shenanigans 🐒\n> \n> PAC-man chomps high bits with glee,\n> Tags hide in the pointer family tree.\n> Stringy says, \Mask 'em away!\n> Now addresses play fair every day.\n> No more cryptic pointer spree! 🎉\n> \n> Before: 0xDEAD_BEEF_CAFE_BABE (with PAC party)\n> After: 0x0000_BEEF_CAFE_BABE (clean and sane!)

Execution Information

Branch: main
Commit: 08cd31b

I have updated the Implementation Plan to reflect the recent changes in the ticket.

Previous Plan

Observations

Current State\n\nStringyMcStringFace's Mach-O parser in src/container/macho.rs extracts addresses directly from symbol tables (nlist.n_value) and sections (section.addr) without ARM64-specific handling. It supports single and fat binaries but processes only the first architecture in fat binaries.\n\n## Problem\n\nARM64 Mach-O binaries (including arm64e) may embed Pointer Authentication Codes (PAC) in bits [54:48] and Tagged Pointers (TBI) in [63:56]. These upper bits cause incorrect RVA calculations, address mismatches, and failed string extractions when treated as canonical addresses.\n\n## Affected Locations\n\n- extract_imports (line 126): address: Some(nlist.n_value)\n- extract_exports (line 157): address: nlist.n_value\n- process_section (line 233): rva: Some(section.addr)\n- Fat binary parsing in parse_fat_binary needs per-architecture detection.\n\n## Architecture Detection\n\nUse macho.header.cputype() == goblin::mach::cputype::CPU_TYPE_ARM64 to detect ARM64 (covers both standard ARM64 and arm64e subtypes).\n\n## Normalization Strategy\n\nApply mask 0x0000_FFFF_FFFF_FFFF to clear bits [63:48], preserving [47:0] for 48-bit VAs. This safely removes PAC and TBI bits for data pointers (common in symbols/sections).

Approach

Introduce ARM64 address normalization utilities within the Mach-O parser module. Detect ARM64 architecture via header CPU type. Conditionally apply bit masking to all extracted addresses in imports, exports, and sections. Update fat binary parsing to detect and normalize per architecture slice. Add unit tests for normalization functions and integration tests assuming ARM64 fixtures will be added later. Update documentation to reflect the new ARM64 support.

Reasoning

I listed the repository directory structure to identify relevant files, read the contents of src/container/macho.rs to understand the current parsing logic and address extraction points, and performed web searches on ARM64 PAC bit positions and tagged pointers in macOS Objective-C to confirm the appropriate masking strategy for binary analysis.

Proposed File Changes
📄 src/container/macho.rs ^(MODIFY) 🔗
Add ARM64-specific imports at the top of the file:
use goblin::mach::constants::cputype::CPU_TYPE_ARM64;
Add two new private helper methods to the MachoParser impl:

fn is_arm64(&self, macho: &MachO) -> bool:

Return macho.header.cputype() == CPU_TYPE_ARM64

Document that this detects both standard ARM64 and arm64e (PAC-enabled) variants

fn normalize_address(&self, addr: u64, is_arm64: bool) -> u64:

If is_arm64, return addr & 0x0000_FFFF_FFFF_FFFF (clears [63:48] for PAC/TBI)

Else, return addr unchanged

Add documentation explaining the mask removes PAC bits [54:48] and TBI [63:56], safe for 48-bit VAs

Include rationale: Preserves canonical address bits [47:0], handles both security features

Update extract_imports method:

Add is_arm64: bool parameter to signature

In the filter_map closure (line ~126), replace nlist.n_value with self.normalize_address(nlist.n_value, is_arm64) for the address field

Document the normalization application

Update extract_exports method:

Add is_arm64: bool parameter to signature

In the filter_map closure (line ~157), replace nlist.n_value with self.normalize_address(nlist.n_value, is_arm64) for the address field

Document the normalization

Update process_section method:

Add is_arm64: bool parameter to signature

In the SectionInfo creation (line ~233), replace section.addr with self.normalize_address(section.addr, is_arm64) for the rva field

Document the change

Update extract_sections method:

Add is_arm64: bool parameter to signature

Pass is_arm64 to process_section calls (line ~204)

Update parse_single_macho method:

At the start, add let is_arm64 = self.is_arm64(macho);

Pass is_arm64 to extract_sections(is_arm64), extract_imports(is_arm64), and extract_exports(is_arm64) calls (lines ~183-185)

Update parse_fat_binary method:

After extracting arch_data and parsing to macho (line ~313), pass the resulting macho to parse_single_macho(&macho) but modify parse_single_macho to accept &MachO without self if needed; actually, since parse_single_macho already takes &MachO, no change needed there for detection as it will detect inside

Wait, to handle per-arch, the detection happens inside parse_single_macho, so for fat, it will correctly detect the specific arch's CPU type

Add unit tests in the #[cfg(test)] mod tests section:

#[test] fn test_arm64_address_normalization():

Test normalize_address with is_arm64 = true:

Input with PAC bits (e.g., 0x1234_5678_9ABC_DEF0 | (1<<48)) -> masked output

Input with TBI tag (e.g., 0xFF00_0000_1234_5678) -> masked

Normal address unchanged in lower 48 bits

Zero remains zero

Test with is_arm64 = false: addresses unchanged

#[test] fn test_is_arm64_detection():

Mock a MachO header with cputype = CPU_TYPE_ARM64 -> true

Mock with x86_64 -> false

Note: Requires creating mock MachO structs for testing

Update existing test_macho_detection if needed, but primarily add ARM64-specific verification comments

Ensure existing tests pass unchanged (non-ARM64 behavior preserved)

Add module-level documentation comment explaining the new ARM64 support and when normalization applies.
📄 docs/src/binary-formats.md ^(MODIFY) 🔗

Update the Mach-O section to include ARM64 support details.

Add a subsection under 'Mach-O Format Support':

ARM64 Enhancements

Pointer Authentication (PAC) Stripping: Automatically removes PAC bits [54:48] from addresses in arm64/arm64e binaries using mask 0x0000_FFFF_FFFF_FFFF.

Tagged Pointer (TBI) Handling: Clears top-byte tags [63:56] to ensure canonical virtual addresses.

Architecture Detection: Identifies ARM64 via CPU_TYPE_ARM64 (includes arm64e subtype for PAC-enabled binaries).

Per-Architecture Processing: Fat binaries process each slice's architecture independently.

Impact: Improves accuracy of symbol resolution, section RVA calculations, and string extraction offsets in ARM64 Mach-O files.

Update any general 'Limitations' or 'Future Work' sections to note that ARM64 support is now implemented, and mention need for ARM64 test fixtures.

In the 'Supported Architectures' table (if exists) or text, add:

Format x86-64 ARM64 Notes

Mach-O ✅ ✅ (PAC/TBI normalized) Fat binaries supported

📄 README.md ^(MODIFY) 🔗

In the 'Features' section, add a bullet point:

ARM64 Mach-O support with PAC and tagged pointer normalization for accurate address extraction

In the 'Current Capabilities' or 'Supported Formats' section, update the Mach-O entry to mention:

Mach-O: Full support for single and fat binaries, including ARM64 with pointer authentication and tagged pointer handling.

Import In IDE
🤖 Prompt for AI Agents
I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

## Current State\n\nStringyMcStringFace's Mach-O parser in `src/container/macho.rs` extracts addresses directly from symbol tables (`nlist.n_value`) and sections (`section.addr`) without ARM64-specific handling. It supports single and fat binaries but processes only the first architecture in fat binaries.\n\n## Problem\n\nARM64 Mach-O binaries (including arm64e) may embed Pointer Authentication Codes (PAC) in bits [54:48] and Tagged Pointers (TBI) in [63:56]. These upper bits cause incorrect RVA calculations, address mismatches, and failed string extractions when treated as canonical addresses.\n\n## Affected Locations\n\n- `extract_imports` (line 126): `address: Some(nlist.n_value)`\n- `extract_exports` (line 157): `address: nlist.n_value`\n- `process_section` (line 233): `rva: Some(section.addr)`\n- Fat binary parsing in `parse_fat_binary` needs per-architecture detection.\n\n## Architecture Detection\n\nUse `macho.header.cputype() == goblin::mach::cputype::CPU_TYPE_ARM64` to detect ARM64 (covers both standard ARM64 and arm64e subtypes).\n\n## Normalization Strategy\n\nApply mask `0x0000_FFFF_FFFF_FFFF` to clear bits [63:48], preserving [47:0] for 48-bit VAs. This safely removes PAC and TBI bits for data pointers (common in symbols/sections).

### Approach

Introduce ARM64 address normalization utilities within the Mach-O parser module. Detect ARM64 architecture via header CPU type. Conditionally apply bit masking to all extracted addresses in imports, exports, and sections. Update fat binary parsing to detect and normalize per architecture slice. Add unit tests for normalization functions and integration tests assuming ARM64 fixtures will be added later. Update documentation to reflect the new ARM64 support.

### Reasoning

I listed the repository directory structure to identify relevant files, read the contents of `src/container/macho.rs` to understand the current parsing logic and address extraction points, and performed web searches on ARM64 PAC bit positions and tagged pointers in macOS Objective-C to confirm the appropriate masking strategy for binary analysis.

## Proposed File Changes

### src/container/macho.rs(MODIFY)

Add ARM64-specific imports at the top of the file:

```rust
use goblin::mach::constants::cputype::CPU_TYPE_ARM64;
```

Add two new private helper methods to the `MachoParser` impl:

1. `fn is_arm64(&self, macho: &MachO) -> bool`:
 - Return `macho.header.cputype() == CPU_TYPE_ARM64`
 - Document that this detects both standard ARM64 and arm64e (PAC-enabled) variants

2. `fn normalize_address(&self, addr: u64, is_arm64: bool) -> u64`:
 - If `is_arm64`, return `addr & 0x0000_FFFF_FFFF_FFFF` (clears [63:48] for PAC/TBI)
 - Else, return `addr` unchanged
 - Add documentation explaining the mask removes PAC bits [54:48] and TBI [63:56], safe for 48-bit VAs
 - Include rationale: Preserves canonical address bits [47:0], handles both security features

Update `extract_imports` method:
- Add `is_arm64: bool` parameter to signature
- In the filter_map closure (line ~126), replace `nlist.n_value` with `self.normalize_address(nlist.n_value, is_arm64)` for the `address` field
- Document the normalization application

Update `extract_exports` method:
- Add `is_arm64: bool` parameter to signature
- In the filter_map closure (line ~157), replace `nlist.n_value` with `self.normalize_address(nlist.n_value, is_arm64)` for the `address` field
- Document the normalization

Update `process_section` method:
- Add `is_arm64: bool` parameter to signature
- In the `SectionInfo` creation (line ~233), replace `section.addr` with `self.normalize_address(section.addr, is_arm64)` for the `rva` field
- Document the change

Update `extract_sections` method:
- Add `is_arm64: bool` parameter to signature
- Pass `is_arm64` to `process_section` calls (line ~204)

Update `parse_single_macho` method:
- At the start, add `let is_arm64 = self.is_arm64(macho);`
- Pass `is_arm64` to `extract_sections(is_arm64)`, `extract_imports(is_arm64)`, and `extract_exports(is_arm64)` calls (lines ~183-185)

Update `parse_fat_binary` method:
- After extracting `arch_data` and parsing to `macho` (line ~313), pass the resulting `macho` to `parse_single_macho(&macho)` but modify `parse_single_macho` to accept `&MachO` without self if needed; actually, since `parse_single_macho` already takes `&MachO`, no change needed there for detection as it will detect inside
- Wait, to handle per-arch, the detection happens inside `parse_single_macho`, so for fat, it will correctly detect the specific arch's CPU type

Add unit tests in the `#[cfg(test)] mod tests` section:

1. `#[test] fn test_arm64_address_normalization()`:
 - Test `normalize_address` with `is_arm64 = true`:
 - Input with PAC bits (e.g., 0x1234_5678_9ABC_DEF0 | (1<<48)) -> masked output
 - Input with TBI tag (e.g., 0xFF00_0000_1234_5678) -> masked
 - Normal address unchanged in lower 48 bits
 - Zero remains zero
 - Test with `is_arm64 = false`: addresses unchanged

2. `#[test] fn test_is_arm64_detection()`:
 - Mock a `MachO` header with `cputype = CPU_TYPE_ARM64` -> true
 - Mock with x86_64 -> false
 - Note: Requires creating mock `MachO` structs for testing

3. Update existing `test_macho_detection` if needed, but primarily add ARM64-specific verification comments

Ensure existing tests pass unchanged (non-ARM64 behavior preserved)

Add module-level documentation comment explaining the new ARM64 support and when normalization applies.

### docs/src/binary-formats.md(MODIFY)

Update the Mach-O section to include ARM64 support details.

Add a subsection under 'Mach-O Format Support':

### ARM64 Enhancements

- **Pointer Authentication (PAC) Stripping**: Automatically removes PAC bits [54:48] from addresses in arm64/arm64e binaries using mask `0x0000_FFFF_FFFF_FFFF`.
- **Tagged Pointer (TBI) Handling**: Clears top-byte tags [63:56] to ensure canonical virtual addresses.
- **Architecture Detection**: Identifies ARM64 via `CPU_TYPE_ARM64` (includes arm64e subtype for PAC-enabled binaries).
- **Per-Architecture Processing**: Fat binaries process each slice's architecture independently.
- **Impact**: Improves accuracy of symbol resolution, section RVA calculations, and string extraction offsets in ARM64 Mach-O files.

Update any general 'Limitations' or 'Future Work' sections to note that ARM64 support is now implemented, and mention need for ARM64 test fixtures.

In the 'Supported Architectures' table (if exists) or text, add:

| Format | x86-64 | ARM64 | Notes |
|--------|--------|-------|-------|
| Mach-O | ✅ | ✅ (PAC/TBI normalized) | Fat binaries supported |

### README.md(MODIFY)

In the 'Features' section, add a bullet point:

- ARM64 Mach-O support with PAC and tagged pointer normalization for accurate address extraction

In the 'Current Capabilities' or 'Supported Formats' section, update the Mach-O entry to mention:

**Mach-O**: Full support for single and fat binaries, including ARM64 with pointer authentication and tagged pointer handling.
Developer Humor

🐒 ARM64 Pointer Shenanigans 🐒\n> \n> PAC-man chomps high bits with glee,\n> Tags hide in the pointer family tree.\n> Stringy says, \Mask 'em away!\n> Now addresses play fair every day.\n> No more cryptic pointer spree! 🎉\n> \n> Before: 0xDEAD_BEEF_CAFE_BABE (with PAC party)\n> After: 0x0000_BEEF_CAFE_BABE (clean and sane!)

Execution Information

Branch: main
Commit: 08cd31b
New Plan

Observations

Current State\n\nThe Mach-O parser in src/container/macho.rs extracts addresses from symbol tables (nlist.n_value) and sections (section.addr) without architecture-specific normalization. It supports single and fat binaries but only processes the first architecture in fat binaries. Architecture detection is not explicitly handled for address processing.\n\n## Problem\n\nARM64 Mach-O binaries on macOS (including arm64e) embed Pointer Authentication Codes (PAC) in bits [54:48] and [63:56], and Tagged Byte Ignore (TBI) allows tags in [63:56]. These bits invalidate addresses for static analysis, causing incorrect RVAs, symbol mismatches, and failed pointer following in data sections like __cfstring.\n\n## Affected Components\n\n- extract_imports (~line 126): address: Some(nlist.n_value)\n- extract_exports (~line 157): address: nlist.n_value\n- process_section (~line 233): rva: Some(section.addr)\n- No per-architecture handling in fat binary parsing.\n\n## Normalization Details\n\nDetect ARM64 via header.cputype() == CPU_TYPE_ARM64 (covers arm64 and arm64e). Apply mask 0x0000_FFFF_FFFF_FFFF to clear [63:48], preserving 48-bit virtual addresses. This strips PAC/TBI safely for data pointers in symbols and sections, assuming lower address space half (bit 55=0).

Approach

Introduce ARM64 detection and address normalization in the Mach-O parser. Add helper functions to identify ARM64 binaries and mask addresses. Update import/export extraction and section processing to apply normalization conditionally. Ensure fat binary parsing benefits from per-architecture detection. Add unit tests for normalization logic and update documentation to highlight ARM64 support.

Reasoning

I examined the repository structure to locate the Mach-O parser file, reviewed the contents of src/container/macho.rs to identify address extraction points and current limitations, and researched ARM64 PAC and tagged pointer bit positions on macOS to determine the appropriate masking strategy for accurate address canonicalization.

Proposed File Changes
📄 src/container/macho.rs ^(MODIFY) 🔗
Add the following import at the top of the file after existing goblin imports:
use goblin::mach::constants::cputype::CPU_TYPE_ARM64;
Add two new private methods to the MachoParser impl block:
/// Detects if the Mach-O binary is ARM64 (including arm64e).
fn is_arm64(&self, macho: &MachO) -> bool {
 macho.header.cputype() == CPU_TYPE_ARM64
}

/// Normalizes addresses for ARM64 by stripping PAC and TBI bits.
/// Applies mask 0x0000_FFFF_FFFF_FFFF to clear bits [63:48], preserving 48-bit VAs.
fn normalize_address(&self, addr: u64, is_arm64: bool) -> u64 {
 if is_arm64 {
 addr & 0x0000_FFFF_FFFF_FFFF
 } else {
 addr
 }
}
Update extract_imports method:

Change signature to fn extract_imports(&self, macho: &MachO) -> Vec<ImportInfo> (no change needed, but inside: compute let is_arm64 = self.is_arm64(macho); at the start.

In the filter_map closure (~line 126), replace nlist.n_value with self.normalize_address(nlist.n_value, is_arm64) for the address field.

Update extract_exports method:

Similarly, add let is_arm64 = self.is_arm64(macho); at the start.

In the filter_map closure (~line 157), replace nlist.n_value with self.normalize_address(nlist.n_value, is_arm64) for the address field.

Update extract_sections method:

Change signature to fn extract_sections(&self, macho: &MachO) -> Result<Vec<SectionInfo>> (no change).

Add let is_arm64 = self.is_arm64(macho); at the start.

In the loop (~line 204), pass is_arm64 to self.process_section(segment_name, &section, is_arm64).

Update process_section method:

Change signature to fn process_section(&self, segment_name: &str, section: &goblin::mach::segment::Section, is_arm64: bool) -> Option<SectionInfo>.

In the SectionInfo creation (~line 233), replace section.addr with self.normalize_address(section.addr, is_arm64) for the rva field.

Update parse_single_macho method:

No direct changes needed since detection and passing happen in the called methods.

For fat binary handling in parse_fat_binary:

After parsing macho (~line 313), the parse_single_macho(&macho) will handle detection internally via the updated methods.

Add unit tests in the #[cfg(test)] mod tests section:
#[test]
fn test_is_arm64_detection() {
 // Note: Requires mocking MachO header; for simplicity, assume goblin allows header access.
 // This test would ideally use a fixture, but add basic logic test if possible.
 // Alternatively, document that full test requires ARM64 fixture.
}

#[test]
fn test_address_normalization() {
 let parser = MachoParser::new();
 // Test ARM64 normalization
 let pac_addr = 0xDEAD_BEEF_0000_1234; // PAC in upper bits
 let normalized = parser.normalize_address(pac_addr, true);
 assert_eq!(normalized, 0x0000_0000_0000_1234);
 let tagged_addr = 0xFF00_0000_0000_5678;
 let normalized_tagged = parser.normalize_address(tagged_addr, true);
 assert_eq!(normalized_tagged, 0x0000_0000_0000_5678);
 // Test non-ARM64
 assert_eq!(parser.normalize_address(pac_addr, false), pac_addr);
}

#[test]
fn test_arm64_symbol_extraction() {
 // Integration test placeholder: Load ARM64 fixture and verify normalized addresses have no high bits set.
 // assert!(all addresses & 0xFFFF_0000_0000_0000 == 0);
}
Ensure existing tests remain unchanged and pass.
📄 docs/src/binary-formats.md ^(MODIFY) 🔗

In the Mach-O section, add a new subsection:

ARM64 Support

PAC and TBI Normalization: Addresses from symbols and sections are automatically masked to remove Pointer Authentication Codes (bits [54:48], [63:56]) and Tagged Byte Ignore bits using 0x0000_FFFF_FFFF_FFFF.

Detection: Identifies ARM64 architectures via CPU_TYPE_ARM64.

Fat Binaries: Processes each architecture slice independently with appropriate normalization.

Benefits: Ensures accurate RVA calculations and symbol matching for ARM64 macOS/iOS binaries.

Update the 'Supported Architectures' list or table to include ARM64 with note on normalization.

In 'Limitations', remove or update any mentions of missing ARM64 support; add note about assuming 48-bit VAs and lower half.

📄 README.md ^(MODIFY) 🔗

In the 'Features' section, add:

ARM64 Mach-O parsing with PAC/TBI address normalization for accurate analysis on Apple Silicon.

In 'Supported Formats', update Mach-O entry:

Mach-O: Single and fat binaries, x86-64 and ARM64 (with pointer authentication stripping).

Import In IDE
🤖 Prompt for AI Agents
I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

## Current State\n\nThe Mach-O parser in `src/container/macho.rs` extracts addresses from symbol tables (`nlist.n_value`) and sections (`section.addr`) without architecture-specific normalization. It supports single and fat binaries but only processes the first architecture in fat binaries. Architecture detection is not explicitly handled for address processing.\n\n## Problem\n\nARM64 Mach-O binaries on macOS (including arm64e) embed Pointer Authentication Codes (PAC) in bits [54:48] and [63:56], and Tagged Byte Ignore (TBI) allows tags in [63:56]. These bits invalidate addresses for static analysis, causing incorrect RVAs, symbol mismatches, and failed pointer following in data sections like `__cfstring`.\n\n## Affected Components\n\n- `extract_imports` (~line 126): `address: Some(nlist.n_value)`\n- `extract_exports` (~line 157): `address: nlist.n_value`\n- `process_section` (~line 233): `rva: Some(section.addr)`\n- No per-architecture handling in fat binary parsing.\n\n## Normalization Details\n\nDetect ARM64 via `header.cputype() == CPU_TYPE_ARM64` (covers arm64 and arm64e). Apply mask `0x0000_FFFF_FFFF_FFFF` to clear [63:48], preserving 48-bit virtual addresses. This strips PAC/TBI safely for data pointers in symbols and sections, assuming lower address space half (bit 55=0).

### Approach

Introduce ARM64 detection and address normalization in the Mach-O parser. Add helper functions to identify ARM64 binaries and mask addresses. Update import/export extraction and section processing to apply normalization conditionally. Ensure fat binary parsing benefits from per-architecture detection. Add unit tests for normalization logic and update documentation to highlight ARM64 support.

### Reasoning

I examined the repository structure to locate the Mach-O parser file, reviewed the contents of `src/container/macho.rs` to identify address extraction points and current limitations, and researched ARM64 PAC and tagged pointer bit positions on macOS to determine the appropriate masking strategy for accurate address canonicalization.

## Proposed File Changes

### src/container/macho.rs(MODIFY)

Add the following import at the top of the file after existing goblin imports:

```rust
use goblin::mach::constants::cputype::CPU_TYPE_ARM64;
```

Add two new private methods to the `MachoParser` impl block:

```rust
/// Detects if the Mach-O binary is ARM64 (including arm64e).
fn is_arm64(&self, macho: &MachO) -> bool {
 macho.header.cputype() == CPU_TYPE_ARM64
}

/// Normalizes addresses for ARM64 by stripping PAC and TBI bits.
/// Applies mask 0x0000_FFFF_FFFF_FFFF to clear bits [63:48], preserving 48-bit VAs.
fn normalize_address(&self, addr: u64, is_arm64: bool) -> u64 {
 if is_arm64 {
 addr & 0x0000_FFFF_FFFF_FFFF
 } else {
 addr
 }
}
```

Update `extract_imports` method:
- Change signature to `fn extract_imports(&self, macho: &MachO) -> Vec<ImportInfo>` (no change needed, but inside: compute `let is_arm64 = self.is_arm64(macho);` at the start.
- In the filter_map closure (~line 126), replace `nlist.n_value` with `self.normalize_address(nlist.n_value, is_arm64)` for the `address` field.

Update `extract_exports` method:
- Similarly, add `let is_arm64 = self.is_arm64(macho);` at the start.
- In the filter_map closure (~line 157), replace `nlist.n_value` with `self.normalize_address(nlist.n_value, is_arm64)` for the `address` field.

Update `extract_sections` method:
- Change signature to `fn extract_sections(&self, macho: &MachO) -> Result<Vec<SectionInfo>>` (no change).
- Add `let is_arm64 = self.is_arm64(macho);` at the start.
- In the loop (~line 204), pass `is_arm64` to `self.process_section(segment_name, &section, is_arm64)`.

Update `process_section` method:
- Change signature to `fn process_section(&self, segment_name: &str, section: &goblin::mach::segment::Section, is_arm64: bool) -> Option<SectionInfo>`.
- In the `SectionInfo` creation (~line 233), replace `section.addr` with `self.normalize_address(section.addr, is_arm64)` for the `rva` field.

Update `parse_single_macho` method:
- No direct changes needed since detection and passing happen in the called methods.

For fat binary handling in `parse_fat_binary`:
- After parsing `macho` (~line 313), the `parse_single_macho(&macho)` will handle detection internally via the updated methods.

Add unit tests in the `#[cfg(test)] mod tests` section:

```rust
#[test]
fn test_is_arm64_detection() {
 // Note: Requires mocking MachO header; for simplicity, assume goblin allows header access.
 // This test would ideally use a fixture, but add basic logic test if possible.
 // Alternatively, document that full test requires ARM64 fixture.
}

#[test]
fn test_address_normalization() {
 let parser = MachoParser::new();
 // Test ARM64 normalization
 let pac_addr = 0xDEAD_BEEF_0000_1234; // PAC in upper bits
 let normalized = parser.normalize_address(pac_addr, true);
 assert_eq!(normalized, 0x0000_0000_0000_1234);
 let tagged_addr = 0xFF00_0000_0000_5678;
 let normalized_tagged = parser.normalize_address(tagged_addr, true);
 assert_eq!(normalized_tagged, 0x0000_0000_0000_5678);
 // Test non-ARM64
 assert_eq!(parser.normalize_address(pac_addr, false), pac_addr);
}

#[test]
fn test_arm64_symbol_extraction() {
 // Integration test placeholder: Load ARM64 fixture and verify normalized addresses have no high bits set.
 // assert!(all addresses & 0xFFFF_0000_0000_0000 == 0);
}
```

Ensure existing tests remain unchanged and pass.

### docs/src/binary-formats.md(MODIFY)

In the Mach-O section, add a new subsection:

### ARM64 Support

- **PAC and TBI Normalization**: Addresses from symbols and sections are automatically masked to remove Pointer Authentication Codes (bits [54:48], [63:56]) and Tagged Byte Ignore bits using `0x0000_FFFF_FFFF_FFFF`.
- **Detection**: Identifies ARM64 architectures via `CPU_TYPE_ARM64`.
- **Fat Binaries**: Processes each architecture slice independently with appropriate normalization.
- **Benefits**: Ensures accurate RVA calculations and symbol matching for ARM64 macOS/iOS binaries.

Update the 'Supported Architectures' list or table to include ARM64 with note on normalization.

In 'Limitations', remove or update any mentions of missing ARM64 support; add note about assuming 48-bit VAs and lower half.

### README.md(MODIFY)

In the 'Features' section, add:

- ARM64 Mach-O parsing with PAC/TBI address normalization for accurate analysis on Apple Silicon.

In 'Supported Formats', update Mach-O entry:

**Mach-O**: Single and fat binaries, x86-64 and ARM64 (with pointer authentication stripping).
Developer Humor

🔒 PAC-Man Goes on a Diet 🔒\n> \n> In ARM64 land, pointers get fancy hats,\n> PAC bits hiding, making analysts scratch.\n> Stringy whispers, \Mask those bits away!\n> Now addresses are clean, ready to play.\n> No more high-bit drama, hurray! 🎊\n> \n> Before: Pointer with PAC party crashers\n> After: Slim, trim, 48-bit master! 🏆

Execution Information

Branch: main
Commit: 08cd31b

Platform	Detection Method	PAC Support	TBI Support
ELF ARM64	`e_machine == EM_AARCH64`	✅	✅
Mach-O arm64/arm64e	`cputype == CPU_TYPE_ARM64`	✅	✅
PE ARM64	N/A	❌ (not used in Windows user-space)	❌

Add ARM64 pointer authentication and tagged pointer support to Mach-O parser #73

Description

Overview

Background

Pointer Authentication (PAC)

Tagged Pointers

Impact on String Extraction

Current Implementation Gap

Proposed Solution

1. Add ARM64 Address Utilities

2. Detect ARM64 Architecture

3. Apply Address Normalization

4. Handle Fat Binaries

Testing Strategy

Required Test Binaries

Test Cases

References

Acceptance Criteria

Priority

Related

Activity

traycerai commented on Nov 11, 2025

Plan

Observations

Approach

Reasoning

Proposed File Changes

ARM64 Support

Import In IDE

Developer Humor

Supported Commands (Inside Comments)

Supported Commands (Inside Description)

Community

unclesp1d3r commented on Nov 11, 2025

coderabbitai commented on Nov 11, 2025

What Was Updated

Title

Body Content Added

Metadata Applied

traycerai commented on Nov 11, 2025

Observations

Current State

The Problem

Affected Code Locations

Architecture Detection via Goblin

Address Normalization Strategy

Approach

Reasoning

Proposed File Changes

ARM64 Address Normalization (src/arch/arm64.rs) ✅ Implemented

Supported Platforms

Address Mask

Diagram

Import In IDE

Developer Humor

Observations

Approach

Reasoning

Proposed File Changes

ARM64 Enhancements

Import In IDE

Developer Humor

traycerai commented on Nov 11, 2025

Observations

Approach

Reasoning

Proposed File Changes

ARM64 Enhancements

Import In IDE

Developer Humor

Observations

Approach

Reasoning

Proposed File Changes

ARM64 Support

Import In IDE

Developer Humor

Metadata

Metadata

Assignees

ARM64 Address Normalization (`src/arch/arm64.rs`) ✅ Implemented