bloodhound 4.1.0 Darwin arm64 release not working

[epichoxha]

App does not run. Error message:BloodHound.app” is damaged and can’t be opened.

Mac M1

Darwin ****.local 21.3.0 Darwin Kernel Version 21.3.0: Wed Jan  5 21:37:58 PST 2022; root:xnu-8019.80.24~20/RELEASE_ARM64_T8101 arm64

[yellow-starburst]

Everything breaks with M1 - what do you expect? Lol

[epichoxha]

:), true. Only golang binaries seem to work flawlessly

[vysecurity]

+1, but you can compile yourself and it'll work.

[rvazarkar]

@ddlees we'll need to make sure our pipeline uses Node16 going forward I believe

[ddlees]

@epichoxha We overhauled our build infrastructure and are now publishing the artifacts from the most recent commit on the master branch to a rolling release. Can you let us know if the arm64 binary that is published there works for you? Thanks!

https://github.com/BloodHoundAD/BloodHound/releases/tag/rolling

[epichoxha]

@ddlees , nah, still getting the same issue.

“BloodHound.app” is damaged and can’t be opened. You should move it to the Bin.

[vysecurity]

If you build it, it'll work.

[epichoxha]

I'll try to build @vysecurity thanks

[andyrobbins]

@epichoxha

I just built the M1 binary on my M1 and verified it works. I went ahead and added it to the release as well: https://github.com/BloodHoundAD/BloodHound/releases/tag/4.1.0

If you'd like to build this yourself, you can clone the repo then run these commands:

npm ci
npm run build

This will create the M1 compatible binary for you

Andy

[epichoxha]

Hey @andyrobbins thanks. Couldn't find your recent built. I build it myself, it works well.

Thanks

[vysecurity]

@andyrobbins did you get customqueries.json to work on the ARM build?

[vashirov]

App is not signed, I had to remove com.apple.quarantine to be able to start it:
xattr -d com.apple.quarantine /Applications/BloodHound.app

[Esonhugh]

Is the brew one a right M1 Version?

[vashirov]

Brew only had Intel version. I've submitted a PR to add support for arm64 builds in Homebrew/homebrew-cask#127827

[vashirov]

What's interesting though is that arm64 version has signing issues while x64 version is just not signed:

[vysecurity]

issue still exists.

[pwnmeow]

Its still a issue

[rpetersson]

When an application gets downloaded from any source other than those that Apple seems suited, the application gets an extended attribute "com.apple.Quarantine". This triggers the message: " is damaged and can't be opened. You should move it to the Bin."
Remove the attribute and you can launch the application.

To do this, open a console and type:

$ xattr -c <path/to/application.app>

Lauch, smile and enjoy.

[benburkhart]

thanks @rpetersson , worked like a charm