"PIE" applies not only to executable files but also to "frameworks."

[watanabemk]

ENVIRONMENT

OS and Version: Ubuntu 22.04.3 LTS (Jammy Jellyfish) on WSL2
Python Version: 3.10.12
MobSF Version: v3.7.9 beta

EXPLANATION OF THE ISSUE

Originally, the diagnosis target of "PIE" is executable files, so "Severiyt" of "framework" should be "Info".
However, in the API diagnosis result, "Severiyt" of "PIE" in the JSON "framework_analysis" object is "High".

STEPS TO REPRODUCE THE ISSUE

Diagnosis target app: Upload DVIA-v2 [https://github.com/prateek147/DVIA-v2] to MobSF
Output diagnostic results using the API "Generate JSON Report API"
Check that the “severity” entry in the “PIE” section of the “framework_analysis” array is “High”
Expected output result
The “severity” entry in the “PIE” section of the “framework_analysis” array becomes “Info”

LOG FILE

*The [-] line is the current output result, and the [+] line is the expected output result.

...
    "framework_analysis": [
        {
...
            "pie": {
                "has_pie": false,
-                 "severity": "high",
+                 "severity": "info",
                "description": "The binary is built without Position Independent Code flag...."
            },
...

POTENTIAL SOLUTION

Add “framework” and work to the conditional expression in the file below.

Mobile-Security-Framework-MobSF/mobsf/StaticAnalyzer/views/common/binary/macho.py

Line 65 in 4685d8e

if self.macho_name.endswith('.dylib'):

[github-actions]

👋 @watanabemk
Issues is only for reporting a bug/feature request. For limited support, questions, and discussions, please join MobSF Slack channel
Please include all the requested and relevant information when opening a bug report. Improper reports will be closed without any response.

[ajinabraham]

I will update the current checks.

#define	MH_PIE 0x200000			/* When this bit is set, the OS will
					   load the main executable at a
					   random address.  Only used in
					   MH_EXECUTE filetypes. */

Ref: https://opensource.apple.com/source/xnu/xnu-4570.1.46/EXTERNAL_HEADERS/mach-o/loader.h.auto.html

I believe only MachO executables are meant to be PIE.
Dylibs and framework bundles are always implicitly position-independent.

[ajinabraham]

Addressed when this #2307 gets merged to master.