retdec
|
#include <macho_wrapper.h>
Public Member Functions | |
MachOWrapper (std::string pathToFile, retdec::fileformat::LoadFlags loadFlags) | |
Detection methods | |
{ | |
const llvm::object::MachOObjectFile * | getMachOParser () const |
std::string | getTypeOfFile () const |
![]() | |
MachOFormat (std::string pathToFile, LoadFlags loadFlags=LoadFlags::NONE) | |
MachOFormat (std::istream &inputStream, LoadFlags loadFlags=LoadFlags::NONE) | |
MachOFormat (const std::uint8_t *data, std::size_t size, LoadFlags loadFlags=LoadFlags::NONE) | |
virtual retdec::utils::Endianness | getEndianness () const override |
virtual std::size_t | getBytesPerWord () const override |
virtual bool | hasMixedEndianForDouble () const override |
virtual std::string | getFileFormatName () const override |
virtual bool | areSectionsValid () const override |
virtual bool | isObjectFile () const override |
virtual bool | isDll () const override |
virtual bool | isExecutable () const override |
virtual bool | getMachineCode (unsigned long long &result) const override |
virtual bool | getAbiVersion (unsigned long long &result) const override |
virtual bool | getImageBaseAddress (unsigned long long &imageBase) const override |
virtual bool | getEpAddress (unsigned long long &result) const override |
virtual bool | getEpOffset (unsigned long long &epOffset) const override |
virtual Architecture | getTargetArchitecture () const override |
virtual std::size_t | getDeclaredNumberOfSections () const override |
virtual std::size_t | getDeclaredNumberOfSegments () const override |
virtual std::size_t | initSectionTableHashOffsets () override |
virtual std::size_t | getSectionTableOffset () const override |
virtual std::size_t | getSectionTableEntrySize () const override |
virtual std::size_t | getSegmentTableOffset () const override |
virtual std::size_t | getSegmentTableEntrySize () const override |
bool | is32Bit () const |
bool | isFatBinary () const |
bool | isStaticLibrary () const |
bool | getTargetOs (std::string &name, std::string &version) const |
bool | getEncryptionInfo (unsigned long &off, unsigned long &size, unsigned long &id) |
std::uint32_t | getFileType () const |
std::uint32_t | getSizeOfCommands () const |
bool | chooseArchitecture (std::uint32_t cpuType) |
bool | chooseArchitectureAtIndex (std::uint32_t index) |
std::uint32_t | getChosenArchitectureOffset () const |
![]() | |
FileFormat (const std::string &pathToFile, LoadFlags loadFlags=LoadFlags::NONE) | |
FileFormat (std::istream &inputStream, LoadFlags loadFlags=LoadFlags::NONE) | |
FileFormat (const std::uint8_t *data, std::size_t size, LoadFlags loadFlags=LoadFlags::NONE) | |
virtual | ~FileFormat () |
const LoaderErrorInfo & | getLoaderErrorInfo () const |
void | initArchitecture (Architecture arch, retdec::utils::Endianness endian=retdec::utils::Endianness::UNKNOWN, std::size_t bytesPerWord=4, retdec::common::Address entryPoint=retdec::common::Address::Undefined, retdec::common::Address sectionVMA=retdec::common::Address::Undefined) |
void | loadStrings () |
void | loadStrings (StringType type, std::size_t charSize) |
void | loadStrings (StringType type, std::size_t charSize, const SecSeg *secSeg) |
void | loadImpHash () |
void | loadExpHash () |
void | loadResourceIconHash () |
bool | isInValidState () const |
LoadFlags | getLoadFlags () const |
const Section * | getSectionFromOffset (unsigned long long offset) const |
const Segment * | getSegmentFromOffset (unsigned long long offset) const |
const SecSeg * | getSectionOrSegmentFromOffset (unsigned long long offset) const |
bool | haveSectionOrSegmentOnOffset (unsigned long long offset) const |
bool | haveDataOnOffset (unsigned long long offset) const |
const Section * | getSectionFromAddress (unsigned long long address) const |
const Segment * | getSegmentFromAddress (unsigned long long address) const |
const SecSeg * | getSectionOrSegmentFromAddress (unsigned long long address) const |
bool | haveSectionOrSegmentOnAddress (unsigned long long address) const |
bool | haveDataOnAddress (unsigned long long address) const |
bool | haveReadOnlyDataOnAddress (unsigned long long address) const |
Test if there are some read-only data on provided address – address belongs to some read-only section or segment. More... | |
virtual std::size_t | getNibbleLength () const override |
virtual std::size_t | getByteLength () const override |
virtual std::size_t | getWordLength () const override |
virtual std::size_t | getNumberOfNibblesInByte () const override |
bool | isX86 () const |
bool | isX86_64 () const |
bool | isX86OrX86_64 () const |
bool | isArm () const |
bool | isPowerPc () const |
bool | isMips () const |
bool | isUnknownArch () const |
bool | isPe () const |
bool | isElf () const |
bool | isCoff () const |
bool | isMacho () const |
bool | isIntelHex () const |
bool | isRawData () const |
bool | isUnknownFormat () const |
bool | isWindowsDriver () const |
bool | hasCrc32 () const |
bool | hasMd5 () const |
bool | hasSha256 () const |
bool | hasSectionTableCrc32 () const |
bool | hasSectionTableMd5 () const |
bool | hasSectionTableSha256 () const |
std::string | getCrc32 () const |
std::string | getMd5 () const |
std::string | getSha256 () const |
std::string | getSectionTableCrc32 () const |
std::string | getSectionTableMd5 () const |
std::string | getSectionTableSha256 () const |
std::string | getPathToFile () const |
Format | getFileFormat () const |
std::size_t | getNumberOfSections () const |
std::size_t | getNumberOfSegments () const |
std::size_t | getNumberOfSymbolTables () const |
std::size_t | getNumberOfRelocationTables () const |
std::size_t | getNumberOfDynamicTables () const |
std::size_t | getFileLength () const |
std::size_t | getLoadedFileLength () const |
std::size_t | getOverlaySize () const |
bool | getOverlayEntropy (double &res) const |
std::size_t | nibblesFromBytes (std::size_t bytes) const |
std::size_t | bytesFromNibbles (std::size_t nibbles) const |
std::size_t | bytesFromNibblesRounded (std::size_t nibbles) const |
bool | getOffsetFromAddress (unsigned long long &result, unsigned long long address) const |
bool | getAddressFromOffset (unsigned long long &result, unsigned long long offset) const |
bool | getBytes (std::vector< std::uint8_t > &result, unsigned long long offset, unsigned long long numberOfBytes) const |
bool | getEpBytes (std::vector< std::uint8_t > &result, unsigned long long numberOfBytes) const |
bool | getHexBytes (std::string &result, unsigned long long offset, unsigned long long numberOfBytes) const |
bool | getHexEpBytes (std::string &result, unsigned long long numberOfBytes) const |
bool | getHexBytesFromEnd (std::string &result, unsigned long long numberOfBytes) const |
bool | getString (std::string &result, unsigned long long offset, unsigned long long numberOfBytes) const |
bool | getStringFromEnd (std::string &result, unsigned long long numberOfBytes) const |
bool | isObjectStretchedOverSections (std::size_t addr, std::size_t size) const |
const Section * | getEpSection () |
const Section * | getSection (const std::string &secName) const |
const Section * | getSection (unsigned long long secIndex) const |
const Section * | getLastSection () const |
const Section * | getLastButOneSection () const |
const Segment * | getEpSegment () |
const Segment * | getSegment (const std::string &segName) const |
const Segment * | getSegment (unsigned long long segIndex) const |
const Segment * | getLastSegment () const |
const Segment * | getLastButOneSegment () const |
const SymbolTable * | getSymbolTable (unsigned long long tabIndex) const |
const RelocationTable * | getRelocationTable (unsigned long long tabIndex) const |
const DynamicTable * | getDynamicTable (unsigned long long tabIndex) const |
const ImportTable * | getImportTable () const |
const ExportTable * | getExportTable () const |
const ResourceTable * | getResourceTable () const |
const ResourceTree * | getResourceTree () const |
const RichHeader * | getRichHeader () const |
const PdbInfo * | getPdbInfo () const |
const CertificateTable * | getCertificateTable () const |
const TlsInfo * | getTlsInfo () const |
const ElfCoreInfo * | getElfCoreInfo () const |
const Symbol * | getSymbol (const std::string &name) const |
const Symbol * | getSymbol (unsigned long long address) const |
const Relocation * | getRelocation (const std::string &name) const |
const Relocation * | getRelocation (unsigned long long address) const |
const Import * | getImport (const std::string &name) const |
const Import * | getImport (unsigned long long address) const |
const Export * | getExport (const std::string &name) const |
const Export * | getExport (unsigned long long address) const |
const Resource * | getManifestResource () const |
const Resource * | getVersionResource () const |
bool | isSignaturePresent () const |
bool | isSignatureVerified () const |
const retdec::common::RangeContainer< std::uint64_t > & | getNonDecodableAddressRanges () const |
const std::vector< Section * > & | getSections () const |
const std::vector< Section * > | getSections (std::initializer_list< std::string > secs) const |
const std::vector< Segment * > & | getSegments () const |
const std::vector< Segment * > | getSegments (std::initializer_list< std::string > segs) const |
const std::vector< SymbolTable * > & | getSymbolTables () const |
const std::vector< RelocationTable * > & | getRelocationTables () const |
const std::vector< DynamicTable * > & | getDynamicTables () const |
const std::vector< unsigned char > & | getBytes () const |
const std::vector< unsigned char > & | getLoadedBytes () const |
const unsigned char * | getBytesData () const |
const unsigned char * | getLoadedBytesData () const |
const std::vector< String > & | getStrings () const |
const std::vector< ElfNoteSecSeg > & | getElfNoteSecSegs () const |
const std::set< std::uint64_t > & | getUnknownRelocations () const |
const std::vector< std::pair< std::string, std::string > > & | getAnomalies () const |
virtual bool | getXByte (std::uint64_t address, std::uint64_t x, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const override |
virtual bool | getXBytes (std::uint64_t address, std::uint64_t x, std::vector< std::uint8_t > &res) const override |
virtual bool | setXByte (std::uint64_t address, std::uint64_t x, std::uint64_t val, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) override |
virtual bool | setXBytes (std::uint64_t address, const std::vector< std::uint8_t > &val) override |
bool | isPointer (unsigned long long address, std::uint64_t *pointer=nullptr) const |
bool | get1ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const |
bool | get2ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const |
bool | get4ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const |
bool | get8ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const |
bool | get10ByteOffset (std::uint64_t offset, long double &res) const |
bool | getXByteOffset (std::uint64_t offset, std::uint64_t x, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const |
bool | getXBytesOffset (std::uint64_t offset, std::uint64_t x, std::vector< std::uint8_t > &res) const |
bool | getWordOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const |
bool | getNTBSOffset (std::uint64_t offset, std::string &res, std::size_t size=0) const |
bool | getNTWSOffset (std::uint64_t offset, std::size_t width, std::vector< std::uint64_t > &res) const |
virtual std::size_t | getDeclaredFileLength () const |
void | dump () |
void | dump (std::string &dumpFile) |
void | dumpRegionsValidity () |
void | dumpRegionsValidity (std::string &dumpStr) |
void | dumpResourceTree () |
void | dumpResourceTree (std::string &dumpStr) |
![]() | |
ByteValueStorage ()=default | |
virtual | ~ByteValueStorage ()=default |
Endianness | getInverseEndianness () const |
bool | isLittleEndian () const |
bool | isBigEndian () const |
bool | isUnknownEndian () const |
bool | hexToBig (std::string &str) const |
bool | hexToLittle (std::string &str) const |
bool | bitsToBig (std::string &str) const |
bool | bitsToLittle (std::string &str) const |
bool | bitsToBig (std::vector< unsigned char > &values) const |
bool | bitsToLittle (std::vector< unsigned char > &values) const |
bool | get1Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const |
bool | get2Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const |
bool | get4Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const |
bool | get8Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const |
bool | get10Byte (std::uint64_t address, long double &res) const |
bool | getWord (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const |
bool | getFloat (std::uint64_t address, float &res) const |
bool | getDouble (std::uint64_t address, double &res) const |
bool | set1Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN) |
bool | set2Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN) |
bool | set4Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN) |
bool | set8Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN) |
bool | set10Byte (std::uint64_t address, long double val) |
bool | setWord (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN) |
bool | setFloat (std::uint64_t address, float val) |
bool | setDouble (std::uint64_t address, double val) |
bool | getXByteArray (std::uint64_t address, std::uint64_t x, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const |
bool | get1ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const |
bool | get2ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const |
bool | get4ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const |
bool | get8ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const |
bool | get10ByteArray (std::uint64_t address, std::vector< long double > &res, std::size_t size) const |
bool | getWordArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t, Endianness e=Endianness::UNKNOWN) const |
bool | getFloatArray (std::uint64_t address, std::vector< float > &res, std::size_t size) const |
bool | getDoubleArray (std::uint64_t address, std::vector< double > &res, std::size_t size) const |
bool | getNTBS (std::uint64_t address, std::string &res, std::size_t size=0) const |
bool | getNTWS (std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const |
bool | getNTWSNice (std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const |
Additional Inherited Members | |
![]() | |
using | GetNByteFn = std::function< bool(std::uint64_t, std::uint64_t &, Endianness)> |
using | GetXByteFn = std::function< bool(std::uint64_t, std::uint64_t, std::uint64_t &, Endianness)> |
![]() | |
void | clear () |
void | computeSectionTableHashes () |
void | setLoadedBytes (std::vector< unsigned char > *lBytes) |
![]() | |
bool | createValueFromBytes (const std::vector< std::uint8_t > &data, std::uint64_t &value, Endianness endian, std::uint64_t offset=0, std::uint64_t size=0) const |
bool | createBytesFromValue (std::uint64_t data, std::uint64_t x, std::vector< std::uint8_t > &value, Endianness endian) const |
bool | get10ByteImpl (const std::vector< std::uint8_t > &data, long double &res) const |
bool | getFloatImpl (const std::vector< std::uint8_t > &data, float &res) const |
bool | getDoubleImpl (const std::vector< std::uint8_t > &data, double &res) const |
bool | getNTBSImpl (const GetNByteFn &get1ByteFn, std::uint64_t address, std::string &res, std::size_t size) const |
bool | getNTWSImpl (const GetXByteFn &getXByteFn, std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const |
bool | getNTWSNiceImpl (const GetXByteFn &getXByteFn, std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const |
![]() | |
std::unique_ptr< llvm::object::MachOObjectFile > | file |
parser of input file More... | |
std::unique_ptr< llvm::object::MachOUniversalBinary > | fatFile |
parser of universal binary More... | |
![]() | |
std::string | crc32 |
CRC32 of file content. More... | |
std::string | md5 |
MD5 of file content. More... | |
std::string | sha256 |
SHA256 of file content. More... | |
std::string | sectionCrc32 |
CRC32 of section table. More... | |
std::string | sectionMd5 |
MD5 of section table. More... | |
std::string | sectionSha256 |
SHA256 of section table. More... | |
std::string | filePath |
name of input file More... | |
std::istream & | fileStream |
stream representation of input file More... | |
std::vector< Section * > | sections |
file sections More... | |
std::vector< Segment * > | segments |
file segments More... | |
std::vector< SymbolTable * > | symbolTables |
symbol tables More... | |
std::vector< RelocationTable * > | relocationTables |
relocation tables More... | |
std::vector< DynamicTable * > | dynamicTables |
tables with dynamic records More... | |
std::vector< unsigned char > | bytes |
content of file as bytes More... | |
std::vector< String > | strings |
detected strings More... | |
std::vector< ElfNoteSecSeg > | noteSecSegs |
note sections or segemnts found in ELF file More... | |
std::set< std::uint64_t > | unknownRelocs |
unknown relocations More... | |
ImportTable * | importTable |
table of imports More... | |
ExportTable * | exportTable |
table of exports More... | |
ResourceTable * | resourceTable |
table of resources More... | |
ResourceTree * | resourceTree |
structure of resource tree More... | |
RichHeader * | richHeader |
rich header More... | |
PdbInfo * | pdbInfo |
information about related PDB debug file More... | |
CertificateTable * | certificateTable |
table of certificates More... | |
TlsInfo * | tlsInfo |
thread-local information More... | |
ElfCoreInfo * | elfCoreInfo |
information about core file structures More... | |
Format | fileFormat |
format of input file More... | |
LoaderErrorInfo | _ldrErrInfo |
loader error (e.g. Windows loader error for PE files) More... | |
bool | stateIsValid |
internal state of instance More... | |
std::vector< std::pair< std::size_t, std::size_t > > | secHashInfo |
information for calculation of section table hash More... | |
std::optional< bool > | signatureVerified |
indicates whether the signature is present and also verified More... | |
retdec::common::RangeContainer< std::uint64_t > | nonDecodableRanges |
Address ranges which should not be decoded for instructions. More... | |
std::vector< std::pair< std::string, std::string > > | anomalies |
file format anomalies More... | |
Wrapper for parsing MachO files
retdec::fileinfo::MachOWrapper::MachOWrapper | ( | std::string | pathToFile, |
retdec::fileformat::LoadFlags | loadFlags | ||
) |
Constructor
pathToFile | Path to MachO binary file |
loadFlags | Load flags |
const llvm::object::MachOObjectFile * retdec::fileinfo::MachOWrapper::getMachOParser | ( | ) | const |
Get LLVM COFF parser
std::string retdec::fileinfo::MachOWrapper::getTypeOfFile | ( | ) | const |
Get type of binary file