#!/usr/bin/env python
import cmd
import dict_utils
import file_extract
import optparse
import re
import struct
import string
import io
import sys
import uuid
# Mach header "magic" constants
MH_MAGIC = 0xFEEDFACE
MH_CIGAM = 0xCEFAEDFE
MH_MAGIC_64 = 0xFEEDFACF
MH_CIGAM_64 = 0xCFFAEDFE
FAT_MAGIC = 0xCAFEBABE
FAT_CIGAM = 0xBEBAFECA
# Mach haeder "filetype" constants
MH_OBJECT = 0x00000001
MH_EXECUTE = 0x00000002
MH_FVMLIB = 0x00000003
MH_CORE = 0x00000004
MH_PRELOAD = 0x00000005
MH_DYLIB = 0x00000006
MH_DYLINKER = 0x00000007
MH_BUNDLE = 0x00000008
MH_DYLIB_STUB = 0x00000009
MH_DSYM = 0x0000000A
MH_KEXT_BUNDLE = 0x0000000B
# Mach haeder "flag" constant bits
MH_NOUNDEFS = 0x00000001
MH_INCRLINK = 0x00000002
MH_DYLDLINK = 0x00000004
MH_BINDATLOAD = 0x00000008
MH_PREBOUND = 0x00000010
MH_SPLIT_SEGS = 0x00000020
MH_LAZY_INIT = 0x00000040
MH_TWOLEVEL = 0x00000080
MH_FORCE_FLAT = 0x00000100
MH_NOMULTIDEFS = 0x00000200
MH_NOFIXPREBINDING = 0x00000400
MH_PREBINDABLE = 0x00000800
MH_ALLMODSBOUND = 0x00001000
MH_SUBSECTIONS_VIA_SYMBOLS = 0x00002000
MH_CANONICAL = 0x00004000
MH_WEAK_DEFINES = 0x00008000
MH_BINDS_TO_WEAK = 0x00010000
MH_ALLOW_STACK_EXECUTION = 0x00020000
MH_ROOT_SAFE = 0x00040000
MH_SETUID_SAFE = 0x00080000
MH_NO_REEXPORTED_DYLIBS = 0x00100000
MH_PIE = 0x00200000
MH_DEAD_STRIPPABLE_DYLIB = 0x00400000
MH_HAS_TLV_DESCRIPTORS = 0x00800000
MH_NO_HEAP_EXECUTION = 0x01000000
# Mach load command constants
LC_REQ_DYLD = 0x80000000
LC_SEGMENT = 0x00000001
LC_SYMTAB = 0x00000002
LC_SYMSEG = 0x00000003
LC_THREAD = 0x00000004
LC_UNIXTHREAD = 0x00000005
LC_LOADFVMLIB = 0x00000006
LC_IDFVMLIB = 0x00000007
LC_IDENT = 0x00000008
LC_FVMFILE = 0x00000009
LC_PREPAGE = 0x0000000A
LC_DYSYMTAB = 0x0000000B
LC_LOAD_DYLIB = 0x0000000C
LC_ID_DYLIB = 0x0000000D
LC_LOAD_DYLINKER = 0x0000000E
LC_ID_DYLINKER = 0x0000000F
LC_PREBOUND_DYLIB = 0x00000010
LC_ROUTINES = 0x00000011
LC_SUB_FRAMEWORK = 0x00000012
LC_SUB_UMBRELLA = 0x00000013
LC_SUB_CLIENT = 0x00000014
LC_SUB_LIBRARY = 0x00000015
LC_TWOLEVEL_HINTS = 0x00000016
LC_PREBIND_CKSUM = 0x00000017
LC_LOAD_WEAK_DYLIB = 0x00000018 | LC_REQ_DYLD
LC_SEGMENT_64 = 0x00000019
LC_ROUTINES_64 = 0x0000001A
LC_UUID = 0x0000001B
LC_RPATH = 0x0000001C | LC_REQ_DYLD
LC_CODE_SIGNATURE = 0x0000001D
LC_SEGMENT_SPLIT_INFO = 0x0000001E
LC_REEXPORT_DYLIB = 0x0000001F | LC_REQ_DYLD
LC_LAZY_LOAD_DYLIB = 0x00000020
LC_ENCRYPTION_INFO = 0x00000021
LC_DYLD_INFO = 0x00000022
LC_DYLD_INFO_ONLY = 0x00000022 | LC_REQ_DYLD
LC_LOAD_UPWARD_DYLIB = 0x00000023 | LC_REQ_DYLD
LC_VERSION_MIN_MACOSX = 0x00000024
LC_VERSION_MIN_IPHONEOS = 0x00000025
LC_FUNCTION_STARTS = 0x00000026
LC_DYLD_ENVIRONMENT = 0x00000027
# Mach CPU constants
CPU_ARCH_MASK = 0xFF000000
CPU_ARCH_ABI64 = 0x01000000
CPU_TYPE_ANY = 0xFFFFFFFF
CPU_TYPE_VAX = 1
CPU_TYPE_MC680x0 = 6
CPU_TYPE_I386 = 7
CPU_TYPE_X86_64 = CPU_TYPE_I386 | CPU_ARCH_ABI64
CPU_TYPE_MIPS = 8
CPU_TYPE_MC98000 = 10
CPU_TYPE_HPPA = 11
CPU_TYPE_ARM = 12
CPU_TYPE_MC88000 = 13
CPU_TYPE_SPARC = 14
CPU_TYPE_I860 = 15
CPU_TYPE_ALPHA = 16
CPU_TYPE_POWERPC = 18
CPU_TYPE_POWERPC64 = CPU_TYPE_POWERPC | CPU_ARCH_ABI64
# VM protection constants
VM_PROT_READ = 1
VM_PROT_WRITE = 2
VM_PROT_EXECUTE = 4
# VM protection constants
N_STAB = 0xE0
N_PEXT = 0x10
N_TYPE = 0x0E
N_EXT = 0x01
# Values for nlist N_TYPE bits of the "Mach.NList.type" field.
N_UNDF = 0x0
N_ABS = 0x2
N_SECT = 0xE
N_PBUD = 0xC
N_INDR = 0xA
# Section indexes for the "Mach.NList.sect_idx" fields
NO_SECT = 0
MAX_SECT = 255
# Stab defines
N_GSYM = 0x20
N_FNAME = 0x22
N_FUN = 0x24
N_STSYM = 0x26
N_LCSYM = 0x28
N_BNSYM = 0x2E
N_OPT = 0x3C
N_RSYM = 0x40
N_SLINE = 0x44
N_ENSYM = 0x4E
N_SSYM = 0x60
N_SO = 0x64
N_OSO = 0x66
N_LSYM = 0x80
N_BINCL = 0x82
N_SOL = 0x84
N_PARAMS = 0x86
N_VERSION = 0x88
N_OLEVEL = 0x8A
N_PSYM = 0xA0
N_EINCL = 0xA2
N_ENTRY = 0xA4
N_LBRAC = 0xC0
N_EXCL = 0xC2
N_RBRAC = 0xE0
N_BCOMM = 0xE2
N_ECOMM = 0xE4
N_ECOML = 0xE8
N_LENG = 0xFE
vm_prot_names = ["---", "r--", "-w-", "rw-", "--x", "r-x", "-wx", "rwx"]
def dump_memory(base_addr, data, hex_bytes_len, num_per_line):
hex_bytes = data.encode("hex")
if hex_bytes_len == -1:
hex_bytes_len = len(hex_bytes)
addr = base_addr
ascii_str = ""
i = 0
while i < hex_bytes_len:
if ((i / 2) % num_per_line) == 0:
if i > 0:
print(" %s" % (ascii_str))
ascii_str = ""
print("0x%8.8x:" % (addr + i), end=" ")
hex_byte = hex_bytes[i : i + 2]
print(hex_byte, end=" ")
int_byte = int(hex_byte, 16)
ascii_char = "%c" % (int_byte)
if int_byte >= 32 and int_byte < 127:
ascii_str += ascii_char
else:
ascii_str += "."
i = i + 2
if ascii_str:
if (i / 2) % num_per_line:
padding = num_per_line - ((i / 2) % num_per_line)
else:
padding = 0
print("%*s%s" % (padding * 3 + 1, "", ascii_str))
print()
class TerminalColors:
"""Simple terminal colors class"""
def __init__(self, enabled=True):
# TODO: discover terminal type from "file" and disable if
# it can't handle the color codes
self.enabled = enabled
def reset(self):
"""Reset all terminal colors and formatting."""
if self.enabled:
return "\x1b[0m"
return ""
def bold(self, on=True):
"""Enable or disable bold depending on the "on" parameter."""
if self.enabled:
if on:
return "\x1b[1m"
else:
return "\x1b[22m"
return ""
def italics(self, on=True):
"""Enable or disable italics depending on the "on" parameter."""
if self.enabled:
if on:
return "\x1b[3m"
else:
return "\x1b[23m"
return ""
def underline(self, on=True):
"""Enable or disable underline depending on the "on" parameter."""
if self.enabled:
if on:
return "\x1b[4m"
else:
return "\x1b[24m"
return ""
def inverse(self, on=True):
"""Enable or disable inverse depending on the "on" parameter."""
if self.enabled:
if on:
return "\x1b[7m"
else:
return "\x1b[27m"
return ""
def strike(self, on=True):
"""Enable or disable strike through depending on the "on" parameter."""
if self.enabled:
if on:
return "\x1b[9m"
else:
return "\x1b[29m"
return ""
def black(self, fg=True):
"""Set the foreground or background color to black.
The foreground color will be set if "fg" tests True. The background color will be set if "fg" tests False.
"""
if self.enabled:
if fg:
return "\x1b[30m"
else:
return "\x1b[40m"
return ""
def red(self, fg=True):
"""Set the foreground or background color to red.
The foreground color will be set if "fg" tests True. The background color will be set if "fg" tests False.
"""
if self.enabled:
if fg:
return "\x1b[31m"
else:
return "\x1b[41m"
return ""
def green(self, fg=True):
"""Set the foreground or background color to green.
The foreground color will be set if "fg" tests True. The background color will be set if "fg" tests False.
"""
if self.enabled:
if fg:
return "\x1b[32m"
else:
return "\x1b[42m"
return ""
def yellow(self, fg=True):
"""Set the foreground or background color to yellow.
The foreground color will be set if "fg" tests True. The background color will be set if "fg" tests False.
"""
if self.enabled:
if fg:
return "\x1b[43m"
else:
return "\x1b[33m"
return ""
def blue(self, fg=True):
"""Set the foreground or background color to blue.
The foreground color will be set if "fg" tests True. The background color will be set if "fg" tests False.
"""
if self.enabled:
if fg:
return "\x1b[34m"
else:
return "\x1b[44m"
return ""
def magenta(self, fg=True):
"""Set the foreground or background color to magenta.
The foreground color will be set if "fg" tests True. The background color will be set if "fg" tests False.
"""
if self.enabled:
if fg:
return "\x1b[35m"
else:
return "\x1b[45m"
return ""
def cyan(self, fg=True):
"""Set the foreground or background color to cyan.
The foreground color will be set if "fg" tests True. The background color will be set if "fg" tests False.
"""
if self.enabled:
if fg:
return "\x1b[36m"
else:
return "\x1b[46m"
return ""
def white(self, fg=True):
"""Set the foreground or background color to white.
The foreground color will be set if "fg" tests True. The background color will be set if "fg" tests False.
"""
if self.enabled:
if fg:
return "\x1b[37m"
else:
return "\x1b[47m"
return ""
def default(self, fg=True):
"""Set the foreground or background color to the default.
The foreground color will be set if "fg" tests True. The background color will be set if "fg" tests False.
"""
if self.enabled:
if fg:
return "\x1b[39m"
else:
return "\x1b[49m"
return ""
def swap_unpack_char():
"""Returns the unpack prefix that will for non-native endian-ness."""
if struct.pack("H", 1).startswith("\x00"):
return "<"
return ">"
def dump_hex_bytes(addr, s, bytes_per_line=16):
i = 0
line = ""
for ch in s:
if (i % bytes_per_line) == 0:
if line:
print(line)
line = "%#8.8x: " % (addr + i)
line += "%02X " % ord(ch)
i += 1
print(line)
def dump_hex_byte_string_diff(addr, a, b, bytes_per_line=16):
i = 0
line = ""
a_len = len(a)
b_len = len(b)
if a_len < b_len:
max_len = b_len
else:
max_len = a_len
tty_colors = TerminalColors(True)
for i in range(max_len):
ch = None
if i < a_len:
ch_a = a[i]
ch = ch_a
else:
ch_a = None
if i < b_len:
ch_b = b[i]
if not ch:
ch = ch_b
else:
ch_b = None
mismatch = ch_a != ch_b
if (i % bytes_per_line) == 0:
if line:
print(line)
line = "%#8.8x: " % (addr + i)
if mismatch:
line += tty_colors.red()
line += "%02X " % ord(ch)
if mismatch:
line += tty_colors.default()
i += 1
print(line)
class Mach:
"""Class that does everything mach-o related"""
class Arch:
"""Class that implements mach-o architectures"""
def __init__(self, c=0, s=0):
self.cpu = c
self.sub = s
def set_cpu_type(self, c):
self.cpu = c
def set_cpu_subtype(self, s):
self.sub = s
def set_arch(self, c, s):
self.cpu = c
self.sub = s
def is_64_bit(self):
return (self.cpu & CPU_ARCH_ABI64) != 0
cpu_infos = [
["arm", CPU_TYPE_ARM, CPU_TYPE_ANY],
["arm", CPU_TYPE_ARM, 0],
["armv4", CPU_TYPE_ARM, 5],
["armv6", CPU_TYPE_ARM, 6],
["armv5", CPU_TYPE_ARM, 7],
["xscale", CPU_TYPE_ARM, 8],
["armv7", CPU_TYPE_ARM, 9],
["armv7f", CPU_TYPE_ARM, 10],
["armv7s", CPU_TYPE_ARM, 11],
["armv7k", CPU_TYPE_ARM, 12],
["armv7m", CPU_TYPE_ARM, 15],
["armv7em", CPU_TYPE_ARM, 16],
["ppc", CPU_TYPE_POWERPC, CPU_TYPE_ANY],
["ppc", CPU_TYPE_POWERPC, 0],
["ppc601", CPU_TYPE_POWERPC, 1],
["ppc602", CPU_TYPE_POWERPC, 2],
["ppc603", CPU_TYPE_POWERPC, 3],
["ppc603e", CPU_TYPE_POWERPC, 4],
["ppc603ev", CPU_TYPE_POWERPC, 5],
["ppc604", CPU_TYPE_POWERPC, 6],
["ppc604e", CPU_TYPE_POWERPC, 7],
["ppc620", CPU_TYPE_POWERPC, 8],
["ppc750", CPU_TYPE_POWERPC, 9],
["ppc7400", CPU_TYPE_POWERPC, 10],
["ppc7450", CPU_TYPE_POWERPC, 11],
["ppc970", CPU_TYPE_POWERPC, 100],
["ppc64", CPU_TYPE_POWERPC64, 0],
["ppc970-64", CPU_TYPE_POWERPC64, 100],
["i386", CPU_TYPE_I386, 3],
["i486", CPU_TYPE_I386, 4],
["i486sx", CPU_TYPE_I386, 0x84],
["i386", CPU_TYPE_I386, CPU_TYPE_ANY],
["x86_64", CPU_TYPE_X86_64, 3],
["x86_64", CPU_TYPE_X86_64, CPU_TYPE_ANY],
]
def __str__(self):
for info in self.cpu_infos:
if self.cpu == info[1] and (self.sub & 0x00FFFFFF) == info[2]:
return info[0]
return "{0}.{1}".format(self.cpu, self.sub)
class Magic(dict_utils.Enum):
enum = {
"MH_MAGIC": MH_MAGIC,
"MH_CIGAM": MH_CIGAM,
"MH_MAGIC_64": MH_MAGIC_64,
"MH_CIGAM_64": MH_CIGAM_64,
"FAT_MAGIC": FAT_MAGIC,
"FAT_CIGAM": FAT_CIGAM,
}
def __init__(self, initial_value=0):
dict_utils.Enum.__init__(self, initial_value, self.enum)
def is_skinny_mach_file(self):
return (
self.value == MH_MAGIC
or self.value == MH_CIGAM
or self.value == MH_MAGIC_64
or self.value == MH_CIGAM_64
)
def is_universal_mach_file(self):
return self.value == FAT_MAGIC or self.value == FAT_CIGAM
def unpack(self, data):
data.set_byte_order("native")
self.value = data.get_uint32()
def get_byte_order(self):
if (
self.value == MH_CIGAM
or self.value == MH_CIGAM_64
or self.value == FAT_CIGAM
):
return swap_unpack_char()
else:
return "="
def is_64_bit(self):
return self.value == MH_MAGIC_64 or self.value == MH_CIGAM_64
def __init__(self):
self.magic = Mach.Magic()
self.content = None
self.path = None
def extract(self, path, extractor):
self.path = path
self.unpack(extractor)
def parse(self, path):
self.path = path
try:
f = open(self.path)
file_extractor = file_extract.FileExtract(f, "=")
self.unpack(file_extractor)
# f.close()
except IOError as xxx_todo_changeme:
(errno, strerror) = xxx_todo_changeme.args
print("I/O error({0}): {1}".format(errno, strerror))
except ValueError:
print("Could not convert data to an integer.")
except:
print("Unexpected error:", sys.exc_info()[0])
raise
def compare(self, rhs):
self.content.compare(rhs.content)
def dump(self, options=None):
self.content.dump(options)
def dump_header(self, dump_description=True, options=None):
self.content.dump_header(dump_description, options)
def dump_load_commands(self, dump_description=True, options=None):
self.content.dump_load_commands(dump_description, options)
def dump_sections(self, dump_description=True, options=None):
self.content.dump_sections(dump_description, options)
def dump_section_contents(self, options):
self.content.dump_section_contents(options)
def dump_symtab(self, dump_description=True, options=None):
self.content.dump_symtab(dump_description, options)
def dump_symbol_names_matching_regex(self, regex, file=None):
self.content.dump_symbol_names_matching_regex(regex, file)
def description(self):
return self.content.description()
def unpack(self, data):
self.magic.unpack(data)
if self.magic.is_skinny_mach_file():
self.content = Mach.Skinny(self.path)
elif self.magic.is_universal_mach_file():
self.content = Mach.Universal(self.path)
else:
self.content = None
if self.content is not None:
self.content.unpack(data, self.magic)
def is_valid(self):
return self.content is not None
class Universal:
def __init__(self, path):
self.path = path
self.type = "universal"
self.file_off = 0
self.magic = None
self.nfat_arch = 0
self.archs = list()
def description(self):
s = "%#8.8x: %s (" % (self.file_off, self.path)
archs_string = ""
for arch in self.archs:
if len(archs_string):
archs_string += ", "
archs_string += "%s" % arch.arch
s += archs_string
s += ")"
return s
def unpack(self, data, magic=None):
self.file_off = data.tell()
if magic is None:
self.magic = Mach.Magic()
self.magic.unpack(data)
else:
self.magic = magic
self.file_off = self.file_off - 4
# Universal headers are always in big endian
data.set_byte_order("big")
self.nfat_arch = data.get_uint32()
for i in range(self.nfat_arch):
self.archs.append(Mach.Universal.ArchInfo())
self.archs[i].unpack(data)
for i in range(self.nfat_arch):
self.archs[i].mach = Mach.Skinny(self.path)
data.seek(self.archs[i].offset, 0)
skinny_magic = Mach.Magic()
skinny_magic.unpack(data)
self.archs[i].mach.unpack(data, skinny_magic)
def compare(self, rhs):
print("error: comparing two universal files is not supported yet")
return False
def dump(self, options):
if options.dump_header:
print()
print(
"Universal Mach File: magic = %s, nfat_arch = %u"
% (self.magic, self.nfat_arch)
)
print()
if self.nfat_arch > 0:
if options.dump_header:
self.archs[0].dump_header(True, options)
for i in range(self.nfat_arch):
self.archs[i].dump_flat(options)
if options.dump_header:
print()
for i in range(self.nfat_arch):
self.archs[i].mach.dump(options)
def dump_header(self, dump_description=True, options=None):
if dump_description:
print(self.description())
for i in range(self.nfat_arch):
self.archs[i].mach.dump_header(True, options)
print()
def dump_load_commands(self, dump_description=True, options=None):
if dump_description:
print(self.description())
for i in range(self.nfat_arch):
self.archs[i].mach.dump_load_commands(True, options)
print()
def dump_sections(self, dump_description=True, options=None):
if dump_description:
print(self.description())
for i in range(self.nfat_arch):
self.archs[i].mach.dump_sections(True, options)
print()
def dump_section_contents(self, options):
for i in range(self.nfat_arch):
self.archs[i].mach.dump_section_contents(options)
print()
def dump_symtab(self, dump_description=True, options=None):
if dump_description:
print(self.description())
for i in range(self.nfat_arch):
self.archs[i].mach.dump_symtab(True, options)
print()
def dump_symbol_names_matching_regex(self, regex, file=None):
for i in range(self.nfat_arch):
self.archs[i].mach.dump_symbol_names_matching_regex(regex, file)
class ArchInfo:
def __init__(self):
self.arch = Mach.Arch(0, 0)
self.offset = 0
self.size = 0
self.align = 0
self.mach = None
def unpack(self, data):
# Universal headers are always in big endian
data.set_byte_order("big")
(
self.arch.cpu,
self.arch.sub,
self.offset,
self.size,
self.align,
) = data.get_n_uint32(5)
def dump_header(self, dump_description=True, options=None):
if options.verbose:
print("CPU SUBTYPE OFFSET SIZE ALIGN")
print("---------- ---------- ---------- ---------- ----------")
else:
print("ARCH FILEOFFSET FILESIZE ALIGN")
print("---------- ---------- ---------- ----------")
def dump_flat(self, options):
if options.verbose:
print(
"%#8.8x %#8.8x %#8.8x %#8.8x %#8.8x"
% (
self.arch.cpu,
self.arch.sub,
self.offset,
self.size,
self.align,
)
)
else:
print(
"%-10s %#8.8x %#8.8x %#8.8x"
% (self.arch, self.offset, self.size, self.align)
)
def dump(self):
print(" cputype: %#8.8x" % self.arch.cpu)
print("cpusubtype: %#8.8x" % self.arch.sub)
print(" offset: %#8.8x" % self.offset)
print(" size: %#8.8x" % self.size)
print(" align: %#8.8x" % self.align)
def __str__(self):
return "Mach.Universal.ArchInfo: %#8.8x %#8.8x %#8.8x %#8.8x %#8.8x" % (
self.arch.cpu,
self.arch.sub,
self.offset,
self.size,
self.align,
)
def __repr__(self):
return "Mach.Universal.ArchInfo: %#8.8x %#8.8x %#8.8x %#8.8x %#8.8x" % (
self.arch.cpu,
self.arch.sub,
self.offset,
self.size,
self.align,
)
class Flags:
def __init__(self, b):
self.bits = b
def __str__(self):
s = ""
if self.bits & MH_NOUNDEFS:
s += "MH_NOUNDEFS | "
if self.bits & MH_INCRLINK:
s += "MH_INCRLINK | "
if self.bits & MH_DYLDLINK:
s += "MH_DYLDLINK | "
if self.bits & MH_BINDATLOAD:
s += "MH_BINDATLOAD | "
if self.bits & MH_PREBOUND:
s += "MH_PREBOUND | "
if self.bits & MH_SPLIT_SEGS:
s += "MH_SPLIT_SEGS | "
if self.bits & MH_LAZY_INIT:
s += "MH_LAZY_INIT | "
if self.bits & MH_TWOLEVEL:
s += "MH_TWOLEVEL | "
if self.bits & MH_FORCE_FLAT:
s += "MH_FORCE_FLAT | "
if self.bits & MH_NOMULTIDEFS:
s += "MH_NOMULTIDEFS | "
if self.bits & MH_NOFIXPREBINDING:
s += "MH_NOFIXPREBINDING | "
if self.bits & MH_PREBINDABLE:
s += "MH_PREBINDABLE | "
if self.bits & MH_ALLMODSBOUND:
s += "MH_ALLMODSBOUND | "
if self.bits & MH_SUBSECTIONS_VIA_SYMBOLS:
s += "MH_SUBSECTIONS_VIA_SYMBOLS | "
if self.bits & MH_CANONICAL:
s += "MH_CANONICAL | "
if self.bits & MH_WEAK_DEFINES:
s += "MH_WEAK_DEFINES | "
if self.bits & MH_BINDS_TO_WEAK:
s += "MH_BINDS_TO_WEAK | "
if self.bits & MH_ALLOW_STACK_EXECUTION:
s += "MH_ALLOW_STACK_EXECUTION | "
if self.bits & MH_ROOT_SAFE:
s += "MH_ROOT_SAFE | "
if self.bits & MH_SETUID_SAFE:
s += "MH_SETUID_SAFE | "
if self.bits & MH_NO_REEXPORTED_DYLIBS:
s += "MH_NO_REEXPORTED_DYLIBS | "
if self.bits & MH_PIE:
s += "MH_PIE | "
if self.bits & MH_DEAD_STRIPPABLE_DYLIB:
s += "MH_DEAD_STRIPPABLE_DYLIB | "
if self.bits & MH_HAS_TLV_DESCRIPTORS:
s += "MH_HAS_TLV_DESCRIPTORS | "
if self.bits & MH_NO_HEAP_EXECUTION:
s += "MH_NO_HEAP_EXECUTION | "
# Strip the trailing " |" if we have any flags
if len(s) > 0:
s = s[0:-2]
return s
class FileType(dict_utils.Enum):
enum = {
"MH_OBJECT": MH_OBJECT,
"MH_EXECUTE": MH_EXECUTE,
"MH_FVMLIB": MH_FVMLIB,
"MH_CORE": MH_CORE,
"MH_PRELOAD": MH_PRELOAD,
"MH_DYLIB": MH_DYLIB,
"MH_DYLINKER": MH_DYLINKER,
"MH_BUNDLE": MH_BUNDLE,
"MH_DYLIB_STUB": MH_DYLIB_STUB,
"MH_DSYM": MH_DSYM,
"MH_KEXT_BUNDLE": MH_KEXT_BUNDLE,
}
def __init__(self, initial_value=0):
dict_utils.Enum.__init__(self, initial_value, self.enum)
class Skinny:
def __init__(self, path):
self.path = path
self.type = "skinny"
self.data = None
self.file_off = 0
self.magic = 0
self.arch = Mach.Arch(0, 0)
self.filetype = Mach.FileType(0)
self.ncmds = 0
self.sizeofcmds = 0
self.flags = Mach.Flags(0)
self.uuid = None
self.commands = list()
self.segments = list()
self.sections = list()
self.symbols = list()
self.sections.append(Mach.Section())
def description(self):
return "%#8.8x: %s (%s)" % (self.file_off, self.path, self.arch)
def unpack(self, data, magic=None):
self.data = data
self.file_off = data.tell()
if magic is None:
self.magic = Mach.Magic()
self.magic.unpack(data)
else:
self.magic = magic
self.file_off = self.file_off - 4
data.set_byte_order(self.magic.get_byte_order())
(
self.arch.cpu,
self.arch.sub,
self.filetype.value,
self.ncmds,
self.sizeofcmds,
bits,
) = data.get_n_uint32(6)
self.flags.bits = bits
if self.is_64_bit():
data.get_uint32() # Skip reserved word in mach_header_64
for i in range(0, self.ncmds):
lc = self.unpack_load_command(data)
self.commands.append(lc)
def get_data(self):
if self.data:
self.data.set_byte_order(self.magic.get_byte_order())
return self.data
return None
def unpack_load_command(self, data):
lc = Mach.LoadCommand()
lc.unpack(self, data)
lc_command = lc.command.get_enum_value()
if lc_command == LC_SEGMENT or lc_command == LC_SEGMENT_64:
lc = Mach.SegmentLoadCommand(lc)
lc.unpack(self, data)
elif (
lc_command == LC_LOAD_DYLIB
or lc_command == LC_ID_DYLIB
or lc_command == LC_LOAD_WEAK_DYLIB
or lc_command == LC_REEXPORT_DYLIB
):
lc = Mach.DylibLoadCommand(lc)
lc.unpack(self, data)
elif (
lc_command == LC_LOAD_DYLINKER
or lc_command == LC_SUB_FRAMEWORK
or lc_command == LC_SUB_CLIENT
or lc_command == LC_SUB_UMBRELLA
or lc_command == LC_SUB_LIBRARY
or lc_command == LC_ID_DYLINKER
or lc_command == LC_RPATH
):
lc = Mach.LoadDYLDLoadCommand(lc)
lc.unpack(self, data)
elif lc_command == LC_DYLD_INFO_ONLY:
lc = Mach.DYLDInfoOnlyLoadCommand(lc)
lc.unpack(self, data)
elif lc_command == LC_SYMTAB:
lc = Mach.SymtabLoadCommand(lc)
lc.unpack(self, data)
elif lc_command == LC_DYSYMTAB:
lc = Mach.DYLDSymtabLoadCommand(lc)
lc.unpack(self, data)
elif lc_command == LC_UUID:
lc = Mach.UUIDLoadCommand(lc)
lc.unpack(self, data)
elif (
lc_command == LC_CODE_SIGNATURE
or lc_command == LC_SEGMENT_SPLIT_INFO
or lc_command == LC_FUNCTION_STARTS
):
lc = Mach.DataBlobLoadCommand(lc)
lc.unpack(self, data)
elif lc_command == LC_UNIXTHREAD:
lc = Mach.UnixThreadLoadCommand(lc)
lc.unpack(self, data)
elif lc_command == LC_ENCRYPTION_INFO:
lc = Mach.EncryptionInfoLoadCommand(lc)
lc.unpack(self, data)
lc.skip(data)
return lc
def compare(self, rhs):
print("\nComparing:")
print("a) %s %s" % (self.arch, self.path))
print("b) %s %s" % (rhs.arch, rhs.path))
result = True
if self.type == rhs.type:
for lhs_section in self.sections[1:]:
rhs_section = rhs.get_section_by_section(lhs_section)
if rhs_section:
print(
"comparing %s.%s..."
% (lhs_section.segname, lhs_section.sectname),
end=" ",
)
sys.stdout.flush()
lhs_data = lhs_section.get_contents(self)
rhs_data = rhs_section.get_contents(rhs)
if lhs_data and rhs_data:
if lhs_data == rhs_data:
print("ok")
else:
lhs_data_len = len(lhs_data)
rhs_data_len = len(rhs_data)
# if lhs_data_len < rhs_data_len:
# if lhs_data == rhs_data[0:lhs_data_len]:
# print 'section data for %s matches the first %u bytes' % (lhs_section.sectname, lhs_data_len)
# else:
# # TODO: check padding
# result = False
# elif lhs_data_len > rhs_data_len:
# if lhs_data[0:rhs_data_len] == rhs_data:
# print 'section data for %s matches the first %u bytes' % (lhs_section.sectname, lhs_data_len)
# else:
# # TODO: check padding
# result = False
# else:
result = False
print("error: sections differ")
# print 'a) %s' % (lhs_section)
# dump_hex_byte_string_diff(0, lhs_data, rhs_data)
# print 'b) %s' % (rhs_section)
# dump_hex_byte_string_diff(0, rhs_data, lhs_data)
elif lhs_data and not rhs_data:
print("error: section data missing from b:")
print("a) %s" % (lhs_section))
print("b) %s" % (rhs_section))
result = False
elif not lhs_data and rhs_data:
print("error: section data missing from a:")
print("a) %s" % (lhs_section))
print("b) %s" % (rhs_section))
result = False
elif lhs_section.offset or rhs_section.offset:
print("error: section data missing for both a and b:")
print("a) %s" % (lhs_section))
print("b) %s" % (rhs_section))
result = False
else:
print("ok")
else:
result = False
print(
"error: section %s is missing in %s"
% (lhs_section.sectname, rhs.path)
)
else:
print(
"error: comparing a %s mach-o file with a %s mach-o file is not supported"
% (self.type, rhs.type)
)
result = False
if not result:
print("error: mach files differ")
return result
def dump_header(self, dump_description=True, options=None):
if options.verbose:
print(
"MAGIC CPU SUBTYPE FILETYPE NUM CMDS SIZE CMDS FLAGS"
)
print(
"---------- ---------- ---------- ---------- -------- ---------- ----------"
)
else:
print(
"MAGIC ARCH FILETYPE NUM CMDS SIZE CMDS FLAGS"
)
print(
"------------ ---------- -------------- -------- ---------- ----------"
)
def dump_flat(self, options):
if options.verbose:
print(
"%#8.8x %#8.8x %#8.8x %#8.8x %#8u %#8.8x %#8.8x"
% (
self.magic,
self.arch.cpu,
self.arch.sub,
self.filetype.value,
self.ncmds,
self.sizeofcmds,
self.flags.bits,
)
)
else:
print(
"%-12s %-10s %-14s %#8u %#8.8x %s"
% (
self.magic,
self.arch,
self.filetype,
self.ncmds,
self.sizeofcmds,
self.flags,
)
)
def dump(self, options):
if options.dump_header:
self.dump_header(True, options)
if options.dump_load_commands:
self.dump_load_commands(False, options)
if options.dump_sections:
self.dump_sections(False, options)
if options.section_names:
self.dump_section_contents(options)
if options.dump_symtab:
self.get_symtab()
if len(self.symbols):
self.dump_sections(False, options)
else:
print("No symbols")
if options.find_mangled:
self.dump_symbol_names_matching_regex(re.compile("^_?_Z"))
def dump_header(self, dump_description=True, options=None):
if dump_description:
print(self.description())
print("Mach Header")
print(" magic: %#8.8x %s" % (self.magic.value, self.magic))
print(" cputype: %#8.8x %s" % (self.arch.cpu, self.arch))
print(" cpusubtype: %#8.8x" % self.arch.sub)
print(
" filetype: %#8.8x %s"
% (self.filetype.get_enum_value(), self.filetype.get_enum_name())
)
print(" ncmds: %#8.8x %u" % (self.ncmds, self.ncmds))
print(" sizeofcmds: %#8.8x" % self.sizeofcmds)
print(" flags: %#8.8x %s" % (self.flags.bits, self.flags))
def dump_load_commands(self, dump_description=True, options=None):
if dump_description:
print(self.description())
for lc in self.commands:
print(lc)
def get_section_by_name(self, name):
for section in self.sections:
if section.sectname and section.sectname == name:
return section
return None
def get_section_by_section(self, other_section):
for section in self.sections:
if (
section.sectname == other_section.sectname
and section.segname == other_section.segname
):
return section
return None
def dump_sections(self, dump_description=True, options=None):
if dump_description:
print(self.description())
num_sections = len(self.sections)
if num_sections > 1:
self.sections[1].dump_header()
for sect_idx in range(1, num_sections):
print("%s" % self.sections[sect_idx])
def dump_section_contents(self, options):
saved_section_to_disk = False
for sectname in options.section_names:
section = self.get_section_by_name(sectname)
if section:
sect_bytes = section.get_contents(self)
if options.outfile:
if not saved_section_to_disk:
outfile = open(options.outfile, "w")
if options.extract_modules:
# print "Extracting modules from mach file..."
data = file_extract.FileExtract(
io.BytesIO(sect_bytes), self.data.byte_order
)
version = data.get_uint32()
num_modules = data.get_uint32()
# print "version = %u, num_modules = %u" %
# (version, num_modules)
for i in range(num_modules):
data_offset = data.get_uint64()
data_size = data.get_uint64()
name_offset = data.get_uint32()
language = data.get_uint32()
flags = data.get_uint32()
data.seek(name_offset)
module_name = data.get_c_string()
# print "module[%u] data_offset = %#16.16x,
# data_size = %#16.16x, name_offset =
# %#16.16x (%s), language = %u, flags =
# %#x" % (i, data_offset, data_size,
# name_offset, module_name, language,
# flags)
data.seek(data_offset)
outfile.write(data.read_size(data_size))
else:
print(
"Saving section %s to '%s'"
% (sectname, options.outfile)
)
outfile.write(sect_bytes)
outfile.close()
saved_section_to_disk = True
else:
print(
"error: you can only save a single section to disk at a time, skipping section '%s'"
% (sectname)
)
else:
print("section %s:\n" % (sectname))
section.dump_header()
print("%s\n" % (section))
dump_memory(0, sect_bytes, options.max_count, 16)
else:
print('error: no section named "%s" was found' % (sectname))
def get_segment(self, segname):
if len(self.segments) == 1 and self.segments[0].segname == "":
return self.segments[0]
for segment in self.segments:
if segment.segname == segname:
return segment
return None
def get_first_load_command(self, lc_enum_value):
for lc in self.commands:
if lc.command.value == lc_enum_value:
return lc
return None
def get_symtab(self):
if self.data and not self.symbols:
lc_symtab = self.get_first_load_command(LC_SYMTAB)
if lc_symtab:
symtab_offset = self.file_off
if self.data.is_in_memory():
linkedit_segment = self.get_segment("__LINKEDIT")
if linkedit_segment:
linkedit_vmaddr = linkedit_segment.vmaddr
linkedit_fileoff = linkedit_segment.fileoff
symtab_offset = (
linkedit_vmaddr + lc_symtab.symoff - linkedit_fileoff
)
symtab_offset = (
linkedit_vmaddr + lc_symtab.stroff - linkedit_fileoff
)
else:
symtab_offset += lc_symtab.symoff
self.data.seek(symtab_offset)
is_64 = self.is_64_bit()
for i in range(lc_symtab.nsyms):
nlist = Mach.NList()
nlist.unpack(self, self.data, lc_symtab)
self.symbols.append(nlist)
else:
print("no LC_SYMTAB")
def dump_symtab(self, dump_description=True, options=None):
self.get_symtab()
if dump_description:
print(self.description())
for i, symbol in enumerate(self.symbols):
print("[%5u] %s" % (i, symbol))
def dump_symbol_names_matching_regex(self, regex, file=None):
self.get_symtab()
for symbol in self.symbols:
if symbol.name and regex.search(symbol.name):
print(symbol.name)
if file:
file.write("%s\n" % (symbol.name))
def is_64_bit(self):
return self.magic.is_64_bit()
class LoadCommand:
class Command(dict_utils.Enum):
enum = {
"LC_SEGMENT": LC_SEGMENT,
"LC_SYMTAB": LC_SYMTAB,
"LC_SYMSEG": LC_SYMSEG,
"LC_THREAD": LC_THREAD,
"LC_UNIXTHREAD": LC_UNIXTHREAD,
"LC_LOADFVMLIB": LC_LOADFVMLIB,
"LC_IDFVMLIB": LC_IDFVMLIB,
"LC_IDENT": LC_IDENT,
"LC_FVMFILE": LC_FVMFILE,
"LC_PREPAGE": LC_PREPAGE,
"LC_DYSYMTAB": LC_DYSYMTAB,
"LC_LOAD_DYLIB": LC_LOAD_DYLIB,
"LC_ID_DYLIB": LC_ID_DYLIB,
"LC_LOAD_DYLINKER": LC_LOAD_DYLINKER,
"LC_ID_DYLINKER": LC_ID_DYLINKER,
"LC_PREBOUND_DYLIB": LC_PREBOUND_DYLIB,
"LC_ROUTINES": LC_ROUTINES,
"LC_SUB_FRAMEWORK": LC_SUB_FRAMEWORK,
"LC_SUB_UMBRELLA": LC_SUB_UMBRELLA,
"LC_SUB_CLIENT": LC_SUB_CLIENT,
"LC_SUB_LIBRARY": LC_SUB_LIBRARY,
"LC_TWOLEVEL_HINTS": LC_TWOLEVEL_HINTS,
"LC_PREBIND_CKSUM": LC_PREBIND_CKSUM,
"LC_LOAD_WEAK_DYLIB": LC_LOAD_WEAK_DYLIB,
"LC_SEGMENT_64": LC_SEGMENT_64,
"LC_ROUTINES_64": LC_ROUTINES_64,
"LC_UUID": LC_UUID,
"LC_RPATH": LC_RPATH,
"LC_CODE_SIGNATURE": LC_CODE_SIGNATURE,
"LC_SEGMENT_SPLIT_INFO": LC_SEGMENT_SPLIT_INFO,
"LC_REEXPORT_DYLIB": LC_REEXPORT_DYLIB,
"LC_LAZY_LOAD_DYLIB": LC_LAZY_LOAD_DYLIB,
"LC_ENCRYPTION_INFO": LC_ENCRYPTION_INFO,
"LC_DYLD_INFO": LC_DYLD_INFO,
"LC_DYLD_INFO_ONLY": LC_DYLD_INFO_ONLY,
"LC_LOAD_UPWARD_DYLIB": LC_LOAD_UPWARD_DYLIB,
"LC_VERSION_MIN_MACOSX": LC_VERSION_MIN_MACOSX,
"LC_VERSION_MIN_IPHONEOS": LC_VERSION_MIN_IPHONEOS,
"LC_FUNCTION_STARTS": LC_FUNCTION_STARTS,
"LC_DYLD_ENVIRONMENT": LC_DYLD_ENVIRONMENT,
}
def __init__(self, initial_value=0):
dict_utils.Enum.__init__(self, initial_value, self.enum)
def __init__(self, c=None, l=0, o=0):
if c is not None:
self.command = c
else:
self.command = Mach.LoadCommand.Command(0)
self.length = l
self.file_off = o
def unpack(self, mach_file, data):
self.file_off = data.tell()
self.command.value, self.length = data.get_n_uint32(2)
def skip(self, data):
data.seek(self.file_off + self.length, 0)
def __str__(self):
lc_name = self.command.get_enum_name()
return "%#8.8x: <%#4.4x> %-24s" % (self.file_off, self.length, lc_name)
class Section:
def __init__(self):
self.index = 0
self.is_64 = False
self.sectname = None
self.segname = None
self.addr = 0
self.size = 0
self.offset = 0
self.align = 0
self.reloff = 0
self.nreloc = 0
self.flags = 0
self.reserved1 = 0
self.reserved2 = 0
self.reserved3 = 0
def unpack(self, is_64, data):
self.is_64 = is_64
self.sectname = data.get_fixed_length_c_string(16, "", True)
self.segname = data.get_fixed_length_c_string(16, "", True)
if self.is_64:
self.addr, self.size = data.get_n_uint64(2)
(
self.offset,
self.align,
self.reloff,
self.nreloc,
self.flags,
self.reserved1,
self.reserved2,
self.reserved3,
) = data.get_n_uint32(8)
else:
self.addr, self.size = data.get_n_uint32(2)
(
self.offset,
self.align,
self.reloff,
self.nreloc,
self.flags,
self.reserved1,
self.reserved2,
) = data.get_n_uint32(7)
def dump_header(self):
if self.is_64:
print(
"INDEX ADDRESS SIZE OFFSET ALIGN RELOFF NRELOC FLAGS RESERVED1 RESERVED2 RESERVED3 NAME"
)
print(
"===== ------------------ ------------------ ---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ----------------------"
)
else:
print(
"INDEX ADDRESS SIZE OFFSET ALIGN RELOFF NRELOC FLAGS RESERVED1 RESERVED2 NAME"
)
print(
"===== ---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ----------------------"
)
def __str__(self):
if self.is_64:
return (
"[%3u] %#16.16x %#16.16x %#8.8x %#8.8x %#8.8x %#8.8x %#8.8x %#8.8x %#8.8x %#8.8x %s.%s"
% (
self.index,
self.addr,
self.size,
self.offset,
self.align,
self.reloff,
self.nreloc,
self.flags,
self.reserved1,
self.reserved2,
self.reserved3,
self.segname,
self.sectname,
)
)
else:
return (
"[%3u] %#8.8x %#8.8x %#8.8x %#8.8x %#8.8x %#8.8x %#8.8x %#8.8x %#8.8x %s.%s"
% (
self.index,
self.addr,
self.size,
self.offset,
self.align,
self.reloff,
self.nreloc,
self.flags,
self.reserved1,
self.reserved2,
self.segname,
self.sectname,
)
)
def get_contents(self, mach_file):
"""Get the section contents as a python string"""
if self.size > 0 and mach_file.get_segment(self.segname).filesize > 0:
data = mach_file.get_data()
if data:
section_data_offset = mach_file.file_off + self.offset
# print '%s.%s is at offset 0x%x with size 0x%x' %
# (self.segname, self.sectname, section_data_offset,
# self.size)
data.push_offset_and_seek(section_data_offset)
bytes = data.read_size(self.size)
data.pop_offset_and_seek()
return bytes
return None
class DylibLoadCommand(LoadCommand):
def __init__(self, lc):
Mach.LoadCommand.__init__(self, lc.command, lc.length, lc.file_off)
self.name = None
self.timestamp = 0
self.current_version = 0
self.compatibility_version = 0
def unpack(self, mach_file, data):
byte_order_char = mach_file.magic.get_byte_order()
(
name_offset,
self.timestamp,
self.current_version,
self.compatibility_version,
) = data.get_n_uint32(4)
data.seek(self.file_off + name_offset, 0)
self.name = data.get_fixed_length_c_string(self.length - 24)
def __str__(self):
s = Mach.LoadCommand.__str__(self)
s += "%#8.8x %#8.8x %#8.8x " % (
self.timestamp,
self.current_version,
self.compatibility_version,
)
s += self.name
return s
class LoadDYLDLoadCommand(LoadCommand):
def __init__(self, lc):
Mach.LoadCommand.__init__(self, lc.command, lc.length, lc.file_off)
self.name = None
def unpack(self, mach_file, data):
data.get_uint32()
self.name = data.get_fixed_length_c_string(self.length - 12)
def __str__(self):
s = Mach.LoadCommand.__str__(self)
s += "%s" % self.name
return s
class UnixThreadLoadCommand(LoadCommand):
class ThreadState:
def __init__(self):
self.flavor = 0
self.count = 0
self.register_values = list()
def unpack(self, data):
self.flavor, self.count = data.get_n_uint32(2)
self.register_values = data.get_n_uint32(self.count)
def __str__(self):
s = "flavor = %u, count = %u, regs =" % (self.flavor, self.count)
i = 0
for register_value in self.register_values:
if i % 8 == 0:
s += "\n "
s += " %#8.8x" % register_value
i += 1
return s
def __init__(self, lc):
Mach.LoadCommand.__init__(self, lc.command, lc.length, lc.file_off)
self.reg_sets = list()
def unpack(self, mach_file, data):
reg_set = Mach.UnixThreadLoadCommand.ThreadState()
reg_set.unpack(data)
self.reg_sets.append(reg_set)
def __str__(self):
s = Mach.LoadCommand.__str__(self)
for reg_set in self.reg_sets:
s += "%s" % reg_set
return s
class DYLDInfoOnlyLoadCommand(LoadCommand):
def __init__(self, lc):
Mach.LoadCommand.__init__(self, lc.command, lc.length, lc.file_off)
self.rebase_off = 0
self.rebase_size = 0
self.bind_off = 0
self.bind_size = 0
self.weak_bind_off = 0
self.weak_bind_size = 0
self.lazy_bind_off = 0
self.lazy_bind_size = 0
self.export_off = 0
self.export_size = 0
def unpack(self, mach_file, data):
byte_order_char = mach_file.magic.get_byte_order()
(
self.rebase_off,
self.rebase_size,
self.bind_off,
self.bind_size,
self.weak_bind_off,
self.weak_bind_size,
self.lazy_bind_off,
self.lazy_bind_size,
self.export_off,
self.export_size,
) = data.get_n_uint32(10)
def __str__(self):
s = Mach.LoadCommand.__str__(self)
s += "rebase_off = %#8.8x, rebase_size = %u, " % (
self.rebase_off,
self.rebase_size,
)
s += "bind_off = %#8.8x, bind_size = %u, " % (self.bind_off, self.bind_size)
s += "weak_bind_off = %#8.8x, weak_bind_size = %u, " % (
self.weak_bind_off,
self.weak_bind_size,
)
s += "lazy_bind_off = %#8.8x, lazy_bind_size = %u, " % (
self.lazy_bind_off,
self.lazy_bind_size,
)
s += "export_off = %#8.8x, export_size = %u, " % (
self.export_off,
self.export_size,
)
return s
class DYLDSymtabLoadCommand(LoadCommand):
def __init__(self, lc):
Mach.LoadCommand.__init__(self, lc.command, lc.length, lc.file_off)
self.ilocalsym = 0
self.nlocalsym = 0
self.iextdefsym = 0
self.nextdefsym = 0
self.iundefsym = 0
self.nundefsym = 0
self.tocoff = 0
self.ntoc = 0
self.modtaboff = 0
self.nmodtab = 0
self.extrefsymoff = 0
self.nextrefsyms = 0
self.indirectsymoff = 0
self.nindirectsyms = 0
self.extreloff = 0
self.nextrel = 0
self.locreloff = 0
self.nlocrel = 0
def unpack(self, mach_file, data):
byte_order_char = mach_file.magic.get_byte_order()
(
self.ilocalsym,
self.nlocalsym,
self.iextdefsym,
self.nextdefsym,
self.iundefsym,
self.nundefsym,
self.tocoff,
self.ntoc,
self.modtaboff,
self.nmodtab,
self.extrefsymoff,
self.nextrefsyms,
self.indirectsymoff,
self.nindirectsyms,
self.extreloff,
self.nextrel,
self.locreloff,
self.nlocrel,
) = data.get_n_uint32(18)
def __str__(self):
s = Mach.LoadCommand.__str__(self)
# s += "ilocalsym = %u, nlocalsym = %u, " % (self.ilocalsym, self.nlocalsym)
# s += "iextdefsym = %u, nextdefsym = %u, " % (self.iextdefsym, self.nextdefsym)
# s += "iundefsym %u, nundefsym = %u, " % (self.iundefsym, self.nundefsym)
# s += "tocoff = %#8.8x, ntoc = %u, " % (self.tocoff, self.ntoc)
# s += "modtaboff = %#8.8x, nmodtab = %u, " % (self.modtaboff, self.nmodtab)
# s += "extrefsymoff = %#8.8x, nextrefsyms = %u, " % (self.extrefsymoff, self.nextrefsyms)
# s += "indirectsymoff = %#8.8x, nindirectsyms = %u, " % (self.indirectsymoff, self.nindirectsyms)
# s += "extreloff = %#8.8x, nextrel = %u, " % (self.extreloff, self.nextrel)
# s += "locreloff = %#8.8x, nlocrel = %u" % (self.locreloff,
# self.nlocrel)
s += "ilocalsym = %-10u, nlocalsym = %u\n" % (
self.ilocalsym,
self.nlocalsym,
)
s += (
" iextdefsym = %-10u, nextdefsym = %u\n"
% (self.iextdefsym, self.nextdefsym)
)
s += (
" iundefsym = %-10u, nundefsym = %u\n"
% (self.iundefsym, self.nundefsym)
)
s += (
" tocoff = %#8.8x, ntoc = %u\n"
% (self.tocoff, self.ntoc)
)
s += (
" modtaboff = %#8.8x, nmodtab = %u\n"
% (self.modtaboff, self.nmodtab)
)
s += (
" extrefsymoff = %#8.8x, nextrefsyms = %u\n"
% (self.extrefsymoff, self.nextrefsyms)
)
s += (
" indirectsymoff = %#8.8x, nindirectsyms = %u\n"
% (self.indirectsymoff, self.nindirectsyms)
)
s += (
" extreloff = %#8.8x, nextrel = %u\n"
% (self.extreloff, self.nextrel)
)
s += (
" locreloff = %#8.8x, nlocrel = %u"
% (self.locreloff, self.nlocrel)
)
return s
class SymtabLoadCommand(LoadCommand):
def __init__(self, lc):
Mach.LoadCommand.__init__(self, lc.command, lc.length, lc.file_off)
self.symoff = 0
self.nsyms = 0
self.stroff = 0
self.strsize = 0
def unpack(self, mach_file, data):
byte_order_char = mach_file.magic.get_byte_order()
self.symoff, self.nsyms, self.stroff, self.strsize = data.get_n_uint32(4)
def __str__(self):
s = Mach.LoadCommand.__str__(self)
s += "symoff = %#8.8x, nsyms = %u, stroff = %#8.8x, strsize = %u" % (
self.symoff,
self.nsyms,
self.stroff,
self.strsize,
)
return s
class UUIDLoadCommand(LoadCommand):
def __init__(self, lc):
Mach.LoadCommand.__init__(self, lc.command, lc.length, lc.file_off)
self.uuid = None
def unpack(self, mach_file, data):
uuid_data = data.get_n_uint8(16)
uuid_str = ""
for byte in uuid_data:
uuid_str += "%2.2x" % byte
self.uuid = uuid.UUID(uuid_str)
mach_file.uuid = self.uuid
def __str__(self):
s = Mach.LoadCommand.__str__(self)
s += self.uuid.__str__()
return s
class DataBlobLoadCommand(LoadCommand):
def __init__(self, lc):
Mach.LoadCommand.__init__(self, lc.command, lc.length, lc.file_off)
self.dataoff = 0
self.datasize = 0
def unpack(self, mach_file, data):
byte_order_char = mach_file.magic.get_byte_order()
self.dataoff, self.datasize = data.get_n_uint32(2)
def __str__(self):
s = Mach.LoadCommand.__str__(self)
s += "dataoff = %#8.8x, datasize = %u" % (self.dataoff, self.datasize)
return s
class EncryptionInfoLoadCommand(LoadCommand):
def __init__(self, lc):
Mach.LoadCommand.__init__(self, lc.command, lc.length, lc.file_off)
self.cryptoff = 0
self.cryptsize = 0
self.cryptid = 0
def unpack(self, mach_file, data):
byte_order_char = mach_file.magic.get_byte_order()
self.cryptoff, self.cryptsize, self.cryptid = data.get_n_uint32(3)
def __str__(self):
s = Mach.LoadCommand.__str__(self)
s += "file-range = [%#8.8x - %#8.8x), cryptsize = %u, cryptid = %u" % (
self.cryptoff,
self.cryptoff + self.cryptsize,
self.cryptsize,
self.cryptid,
)
return s
class SegmentLoadCommand(LoadCommand):
def __init__(self, lc):
Mach.LoadCommand.__init__(self, lc.command, lc.length, lc.file_off)
self.segname = None
self.vmaddr = 0
self.vmsize = 0
self.fileoff = 0
self.filesize = 0
self.maxprot = 0
self.initprot = 0
self.nsects = 0
self.flags = 0
def unpack(self, mach_file, data):
is_64 = self.command.get_enum_value() == LC_SEGMENT_64
self.segname = data.get_fixed_length_c_string(16, "", True)
if is_64:
(
self.vmaddr,
self.vmsize,
self.fileoff,
self.filesize,
) = data.get_n_uint64(4)
else:
(
self.vmaddr,
self.vmsize,
self.fileoff,
self.filesize,
) = data.get_n_uint32(4)
self.maxprot, self.initprot, self.nsects, self.flags = data.get_n_uint32(4)
mach_file.segments.append(self)
for i in range(self.nsects):
section = Mach.Section()
section.unpack(is_64, data)
section.index = len(mach_file.sections)
mach_file.sections.append(section)
def __str__(self):
s = Mach.LoadCommand.__str__(self)
if self.command.get_enum_value() == LC_SEGMENT:
s += "%#8.8x %#8.8x %#8.8x %#8.8x " % (
self.vmaddr,
self.vmsize,
self.fileoff,
self.filesize,
)
else:
s += "%#16.16x %#16.16x %#16.16x %#16.16x " % (
self.vmaddr,
self.vmsize,
self.fileoff,
self.filesize,
)
s += "%s %s %3u %#8.8x" % (
vm_prot_names[self.maxprot],
vm_prot_names[self.initprot],
self.nsects,
self.flags,
)
s += " " + self.segname
return s
class NList:
class Type:
class Stab(dict_utils.Enum):
enum = {
"N_GSYM": N_GSYM,
"N_FNAME": N_FNAME,
"N_FUN": N_FUN,
"N_STSYM": N_STSYM,
"N_LCSYM": N_LCSYM,
"N_BNSYM": N_BNSYM,
"N_OPT": N_OPT,
"N_RSYM": N_RSYM,
"N_SLINE": N_SLINE,
"N_ENSYM": N_ENSYM,
"N_SSYM": N_SSYM,
"N_SO": N_SO,
"N_OSO": N_OSO,
"N_LSYM": N_LSYM,
"N_BINCL": N_BINCL,
"N_SOL": N_SOL,
"N_PARAMS": N_PARAMS,
"N_VERSION": N_VERSION,
"N_OLEVEL": N_OLEVEL,
"N_PSYM": N_PSYM,
"N_EINCL": N_EINCL,
"N_ENTRY": N_ENTRY,
"N_LBRAC": N_LBRAC,
"N_EXCL": N_EXCL,
"N_RBRAC": N_RBRAC,
"N_BCOMM": N_BCOMM,
"N_ECOMM": N_ECOMM,
"N_ECOML": N_ECOML,
"N_LENG": N_LENG,
}
def __init__(self, magic=0):
dict_utils.Enum.__init__(self, magic, self.enum)
def __init__(self, t=0):
self.value = t
def __str__(self):
n_type = self.value
if n_type & N_STAB:
stab = Mach.NList.Type.Stab(self.value)
return "%s" % stab
else:
type = self.value & N_TYPE
type_str = ""
if type == N_UNDF:
type_str = "N_UNDF"
elif type == N_ABS:
type_str = "N_ABS "
elif type == N_SECT:
type_str = "N_SECT"
elif type == N_PBUD:
type_str = "N_PBUD"
elif type == N_INDR:
type_str = "N_INDR"
else:
type_str = "??? (%#2.2x)" % type
if n_type & N_PEXT:
type_str += " | PEXT"
if n_type & N_EXT:
type_str += " | EXT "
return type_str
def __init__(self):
self.index = 0
self.name_offset = 0
self.name = 0
self.type = Mach.NList.Type()
self.sect_idx = 0
self.desc = 0
self.value = 0
def unpack(self, mach_file, data, symtab_lc):
self.index = len(mach_file.symbols)
self.name_offset = data.get_uint32()
self.type.value, self.sect_idx = data.get_n_uint8(2)
self.desc = data.get_uint16()
if mach_file.is_64_bit():
self.value = data.get_uint64()
else:
self.value = data.get_uint32()
data.push_offset_and_seek(
mach_file.file_off + symtab_lc.stroff + self.name_offset
)
# print "get string for symbol[%u]" % self.index
self.name = data.get_c_string()
data.pop_offset_and_seek()
def __str__(self):
name_display = ""
if len(self.name):
name_display = ' "%s"' % self.name
return "%#8.8x %#2.2x (%-20s) %#2.2x %#4.4x %16.16x%s" % (
self.name_offset,
self.type.value,
self.type,
self.sect_idx,
self.desc,
self.value,
name_display,
)
class Interactive(cmd.Cmd):
"""Interactive command interpreter to mach-o files."""
def __init__(self, mach, options):
cmd.Cmd.__init__(self)
self.intro = "Interactive mach-o command interpreter"
self.prompt = "mach-o: %s %% " % mach.path
self.mach = mach
self.options = options
def default(self, line):
"""Catch all for unknown command, which will exit the interpreter."""
print("uknown command: %s" % line)
return True
def do_q(self, line):
"""Quit command"""
return True
def do_quit(self, line):
"""Quit command"""
return True
def do_header(self, line):
"""Dump mach-o file headers"""
self.mach.dump_header(True, self.options)
return False
def do_load(self, line):
"""Dump all mach-o load commands"""
self.mach.dump_load_commands(True, self.options)
return False
def do_sections(self, line):
"""Dump all mach-o sections"""
self.mach.dump_sections(True, self.options)
return False
def do_symtab(self, line):
"""Dump all mach-o symbols in the symbol table"""
self.mach.dump_symtab(True, self.options)
return False
if __name__ == "__main__":
parser = optparse.OptionParser(
description="A script that parses skinny and universal mach-o files."
)
parser.add_option(
"--arch",
"-a",
type="string",
metavar="arch",
dest="archs",
action="append",
help="specify one or more architectures by name",
)
parser.add_option(
"-v",
"--verbose",
action="store_true",
dest="verbose",
help="display verbose debug info",
default=False,
)
parser.add_option(
"-H",
"--header",
action="store_true",
dest="dump_header",
help="dump the mach-o file header",
default=False,
)
parser.add_option(
"-l",
"--load-commands",
action="store_true",
dest="dump_load_commands",
help="dump the mach-o load commands",
default=False,
)
parser.add_option(
"-s",
"--symtab",
action="store_true",
dest="dump_symtab",
help="dump the mach-o symbol table",
default=False,
)
parser.add_option(
"-S",
"--sections",
action="store_true",
dest="dump_sections",
help="dump the mach-o sections",
default=False,
)
parser.add_option(
"--section",
type="string",
metavar="sectname",
dest="section_names",
action="append",
help="Specify one or more section names to dump",
default=[],
)
parser.add_option(
"-o",
"--out",
type="string",
dest="outfile",
help="Used in conjunction with the --section=NAME option to save a single section's data to disk.",
default=False,
)
parser.add_option(
"-i",
"--interactive",
action="store_true",
dest="interactive",
help="enable interactive mode",
default=False,
)
parser.add_option(
"-m",
"--mangled",
action="store_true",
dest="find_mangled",
help="dump all mangled names in a mach file",
default=False,
)
parser.add_option(
"-c",
"--compare",
action="store_true",
dest="compare",
help="compare two mach files",
default=False,
)
parser.add_option(
"-M",
"--extract-modules",
action="store_true",
dest="extract_modules",
help="Extract modules from file",
default=False,
)
parser.add_option(
"-C",
"--count",
type="int",
dest="max_count",
help="Sets the max byte count when dumping section data",
default=-1,
)
(options, mach_files) = parser.parse_args()
if options.extract_modules:
if options.section_names:
print("error: can't use --section option with the --extract-modules option")
exit(1)
if not options.outfile:
print(
"error: the --output=FILE option must be specified with the --extract-modules option"
)
exit(1)
options.section_names.append("__apple_ast")
if options.compare:
if len(mach_files) == 2:
mach_a = Mach()
mach_b = Mach()
mach_a.parse(mach_files[0])
mach_b.parse(mach_files[1])
mach_a.compare(mach_b)
else:
print("error: --compare takes two mach files as arguments")
else:
if not (
options.dump_header
or options.dump_load_commands
or options.dump_symtab
or options.dump_sections
or options.find_mangled
or options.section_names
):
options.dump_header = True
options.dump_load_commands = True
if options.verbose:
print("options", options)
print("mach_files", mach_files)
for path in mach_files:
mach = Mach()
mach.parse(path)
if options.interactive:
interpreter = Mach.Interactive(mach, options)
interpreter.cmdloop()
else:
mach.dump(options)
Codebase Browser
llvm