retdec
Public Member Functions | Protected Attributes | Private Attributes | List of all members
retdec::fileformat::MachOFormat Class Reference

#include <macho_format.h>

Inheritance diagram for retdec::fileformat::MachOFormat:
Inheritance graph
[legend]
Collaboration diagram for retdec::fileformat::MachOFormat:
Collaboration graph
[legend]

Public Member Functions

 MachOFormat (std::string pathToFile, LoadFlags loadFlags=LoadFlags::NONE)
 
 MachOFormat (std::istream &inputStream, LoadFlags loadFlags=LoadFlags::NONE)
 
 MachOFormat (const std::uint8_t *data, std::size_t size, LoadFlags loadFlags=LoadFlags::NONE)
 
Byte value storage methods
virtual retdec::utils::Endianness getEndianness () const override
 
virtual std::size_t getBytesPerWord () const override
 
virtual bool hasMixedEndianForDouble () const override
 
Virtual detection methods
virtual std::string getFileFormatName () const override
 
virtual bool areSectionsValid () const override
 
virtual bool isObjectFile () const override
 
virtual bool isDll () const override
 
virtual bool isExecutable () const override
 
virtual bool getMachineCode (unsigned long long &result) const override
 
virtual bool getAbiVersion (unsigned long long &result) const override
 
virtual bool getImageBaseAddress (unsigned long long &imageBase) const override
 
virtual bool getEpAddress (unsigned long long &result) const override
 
virtual bool getEpOffset (unsigned long long &epOffset) const override
 
virtual Architecture getTargetArchitecture () const override
 
virtual std::size_t getDeclaredNumberOfSections () const override
 
virtual std::size_t getDeclaredNumberOfSegments () const override
 
virtual std::size_t initSectionTableHashOffsets () override
 
virtual std::size_t getSectionTableOffset () const override
 
virtual std::size_t getSectionTableEntrySize () const override
 
virtual std::size_t getSegmentTableOffset () const override
 
virtual std::size_t getSegmentTableEntrySize () const override
 
Detection methods
bool is32Bit () const
 
bool isFatBinary () const
 
bool isStaticLibrary () const
 
bool getTargetOs (std::string &name, std::string &version) const
 
bool getEncryptionInfo (unsigned long &off, unsigned long &size, unsigned long &id)
 
std::uint32_t getFileType () const
 
std::uint32_t getSizeOfCommands () const
 
Universal binary architecture switching
bool chooseArchitecture (std::uint32_t cpuType)
 
bool chooseArchitectureAtIndex (std::uint32_t index)
 
std::uint32_t getChosenArchitectureOffset () const
 
- Public Member Functions inherited from retdec::fileformat::FileFormat
 FileFormat (const std::string &pathToFile, LoadFlags loadFlags=LoadFlags::NONE)
 
 FileFormat (std::istream &inputStream, LoadFlags loadFlags=LoadFlags::NONE)
 
 FileFormat (const std::uint8_t *data, std::size_t size, LoadFlags loadFlags=LoadFlags::NONE)
 
virtual ~FileFormat ()
 
const LoaderErrorInfogetLoaderErrorInfo () const
 
void initArchitecture (Architecture arch, retdec::utils::Endianness endian=retdec::utils::Endianness::UNKNOWN, std::size_t bytesPerWord=4, retdec::common::Address entryPoint=retdec::common::Address::Undefined, retdec::common::Address sectionVMA=retdec::common::Address::Undefined)
 
void loadStrings ()
 
void loadStrings (StringType type, std::size_t charSize)
 
void loadStrings (StringType type, std::size_t charSize, const SecSeg *secSeg)
 
void loadImpHash ()
 
void loadExpHash ()
 
void loadResourceIconHash ()
 
bool isInValidState () const
 
LoadFlags getLoadFlags () const
 
const SectiongetSectionFromOffset (unsigned long long offset) const
 
const SegmentgetSegmentFromOffset (unsigned long long offset) const
 
const SecSeggetSectionOrSegmentFromOffset (unsigned long long offset) const
 
bool haveSectionOrSegmentOnOffset (unsigned long long offset) const
 
bool haveDataOnOffset (unsigned long long offset) const
 
const SectiongetSectionFromAddress (unsigned long long address) const
 
const SegmentgetSegmentFromAddress (unsigned long long address) const
 
const SecSeggetSectionOrSegmentFromAddress (unsigned long long address) const
 
bool haveSectionOrSegmentOnAddress (unsigned long long address) const
 
bool haveDataOnAddress (unsigned long long address) const
 
bool haveReadOnlyDataOnAddress (unsigned long long address) const
 Test if there are some read-only data on provided address – address belongs to some read-only section or segment. More...
 
virtual std::size_t getNibbleLength () const override
 
virtual std::size_t getByteLength () const override
 
virtual std::size_t getWordLength () const override
 
virtual std::size_t getNumberOfNibblesInByte () const override
 
bool isX86 () const
 
bool isX86_64 () const
 
bool isX86OrX86_64 () const
 
bool isArm () const
 
bool isPowerPc () const
 
bool isMips () const
 
bool isUnknownArch () const
 
bool isPe () const
 
bool isElf () const
 
bool isCoff () const
 
bool isMacho () const
 
bool isIntelHex () const
 
bool isRawData () const
 
bool isUnknownFormat () const
 
bool isWindowsDriver () const
 
bool hasCrc32 () const
 
bool hasMd5 () const
 
bool hasSha256 () const
 
bool hasSectionTableCrc32 () const
 
bool hasSectionTableMd5 () const
 
bool hasSectionTableSha256 () const
 
std::string getCrc32 () const
 
std::string getMd5 () const
 
std::string getSha256 () const
 
std::string getSectionTableCrc32 () const
 
std::string getSectionTableMd5 () const
 
std::string getSectionTableSha256 () const
 
std::string getPathToFile () const
 
Format getFileFormat () const
 
std::size_t getNumberOfSections () const
 
std::size_t getNumberOfSegments () const
 
std::size_t getNumberOfSymbolTables () const
 
std::size_t getNumberOfRelocationTables () const
 
std::size_t getNumberOfDynamicTables () const
 
std::size_t getFileLength () const
 
std::size_t getLoadedFileLength () const
 
std::size_t getOverlaySize () const
 
bool getOverlayEntropy (double &res) const
 
std::size_t nibblesFromBytes (std::size_t bytes) const
 
std::size_t bytesFromNibbles (std::size_t nibbles) const
 
std::size_t bytesFromNibblesRounded (std::size_t nibbles) const
 
bool getOffsetFromAddress (unsigned long long &result, unsigned long long address) const
 
bool getAddressFromOffset (unsigned long long &result, unsigned long long offset) const
 
bool getBytes (std::vector< std::uint8_t > &result, unsigned long long offset, unsigned long long numberOfBytes) const
 
bool getEpBytes (std::vector< std::uint8_t > &result, unsigned long long numberOfBytes) const
 
bool getHexBytes (std::string &result, unsigned long long offset, unsigned long long numberOfBytes) const
 
bool getHexEpBytes (std::string &result, unsigned long long numberOfBytes) const
 
bool getHexBytesFromEnd (std::string &result, unsigned long long numberOfBytes) const
 
bool getString (std::string &result, unsigned long long offset, unsigned long long numberOfBytes) const
 
bool getStringFromEnd (std::string &result, unsigned long long numberOfBytes) const
 
bool isObjectStretchedOverSections (std::size_t addr, std::size_t size) const
 
const SectiongetEpSection ()
 
const SectiongetSection (const std::string &secName) const
 
const SectiongetSection (unsigned long long secIndex) const
 
const SectiongetLastSection () const
 
const SectiongetLastButOneSection () const
 
const SegmentgetEpSegment ()
 
const SegmentgetSegment (const std::string &segName) const
 
const SegmentgetSegment (unsigned long long segIndex) const
 
const SegmentgetLastSegment () const
 
const SegmentgetLastButOneSegment () const
 
const SymbolTablegetSymbolTable (unsigned long long tabIndex) const
 
const RelocationTablegetRelocationTable (unsigned long long tabIndex) const
 
const DynamicTablegetDynamicTable (unsigned long long tabIndex) const
 
const ImportTablegetImportTable () const
 
const ExportTablegetExportTable () const
 
const ResourceTablegetResourceTable () const
 
const ResourceTreegetResourceTree () const
 
const RichHeadergetRichHeader () const
 
const PdbInfogetPdbInfo () const
 
const CertificateTablegetCertificateTable () const
 
const TlsInfogetTlsInfo () const
 
const ElfCoreInfogetElfCoreInfo () const
 
const SymbolgetSymbol (const std::string &name) const
 
const SymbolgetSymbol (unsigned long long address) const
 
const RelocationgetRelocation (const std::string &name) const
 
const RelocationgetRelocation (unsigned long long address) const
 
const ImportgetImport (const std::string &name) const
 
const ImportgetImport (unsigned long long address) const
 
const ExportgetExport (const std::string &name) const
 
const ExportgetExport (unsigned long long address) const
 
const ResourcegetManifestResource () const
 
const ResourcegetVersionResource () const
 
bool isSignaturePresent () const
 
bool isSignatureVerified () const
 
const retdec::common::RangeContainer< std::uint64_t > & getNonDecodableAddressRanges () const
 
const std::vector< Section * > & getSections () const
 
const std::vector< Section * > getSections (std::initializer_list< std::string > secs) const
 
const std::vector< Segment * > & getSegments () const
 
const std::vector< Segment * > getSegments (std::initializer_list< std::string > segs) const
 
const std::vector< SymbolTable * > & getSymbolTables () const
 
const std::vector< RelocationTable * > & getRelocationTables () const
 
const std::vector< DynamicTable * > & getDynamicTables () const
 
const std::vector< unsigned char > & getBytes () const
 
const std::vector< unsigned char > & getLoadedBytes () const
 
const unsigned char * getBytesData () const
 
const unsigned char * getLoadedBytesData () const
 
const std::vector< String > & getStrings () const
 
const std::vector< ElfNoteSecSeg > & getElfNoteSecSegs () const
 
const std::set< std::uint64_t > & getUnknownRelocations () const
 
const std::vector< std::pair< std::string, std::string > > & getAnomalies () const
 
virtual bool getXByte (std::uint64_t address, std::uint64_t x, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const override
 
virtual bool getXBytes (std::uint64_t address, std::uint64_t x, std::vector< std::uint8_t > &res) const override
 
virtual bool setXByte (std::uint64_t address, std::uint64_t x, std::uint64_t val, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) override
 
virtual bool setXBytes (std::uint64_t address, const std::vector< std::uint8_t > &val) override
 
bool isPointer (unsigned long long address, std::uint64_t *pointer=nullptr) const
 
bool get1ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get2ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get4ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get8ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get10ByteOffset (std::uint64_t offset, long double &res) const
 
bool getXByteOffset (std::uint64_t offset, std::uint64_t x, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool getXBytesOffset (std::uint64_t offset, std::uint64_t x, std::vector< std::uint8_t > &res) const
 
bool getWordOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool getNTBSOffset (std::uint64_t offset, std::string &res, std::size_t size=0) const
 
bool getNTWSOffset (std::uint64_t offset, std::size_t width, std::vector< std::uint64_t > &res) const
 
virtual std::size_t getDeclaredFileLength () const
 
void dump ()
 
void dump (std::string &dumpFile)
 
void dumpRegionsValidity ()
 
void dumpRegionsValidity (std::string &dumpStr)
 
void dumpResourceTree ()
 
void dumpResourceTree (std::string &dumpStr)
 
- Public Member Functions inherited from retdec::utils::ByteValueStorage
 ByteValueStorage ()=default
 
virtual ~ByteValueStorage ()=default
 
Endianness getInverseEndianness () const
 
bool isLittleEndian () const
 
bool isBigEndian () const
 
bool isUnknownEndian () const
 
bool hexToBig (std::string &str) const
 
bool hexToLittle (std::string &str) const
 
bool bitsToBig (std::string &str) const
 
bool bitsToLittle (std::string &str) const
 
bool bitsToBig (std::vector< unsigned char > &values) const
 
bool bitsToLittle (std::vector< unsigned char > &values) const
 
bool get1Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get2Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get4Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get8Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get10Byte (std::uint64_t address, long double &res) const
 
bool getWord (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool getFloat (std::uint64_t address, float &res) const
 
bool getDouble (std::uint64_t address, double &res) const
 
bool set1Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set2Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set4Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set8Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set10Byte (std::uint64_t address, long double val)
 
bool setWord (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool setFloat (std::uint64_t address, float val)
 
bool setDouble (std::uint64_t address, double val)
 
bool getXByteArray (std::uint64_t address, std::uint64_t x, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get1ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get2ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get4ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get8ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get10ByteArray (std::uint64_t address, std::vector< long double > &res, std::size_t size) const
 
bool getWordArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t, Endianness e=Endianness::UNKNOWN) const
 
bool getFloatArray (std::uint64_t address, std::vector< float > &res, std::size_t size) const
 
bool getDoubleArray (std::uint64_t address, std::vector< double > &res, std::size_t size) const
 
bool getNTBS (std::uint64_t address, std::string &res, std::size_t size=0) const
 
bool getNTWS (std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 
bool getNTWSNice (std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 

Protected Attributes

std::unique_ptr< llvm::object::MachOObjectFile > file
 parser of input file More...
 
std::unique_ptr< llvm::object::MachOUniversalBinary > fatFile
 parser of universal binary More...
 
- Protected Attributes inherited from retdec::fileformat::FileFormat
std::string crc32
 CRC32 of file content. More...
 
std::string md5
 MD5 of file content. More...
 
std::string sha256
 SHA256 of file content. More...
 
std::string sectionCrc32
 CRC32 of section table. More...
 
std::string sectionMd5
 MD5 of section table. More...
 
std::string sectionSha256
 SHA256 of section table. More...
 
std::string filePath
 name of input file More...
 
std::istream & fileStream
 stream representation of input file More...
 
std::vector< Section * > sections
 file sections More...
 
std::vector< Segment * > segments
 file segments More...
 
std::vector< SymbolTable * > symbolTables
 symbol tables More...
 
std::vector< RelocationTable * > relocationTables
 relocation tables More...
 
std::vector< DynamicTable * > dynamicTables
 tables with dynamic records More...
 
std::vector< unsigned char > bytes
 content of file as bytes More...
 
std::vector< Stringstrings
 detected strings More...
 
std::vector< ElfNoteSecSegnoteSecSegs
 note sections or segemnts found in ELF file More...
 
std::set< std::uint64_t > unknownRelocs
 unknown relocations More...
 
ImportTableimportTable
 table of imports More...
 
ExportTableexportTable
 table of exports More...
 
ResourceTableresourceTable
 table of resources More...
 
ResourceTreeresourceTree
 structure of resource tree More...
 
RichHeaderrichHeader
 rich header More...
 
PdbInfopdbInfo
 information about related PDB debug file More...
 
CertificateTablecertificateTable
 table of certificates More...
 
TlsInfotlsInfo
 thread-local information More...
 
ElfCoreInfoelfCoreInfo
 information about core file structures More...
 
Format fileFormat
 format of input file More...
 
LoaderErrorInfo _ldrErrInfo
 loader error (e.g. Windows loader error for PE files) More...
 
bool stateIsValid
 internal state of instance More...
 
std::vector< std::pair< std::size_t, std::size_t > > secHashInfo
 information for calculation of section table hash More...
 
std::optional< bool > signatureVerified
 indicates whether the signature is present and also verified More...
 
retdec::common::RangeContainer< std::uint64_t > nonDecodableRanges
 Address ranges which should not be decoded for instructions. More...
 
std::vector< std::pair< std::string, std::string > > anomalies
 file format anomalies More...
 

Private Member Functions

Auxiliary initialization methods
void setWidthAndEndianness ()
 
bool chooseArchitecture (const llvm::object::MachOUniversalBinary::object_iterator &itr)
 
bool constructMachO ()
 
bool constructFatMachO ()
 
Initialization methods
void initStructures ()
 
Sections and segments commands methods
std::string getSecSegName (const char *secSegName) const
 
SecSeg::Type getSegmentType (const char *segName) const
 
SecSeg::Type getSectionType (std::uint32_t flags, const std::string &name) const
 
std::vector< std::uint8_t > createRelocationMask (unsigned length) const
 
void handleScatteredRelocation (std::uint32_t firstDword, RelocationTable *tabPtr)
 
void handleRelocation (std::uint32_t firstDword, std::uint32_t secondDword, RelocationTable *tabPtr)
 
void loadSectionRelocations (std::size_t offset, std::size_t count)
 
template<typename T >
void loadSection (const T &section)
 
template<typename T >
SegmentloadSegment (const T &segment)
 
void segmentCommand (const llvm::object::MachOObjectFile::LoadCommandInfo &commandInfo)
 
void segment64Command (const llvm::object::MachOObjectFile::LoadCommandInfo &commandInfo)
 
Entry point commands methods
void entryPointCommand (const llvm::object::MachOObjectFile::LoadCommandInfo &commandInfo)
 
void oldEntryPointCommand (const llvm::object::MachOObjectFile::LoadCommandInfo &commandInfo)
 
Symbols & Imports & Exports commands methods
void loadDylibCommand (const llvm::object::MachOObjectFile::LoadCommandInfo &commandInfo)
 
void symtabCommand ()
 
MachOSectiongetLazySymbolsSection () const
 
MachOSectiongetNonLazySymbolsSection () const
 
void getImportsFromSection (const MachOSection *secPtr)
 
void parseIndirectTable (std::uint32_t offset, std::uint32_t size)
 
void dySymtabCommand ()
 
void dyldInfoCommand (const llvm::object::MachOObjectFile::LoadCommandInfo &commandInfo)
 
std::unique_ptr< ImportgetImportFromBindEntry (const llvm::object::MachOBindEntry &input)
 
Load commands methods
std::uint32_t getNumberOfCommands () const
 
std::uint32_t getFirstCommandOffset () const
 
void loadCommands ()
 
void dumpCommands (std::ostream &outStream)
 
Auxiliary methods
unsigned long long get32Bit (const char *ptr) const
 
unsigned long long get64Bit (const char *ptr) const
 
unsigned long long offsetToAddress (unsigned long long offset) const
 
Architecture getTargetArchitecture (std::uint32_t cpuType) const
 
std::vector< std::string > getMachOUniversalArchitectures () const
 
const char * getBufferStart () const
 
const char * getBufferEnd () const
 
void clearCommands ()
 

Private Attributes

bool isLittle = true
 true if file is little endian More...
 
bool is32 = true
 true if address size is 32 bits More...
 
bool isFat = false
 true if file is universal binary More...
 
bool isDyld = false
 true if file has LC_DYLD_INFO command More...
 
bool isStaticLib = false
 true if file static library signature is detected More...
 
bool hasEntryPoint = false
 true if file has LC_MAIN or LC_UNIXTHREAD command More...
 
unsigned long long entryPointAddr = 0
 entry point address More...
 
unsigned long long entryPointOffset = 0
 entry point offset More...
 
std::uint32_t chosenArchOffset = 0
 offset of chosen architecture from universal binary More...
 
std::uint32_t chosenArchSize = 0
 size of chosen architecture from universal binary More...
 
std::vector< std::uint8_t > chosenArchBytes
 bytes of chosen architecture from universal binary More...
 
std::size_t sectionCounter = 0
 number of segment commands found More...
 
std::size_t segmentCounter = 0
 number of section commands found More...
 
std::vector< MachOSymbolsymbols
 temporary symbol representation More...
 
std::vector< unsigned long long > indirectTable
 indirect table for import addresses More...
 
llvm::MachO::mach_header header32
 32 bit Mach-O header More...
 
llvm::MachO::mach_header_64 header64
 64 bit Mach-O header More...
 
llvm::ErrorOr< std::unique_ptr< llvm::MemoryBuffer > > fileBuffer
 LLVM buffer of input file. More...
 

Additional Inherited Members

- Protected Types inherited from retdec::utils::ByteValueStorage
using GetNByteFn = std::function< bool(std::uint64_t, std::uint64_t &, Endianness)>
 
using GetXByteFn = std::function< bool(std::uint64_t, std::uint64_t, std::uint64_t &, Endianness)>
 
- Protected Member Functions inherited from retdec::fileformat::FileFormat
void clear ()
 
void computeSectionTableHashes ()
 
void setLoadedBytes (std::vector< unsigned char > *lBytes)
 
- Protected Member Functions inherited from retdec::utils::ByteValueStorage
bool createValueFromBytes (const std::vector< std::uint8_t > &data, std::uint64_t &value, Endianness endian, std::uint64_t offset=0, std::uint64_t size=0) const
 
bool createBytesFromValue (std::uint64_t data, std::uint64_t x, std::vector< std::uint8_t > &value, Endianness endian) const
 
bool get10ByteImpl (const std::vector< std::uint8_t > &data, long double &res) const
 
bool getFloatImpl (const std::vector< std::uint8_t > &data, float &res) const
 
bool getDoubleImpl (const std::vector< std::uint8_t > &data, double &res) const
 
bool getNTBSImpl (const GetNByteFn &get1ByteFn, std::uint64_t address, std::string &res, std::size_t size) const
 
bool getNTWSImpl (const GetXByteFn &getXByteFn, std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 
bool getNTWSNiceImpl (const GetXByteFn &getXByteFn, std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 

Detailed Description

MachOFormat - wrapper for parsing MachO files

Constructor & Destructor Documentation

◆ MachOFormat() [1/3]

retdec::fileformat::MachOFormat::MachOFormat ( std::string  pathToFile,
LoadFlags  loadFlags = LoadFlags::NONE 
)

Constructor

Parameters
pathToFilePath to input file
loadFlagsLoad flags

◆ MachOFormat() [2/3]

retdec::fileformat::MachOFormat::MachOFormat ( std::istream &  inputStream,
LoadFlags  loadFlags = LoadFlags::NONE 
)

Constructor

Parameters
inputStreamRepresentation of input file
loadFlagsLoad flags

◆ MachOFormat() [3/3]

retdec::fileformat::MachOFormat::MachOFormat ( const std::uint8_t *  data,
std::size_t  size,
LoadFlags  loadFlags = LoadFlags::NONE 
)

Constructor

Parameters
dataInput data.
sizeInput data size.
loadFlagsLoad flags

Member Function Documentation

◆ areSectionsValid()

bool retdec::fileformat::MachOFormat::areSectionsValid ( ) const
overridevirtual

Determine if loaded sections are OK to use for decompilation purposes. We want at least one valid section which may hold code.

Returns
true if sections are to be used, false otherwise (use segments).

Reimplemented from retdec::fileformat::FileFormat.

◆ chooseArchitecture() [1/2]

bool retdec::fileformat::MachOFormat::chooseArchitecture ( const llvm::object::MachOUniversalBinary::object_iterator &  itr)
private

Choose architecture from universal binary

Parameters
itrIterator of selected architecture
Returns
true if selected architecture is available, false otherwise

◆ chooseArchitecture() [2/2]

bool retdec::fileformat::MachOFormat::chooseArchitecture ( std::uint32_t  cpuType)

Choose architecture from universal binary

Parameters
cpuTypeType of selected architecture
Returns
true if selected architecture is available, false otherwise

◆ chooseArchitectureAtIndex()

bool retdec::fileformat::MachOFormat::chooseArchitectureAtIndex ( std::uint32_t  index)

Choose architecture from universal binary at specified index

Parameters
indexIndex of the selected architecture
Returns
true if selected architecture is available, false otherwise

◆ clearCommands()

void retdec::fileformat::MachOFormat::clearCommands ( )
private

Clear all loaded commands

◆ constructFatMachO()

bool retdec::fileformat::MachOFormat::constructFatMachO ( )
private

Create instance of MachOUniversalBinary and MachOObjectFile

Returns
true on success, false otherwise
Todo:
strange order of prefered architectures - ppc64 before x64??

◆ constructMachO()

bool retdec::fileformat::MachOFormat::constructMachO ( )
private

Create instance of MachOObjectFile

Returns
true on success, false otherwise

◆ createRelocationMask()

std::vector< std::uint8_t > retdec::fileformat::MachOFormat::createRelocationMask ( unsigned  length) const
private

Create relocation mask according to Mach-O specific length information

Parameters
lengthLength information as stored in relocation_info structure
Returns
Relocation mask

◆ dumpCommands()

void retdec::fileformat::MachOFormat::dumpCommands ( std::ostream &  outStream)
private

◆ dyldInfoCommand()

void retdec::fileformat::MachOFormat::dyldInfoCommand ( const llvm::object::MachOObjectFile::LoadCommandInfo &  commandInfo)
private

Load exports and imports from LC_DYLD_INFO (Mac OS 10.6+)

◆ dySymtabCommand()

void retdec::fileformat::MachOFormat::dySymtabCommand ( )
private

Load exports and imports from LC_DYSYMTAB

◆ entryPointCommand()

void retdec::fileformat::MachOFormat::entryPointCommand ( const llvm::object::MachOObjectFile::LoadCommandInfo &  commandInfo)
private

Set entry point address and its file offset (LC_MAIN Mac OS 10.8+)

Parameters
commandInfoLoadCommandInfo reference

◆ get32Bit()

unsigned long long retdec::fileformat::MachOFormat::get32Bit ( const char *  ptr) const
private

Interpret 32 bits of memory

Parameters
ptrPointer to memory
Returns
Interpreted value

◆ get64Bit()

unsigned long long retdec::fileformat::MachOFormat::get64Bit ( const char *  ptr) const
private

Interpret 64 bits of memory

Parameters
ptrPointer to memory
Returns
Interpreted value

◆ getAbiVersion()

bool retdec::fileformat::MachOFormat::getAbiVersion ( unsigned long long &  result) const
overridevirtual

Get file format-dependent version of used ABI

Parameters
resultParameter for store the result
Returns
true if method went OK, false otherwise

Implements retdec::fileformat::FileFormat.

◆ getBufferEnd()

const char * retdec::fileformat::MachOFormat::getBufferEnd ( ) const
private

Get pointer to the end of LLVM buffer with file content.

Returns
Pointer to buffer

◆ getBufferStart()

const char * retdec::fileformat::MachOFormat::getBufferStart ( ) const
private

Get pointer to LLVM buffer with file content.

Returns
Pointer to buffer

◆ getBytesPerWord()

std::size_t retdec::fileformat::MachOFormat::getBytesPerWord ( ) const
overridevirtual

◆ getChosenArchitectureOffset()

std::uint32_t retdec::fileformat::MachOFormat::getChosenArchitectureOffset ( ) const

Get offset of the chosen architecture

Returns
Offset of the architecture

◆ getDeclaredNumberOfSections()

std::size_t retdec::fileformat::MachOFormat::getDeclaredNumberOfSections ( ) const
overridevirtual

Get declared number of sections. This number may be different than real number of sections in file

Returns
Declared number of sections

Implements retdec::fileformat::FileFormat.

◆ getDeclaredNumberOfSegments()

std::size_t retdec::fileformat::MachOFormat::getDeclaredNumberOfSegments ( ) const
overridevirtual

Get declared number of segments. This number may be different than real number of segments in file

Returns
Declared number of segments

Implements retdec::fileformat::FileFormat.

◆ getEncryptionInfo()

bool retdec::fileformat::MachOFormat::getEncryptionInfo ( unsigned long &  off,
unsigned long &  size,
unsigned long &  id 
)

Get information about used encryption

Parameters
offEncrypted information file offset
sizeEncrypted infromation file size
idEncryption algorithm used
Returns
true if encryption was used, false otherwise

◆ getEndianness()

retdec::utils::Endianness retdec::fileformat::MachOFormat::getEndianness ( ) const
overridevirtual

◆ getEpAddress()

bool retdec::fileformat::MachOFormat::getEpAddress ( unsigned long long &  result) const
overridevirtual

Get virtual address of entry point

Parameters
resultParameter for store the result
Returns
true if file has entry point and entry point address is successfully detected, false otherwise

If file has no associated entry point, result is left unchanged.

If file has entry point but detection of entry point address is failed, instance method isInValidState() returns false after its invocation.

Implements retdec::fileformat::FileFormat.

◆ getEpOffset()

bool retdec::fileformat::MachOFormat::getEpOffset ( unsigned long long &  epOffset) const
overridevirtual

Get offset of entry point

Parameters
epOffsetInto this parameter the resulting number is stored
Returns
true if file has entry point and entry point offset is successfully detected, false otherwise

If file has no associated entry point, epOffset is left unchanged.

If file has entry point but detection of entry point offset is failed, instance method isInValidState() returns false after its invocation.

Implements retdec::fileformat::FileFormat.

◆ getFileFormatName()

std::string retdec::fileformat::MachOFormat::getFileFormatName ( ) const
overridevirtual

Get name of file format as string

Returns
Name of file format in which is input file

Reimplemented from retdec::fileformat::FileFormat.

◆ getFileType()

std::uint32_t retdec::fileformat::MachOFormat::getFileType ( ) const

Get format specific file type

Returns
File type

◆ getFirstCommandOffset()

std::uint32_t retdec::fileformat::MachOFormat::getFirstCommandOffset ( ) const
private

Get file offset of first load command

Returns
First command file offset

◆ getImageBaseAddress()

bool retdec::fileformat::MachOFormat::getImageBaseAddress ( unsigned long long &  imageBase) const
overridevirtual

Get image base address of file

Parameters
imageBaseInto this parameter the resulting number is stored
Returns
true if file has image base address and this address was successfully detected, false otherwise

If file has no image base, imageBase is left unchanged

Implements retdec::fileformat::FileFormat.

◆ getImportFromBindEntry()

std::unique_ptr< Import > retdec::fileformat::MachOFormat::getImportFromBindEntry ( const llvm::object::MachOBindEntry &  input)
private

Convert MachOBindEntry to import

Parameters
inputSource entry
Returns
Import

Segments have to be loaded before calling this function

◆ getImportsFromSection()

void retdec::fileformat::MachOFormat::getImportsFromSection ( const MachOSection secPtr)
private

Get all imports from symbol section

Parameters
secPtrSection pointer

importTable and indirectTable have to be available

◆ getLazySymbolsSection()

MachOSection * retdec::fileformat::MachOFormat::getLazySymbolsSection ( ) const
private

Get section with lazy symbols

Returns
__la_symbol_ptrs section pointer

◆ getMachineCode()

bool retdec::fileformat::MachOFormat::getMachineCode ( unsigned long long &  result) const
overridevirtual

Get file format-dependent number representing code of target architecture of file

Parameters
resultParameter for store the result
Returns
true if method went OK, false otherwise

Implements retdec::fileformat::FileFormat.

◆ getMachOUniversalArchitectures()

std::vector< std::string > retdec::fileformat::MachOFormat::getMachOUniversalArchitectures ( ) const
private

◆ getNonLazySymbolsSection()

MachOSection * retdec::fileformat::MachOFormat::getNonLazySymbolsSection ( ) const
private

Get section with non-lazy symbols

Returns
__nl_symbol_ptrs section pointer

◆ getNumberOfCommands()

std::uint32_t retdec::fileformat::MachOFormat::getNumberOfCommands ( ) const
private

Get number of load commands

Returns
Number of load commands

◆ getSecSegName()

std::string retdec::fileformat::MachOFormat::getSecSegName ( const char *  secSegName) const
private

Get section or segment name

Parameters
secSegName16 byte long array with section or segment name
Returns
Name of the section or segment

◆ getSectionTableEntrySize()

std::size_t retdec::fileformat::MachOFormat::getSectionTableEntrySize ( ) const
overridevirtual
Todo:
Implement

Implements retdec::fileformat::FileFormat.

◆ getSectionTableOffset()

std::size_t retdec::fileformat::MachOFormat::getSectionTableOffset ( ) const
overridevirtual
Todo:
Implement

Implements retdec::fileformat::FileFormat.

◆ getSectionType()

SecSeg::Type retdec::fileformat::MachOFormat::getSectionType ( std::uint32_t  flags,
const std::string &  name 
) const
private

Get section type

Parameters
flagsSection flags
nameSection name
Returns
Section type

This is my best guess based on very little information provided by Apple docs, especially the switch part

◆ getSegmentTableEntrySize()

std::size_t retdec::fileformat::MachOFormat::getSegmentTableEntrySize ( ) const
overridevirtual
Todo:
Implement

Implements retdec::fileformat::FileFormat.

◆ getSegmentTableOffset()

std::size_t retdec::fileformat::MachOFormat::getSegmentTableOffset ( ) const
overridevirtual
Todo:
Implement

Implements retdec::fileformat::FileFormat.

◆ getSegmentType()

SecSeg::Type retdec::fileformat::MachOFormat::getSegmentType ( const char *  segName) const
private

Get segment type

Parameters
segNameName of segment
Returns
Segment type

There is no information about type of segment in Mach-O, this is just best guess based on names used by Apple's standard tools

◆ getSizeOfCommands()

std::uint32_t retdec::fileformat::MachOFormat::getSizeOfCommands ( ) const

Get size of all load commands

Returns
Size of commands

◆ getTargetArchitecture() [1/2]

Architecture retdec::fileformat::MachOFormat::getTargetArchitecture ( ) const
overridevirtual

Get target architecture

Returns
Target architecture of input file
Return values
Architecture::UNKNOWNArchitecture is unknown

Implements retdec::fileformat::FileFormat.

◆ getTargetArchitecture() [2/2]

Architecture retdec::fileformat::MachOFormat::getTargetArchitecture ( std::uint32_t  cpuType) const
private

Get target architecture

Parameters
cpuTypeMach-O specific CPU type field
Returns
Target architecture

◆ getTargetOs()

bool retdec::fileformat::MachOFormat::getTargetOs ( std::string &  name,
std::string &  version 
) const

Returns binary target OS

Parameters
nameString describing OS name
versionString describing OS version
Returns
true if OS is detectable, false otherwise

◆ handleRelocation()

void retdec::fileformat::MachOFormat::handleRelocation ( std::uint32_t  firstDword,
std::uint32_t  secondDword,
RelocationTable tabPtr 
)
private

Handle one Mach-O relocation data structure

Function assumes that it is only called during section structure processing as it uses sectionCounter for setting valid relocation section links

Parameters
firstDwordFirst DWORD of relocation_info struct
secondDwordSecond DWORD of relocation_info struct
tabPtrPointer to relocation table (destination)

◆ handleScatteredRelocation()

void retdec::fileformat::MachOFormat::handleScatteredRelocation ( std::uint32_t  firstDword,
RelocationTable tabPtr 
)
private

Handle one Mach-O scattered relocation data structure

Function assumes that it is only called during section structure processing as it uses sectionCounter for setting valid relocation section links

Parameters
firstDwordFirst DWORD of relocation_info struct
tabPtrPointer to relocation table (destination)

◆ hasMixedEndianForDouble()

bool retdec::fileformat::MachOFormat::hasMixedEndianForDouble ( ) const
overridevirtual

◆ initSectionTableHashOffsets()

std::size_t retdec::fileformat::MachOFormat::initSectionTableHashOffsets ( )
overridevirtual
Todo:
Implement

Implements retdec::fileformat::FileFormat.

◆ initStructures()

void retdec::fileformat::MachOFormat::initStructures ( )
private

Init internal structures

◆ is32Bit()

bool retdec::fileformat::MachOFormat::is32Bit ( ) const

Bit-width detection method

Returns
true if architecture is 32-bit, false otherwise

◆ isDll()

bool retdec::fileformat::MachOFormat::isDll ( ) const
overridevirtual
Returns
true if file id dynamic linked library, false otherwise

Implements retdec::fileformat::FileFormat.

◆ isExecutable()

bool retdec::fileformat::MachOFormat::isExecutable ( ) const
overridevirtual
Returns
true if input file is executable file, false otherwise

Implements retdec::fileformat::FileFormat.

◆ isFatBinary()

bool retdec::fileformat::MachOFormat::isFatBinary ( ) const

Fat binary detection method

Returns
true if binary is universal, false otherwise

◆ isObjectFile()

bool retdec::fileformat::MachOFormat::isObjectFile ( ) const
overridevirtual
Returns
true if file is object file, false otherwise

Implements retdec::fileformat::FileFormat.

◆ isStaticLibrary()

bool retdec::fileformat::MachOFormat::isStaticLibrary ( ) const

Static library detection

Returns
true if file contains static signatures, false otherwise

◆ loadCommands()

void retdec::fileformat::MachOFormat::loadCommands ( )
private

Functions iterates over Mach-O load commands and loads useful information from supported commands

◆ loadDylibCommand()

void retdec::fileformat::MachOFormat::loadDylibCommand ( const llvm::object::MachOObjectFile::LoadCommandInfo &  commandInfo)
private

Handle LC_LOAD_DYLIB command

Parameters
commandInfoLoadCommandInfo reference

◆ loadSection()

template<typename T >
void retdec::fileformat::MachOFormat::loadSection ( const T &  section)
private

Load section

Parameters
section32/64-bit section structure reference

◆ loadSectionRelocations()

void retdec::fileformat::MachOFormat::loadSectionRelocations ( std::size_t  offset,
std::size_t  count 
)
private

Load relocations for specific section

Function assumes that it is only called during section structure processing as it uses sectionCounter for setting valid relocation section links

Parameters
offsetOffset of relocation table
countNumber of relocations

◆ loadSegment()

template<typename T >
Segment * retdec::fileformat::MachOFormat::loadSegment ( const T &  segment)
private

Load segment

Parameters
segment32/64-bit segment structure reference
Returns
Pointer to created segment

◆ offsetToAddress()

unsigned long long retdec::fileformat::MachOFormat::offsetToAddress ( unsigned long long  offset) const
private

Convert file offset to virtual address

Parameters
offsetOffset in file
Returns
Address in memory or zero when no address found

Segments have to be loaded before calling this function

◆ oldEntryPointCommand()

void retdec::fileformat::MachOFormat::oldEntryPointCommand ( const llvm::object::MachOObjectFile::LoadCommandInfo &  commandInfo)
private

Set entry point address and its file offset (LC_UNIXTHREAD before Mac OS 10.8)

Parameters
commandInfoLoadCommandInfo reference

◆ parseIndirectTable()

void retdec::fileformat::MachOFormat::parseIndirectTable ( std::uint32_t  offset,
std::uint32_t  size 
)
private

Parse indirect table

Parameters
offsetIndirect table file offset
sizeIndirect table size

◆ segment64Command()

void retdec::fileformat::MachOFormat::segment64Command ( const llvm::object::MachOObjectFile::LoadCommandInfo &  commandInfo)
private

Handle 64-bit segment command

Parameters
commandInfoLoadCommandInfo reference

◆ segmentCommand()

void retdec::fileformat::MachOFormat::segmentCommand ( const llvm::object::MachOObjectFile::LoadCommandInfo &  commandInfo)
private

Handle 32-bit segment command

Parameters
commandInfoLoadCommandInfo reference

◆ setWidthAndEndianness()

void retdec::fileformat::MachOFormat::setWidthAndEndianness ( )
private

As LLVM constructor needs information about bit-width and endianness we must read magic number before calling LLVM constructor

◆ symtabCommand()

void retdec::fileformat::MachOFormat::symtabCommand ( )
private

Load symbol table

Member Data Documentation

◆ chosenArchBytes

std::vector<std::uint8_t> retdec::fileformat::MachOFormat::chosenArchBytes
private

bytes of chosen architecture from universal binary

◆ chosenArchOffset

std::uint32_t retdec::fileformat::MachOFormat::chosenArchOffset = 0
private

offset of chosen architecture from universal binary

◆ chosenArchSize

std::uint32_t retdec::fileformat::MachOFormat::chosenArchSize = 0
private

size of chosen architecture from universal binary

◆ entryPointAddr

unsigned long long retdec::fileformat::MachOFormat::entryPointAddr = 0
private

entry point address

◆ entryPointOffset

unsigned long long retdec::fileformat::MachOFormat::entryPointOffset = 0
private

entry point offset

◆ fatFile

std::unique_ptr<llvm::object::MachOUniversalBinary> retdec::fileformat::MachOFormat::fatFile
protected

parser of universal binary

◆ file

std::unique_ptr<llvm::object::MachOObjectFile> retdec::fileformat::MachOFormat::file
protected

parser of input file

◆ fileBuffer

llvm::ErrorOr<std::unique_ptr<llvm::MemoryBuffer> > retdec::fileformat::MachOFormat::fileBuffer
private

LLVM buffer of input file.

◆ hasEntryPoint

bool retdec::fileformat::MachOFormat::hasEntryPoint = false
private

true if file has LC_MAIN or LC_UNIXTHREAD command

◆ header32

llvm::MachO::mach_header retdec::fileformat::MachOFormat::header32
private

32 bit Mach-O header

◆ header64

llvm::MachO::mach_header_64 retdec::fileformat::MachOFormat::header64
private

64 bit Mach-O header

◆ indirectTable

std::vector<unsigned long long> retdec::fileformat::MachOFormat::indirectTable
private

indirect table for import addresses

◆ is32

bool retdec::fileformat::MachOFormat::is32 = true
private

true if address size is 32 bits

◆ isDyld

bool retdec::fileformat::MachOFormat::isDyld = false
private

true if file has LC_DYLD_INFO command

◆ isFat

bool retdec::fileformat::MachOFormat::isFat = false
private

true if file is universal binary

◆ isLittle

bool retdec::fileformat::MachOFormat::isLittle = true
private

true if file is little endian

◆ isStaticLib

bool retdec::fileformat::MachOFormat::isStaticLib = false
private

true if file static library signature is detected

◆ sectionCounter

std::size_t retdec::fileformat::MachOFormat::sectionCounter = 0
private

number of segment commands found

◆ segmentCounter

std::size_t retdec::fileformat::MachOFormat::segmentCounter = 0
private

number of section commands found

◆ symbols

std::vector<MachOSymbol> retdec::fileformat::MachOFormat::symbols
private

temporary symbol representation


The documentation for this class was generated from the following files: