From 2f32b6969b3a403a1d6dea04b9d84a0974e4169d Mon Sep 17 00:00:00 2001
From: neon <174992783+neonmodder123@users.noreply.github.com>
Date: Wed, 17 Jun 2026 20:00:25 +0300
Subject: [PATCH] add fat binary support

---
 lara/kexploit/decrypt.m | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/lara/kexploit/decrypt.m b/lara/kexploit/decrypt.m
index 77543dc9..b7173c6e 100644
--- a/lara/kexploit/decrypt.m
+++ b/lara/kexploit/decrypt.m
@@ -42,6 +42,7 @@ void set_progress_callback(progress_callback_t callback) {
     uint64_t text_fileoff;
     uint64_t text_filesize;
     uint64_t binary_size;
+    uint64_t fat_offset;
     bool     is_64;
     uint32_t ncmds;
 };
@@ -139,8 +140,16 @@ static int parse_macho(uint8_t *buf, uint64_t size, struct macho_ctx *ctx) {
             if (OSSwapBigToHostInt32(archs[i].cputype) == CPU_TYPE_ARM64) {
                 uint32_t offset = OSSwapBigToHostInt32(archs[i].offset);
                 uint32_t arch_size = OSSwapBigToHostInt32(archs[i].size);
-                if (offset + arch_size <= size)
-                    return parse_macho(buf + offset, arch_size, ctx);
+                if (offset + arch_size <= size) {
+                    int ret = parse_macho(buf + offset, arch_size, ctx);
+                    if (ret == 0) {
+                        ctx->cryptoff += offset;
+                        ctx->text_fileoff += offset;
+                        ctx->binary_size = size;
+                        ctx->fat_offset = offset;
+                    }
+                    return ret;
+                }
             }
         }
         return -1;
@@ -388,7 +397,7 @@ static int decrypt_to_output(const char *binaryPath, pid_t pid, uint8_t *file_bu
         progupdate((double)pages_done / total_pages);
     }
 
-    uint64_t crypto_off = ctx->is_64 ? sizeof(struct mach_header_64) : sizeof(struct mach_header);
+    uint64_t crypto_off = ctx->fat_offset + (ctx->is_64 ? sizeof(struct mach_header_64) : sizeof(struct mach_header));
     for (uint32_t i = 0; i < ctx->ncmds; i++) {
         if (crypto_off + sizeof(struct load_command) > file_size) break;
         struct load_command *lc = (struct load_command *)(decrypted + crypto_off);
@@ -461,5 +470,3 @@ int decrypt_app(const char *bundlePath, const char *executableName, const char *
     snprintf(execPath, sizeof(execPath), "%s/%s", bundlePath, executableName);
     return decrypt_binary(execPath, executableName, outputPath);
 }
-
-