MachO

Parsers

class Parser : public LIEF::Parser

Public Functions

Parser &operator=(const Parser &copy)
Parser(const Parser &copy)
~Parser(void)

Public Static Functions

std::unique_ptr<FatBinary> parse(const std::string &filename, const ParserConfig &conf = ParserConfig::deep())
std::unique_ptr<FatBinary> parse(const std::vector<uint8_t> &data, const std::string &name = "", const ParserConfig &conf = ParserConfig::deep())
class BinaryParser : public LIEF::Parser

Class used to parse single binary (i.e. not FAT)

See

MachO::Parser

Public Functions

BinaryParser(const std::string &file, const ParserConfig &conf = ParserConfig::deep())
BinaryParser(const std::vector<uint8_t> &data, uint64_t fat_offset = 0, const ParserConfig &conf = ParserConfig::deep())
BinaryParser(void)
BinaryParser &operator=(const BinaryParser &copy)
BinaryParser(const BinaryParser &copy)
~BinaryParser(void)
Binary *get_binary(void)

Friends

friend LIEF::MachO::BinaryParser::MachO::Parser
class ParserConfig

Public Functions

ParserConfig(void)
ParserConfig &operator=(const ParserConfig&)
ParserConfig(const ParserConfig&)
~ParserConfig(void)
ParserConfig &parse_dyldinfo_deeply(bool flag)

If flag is set to true, Exports, Bindings and Rebases opcodes are parsed.

Warning

Enabling this flag can slow down the parsing

bool parse_dyldinfo_deeply(void) const

Whether or not bindings, exports, and rebases are parsed.

Public Static Functions

ParserConfig deep(void)

Return a configuration so that the all objects supported by LIEF are parsed.

With this configuration:

  • parse_dyldinfo_deeply is set to true

ParserConfig quick(void)

Return a configuration so that the parsing is quick

With this configuration:

  • parse_dyldinfo_deeply is set to false


FatBinary

class FatBinary

Public Functions

FatBinary(const FatBinary&)
~FatBinary(void)
size_t size(void) const

Number of binary registred.

it_binaries begin(void)
it_const_binaries begin(void) const
it_binaries end(void)
it_const_binaries end(void) const
Binary *pop_back(void)
Binary &at(size_t index)
const Binary &at(size_t index) const
Binary &back(void)
const Binary &back(void) const
Binary &operator[](size_t index)
const Binary &operator[](size_t index) const
void write(const std::string &filename)

Reconstruct the Fat binary object and write it in filename

Parameters
  • filename: Path to write the reconstructed binary

std::vector<uint8_t> raw(void)

Reconstruct the Fat binary object and return his content as bytes.

Friends

friend LIEF::MachO::FatBinary::LIEF::Parser
std::ostream &operator<<(std::ostream &os, const FatBinary &fatbinary)

Binary

class Binary : public LIEF::Binary

Class which represent a MachO binary.

Public Types

using range_t = std::pair<uint64_t, uint64_t>

Public Functions

Binary(const Binary&)
Header &header(void)

Return a reference to MachO::Header.

const Header &header(void) const
it_commands commands(void)

Return binary’s load commands .

it_const_commands commands(void) const
it_symbols symbols(void)

Return binary’s symbols .

it_const_symbols symbols(void) const
bool has_symbol(const std::string &name) const

If a symbol with the given name exists.

const Symbol &get_symbol(const std::string &name) const

Return Symbol from the given name.

Symbol &get_symbol(const std::string &name)
it_exported_symbols exported_symbols(void)

Return binary’s exported symbols.

it_const_exported_symbols exported_symbols(void) const
it_imported_symbols imported_symbols(void)

Return binary’s imported symbols.

it_const_imported_symbols imported_symbols(void) const
it_libraries libraries(void)

Return binary imported libraries (MachO::DylibCommand)

it_const_libraries libraries(void) const
it_segments segments(void)

Return binary’s segments .

it_const_segments segments(void) const
it_sections sections(void)

Return binary’s sections .

it_const_sections sections(void) const
it_const_relocations relocations(void)

Return binary’s relocations .

it_const_relocations relocations(void) const
void write(const std::string &filename)

Reconstruct the binary object and write it in filename

Parameters
  • filename: Path to write the reconstructed binary

std::vector<uint8_t> raw(void)

Reconstruct the binary object and return his content as bytes.

bool has(LOAD_COMMAND_TYPES type) const

Check if the current binary has the given MachO::LOAD_COMMAND_TYPES.

const LoadCommand &get(LOAD_COMMAND_TYPES type) const
LoadCommand &get(LOAD_COMMAND_TYPES type)
LoadCommand &add(const LoadCommand &command)

Insert the new Load Command.

LoadCommand &add(const LoadCommand &command, size_t index)

Insert the new Load command at index

LoadCommand &add(const DylibCommand &library)

Insert the given DylibCommand.

LoadCommand &add(const SegmentCommand &segment)

Add a new LC_SEGMENT command.

LoadCommand &add_library(const std::string &name)

Insert a new shared library through a LC_LOAD_DYLIB command.

Section *add_section(const Section &section)

Add section in the __TEXT segment.

Section *add_section(const SegmentCommand &segment, const Section &section)

Add a section in the given MachO::SegmentCommand.

Warning

This method may corrupt the file if the segment is not the first one or the last one

void remove_section(const std::string &name, bool clear = false)
bool remove(const LoadCommand &command)

Remove the given command.

bool remove(LOAD_COMMAND_TYPES type)

Remove all Load Command with the given type (MachO::LOAD_COMMAND_TYPES)

bool remove_command(size_t index)

Remove the Load Command at index

bool remove_signature(void)

Remove the LC_SIGNATURE command.

bool extend(const LoadCommand &command, uint64_t size)

Extend the size of the Load command.

bool extend_segment(const SegmentCommand &segment, size_t size)

Extend the content of the Segment.

bool disable_pie(void)

Remove PIE flag.

uint64_t imagebase(void) const

Return binary’s imagebase. 0 if not relevant.

const std::string &loader(void) const

Return binary’s loader (e.g. /usr/lib/dyld)

bool has_section(const std::string &name) const

Check if a section with the given name exists.

Section &get_section(const std::string &name)

Return the section from the given name.

const Section &get_section(const std::string &name) const

Return the section from the given name.

bool has_segment(const std::string &name) const

Check if a segment with the given name exists.

const SegmentCommand *get_segment(const std::string &name) const

Return the segment from the given name.

SegmentCommand *get_segment(const std::string &name)
bool remove_symbol(const std::string &name)

Remove symbol with the given name.

bool remove(const Symbol &sym)

Remove the given symbol.

bool can_remove(const Symbol &sym) const

Check if the given symbol can be safely removed.

bool can_remove_symbol(const std::string &name) const
bool unexport(const std::string &name)

Remove the given symbol from the export table.

bool unexport(const Symbol &sym)

Remove the given symbol from the export table.

Section *section_from_offset(uint64_t offset)

Return binary’s section which holds the offset

const Section *section_from_offset(uint64_t offset) const
Section *section_from_virtual_address(uint64_t virtual_address)

Return binary’s section which holds the given virtual address

const Section *section_from_virtual_address(uint64_t virtual_address) const
uint64_t virtual_address_to_offset(uint64_t virtualAddress) const

Convert a virtual address to an offset in the file.

SegmentCommand *segment_from_offset(uint64_t offset)
const SegmentCommand *segment_from_offset(uint64_t offset) const
size_t segment_index(const SegmentCommand &segment) const

Return the index of the given segment;.

uint64_t fat_offset(void) const

Return binary’s fat offset. 0 if not relevant.

SegmentCommand *segment_from_virtual_address(uint64_t virtual_address)
const SegmentCommand *segment_from_virtual_address(uint64_t virtual_address) const
Binary::range_t va_ranges(void) const

Return the range of virtual addresses.

Binary::range_t off_ranges(void) const

Return the range of offsets.

bool is_valid_addr(uint64_t address) const

Check if the given address is comprise between the lowest virtual address and the biggest one

void accept(LIEF::Visitor &visitor) const

Method so that the visitor can visit us.

~Binary(void)
std::ostream &print(std::ostream &os) const
void patch_address(uint64_t address, const std::vector<uint8_t> &patch_value, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO)

Patch the content at virtual address address with patch_value

Parameters
  • [in] address: Address to patch

  • [in] patch_value: Patch to apply

void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO)

Patch the address with the given value

Parameters
  • [in] address: Address to patch

  • [in] patch_value: Patch to apply

  • [in] size: Size of the value in bytes (1, 2, … 8)

std::vector<uint8_t> get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) const

Return the content located at virtual address.

uint64_t entrypoint(void) const

Binary’s entrypoint (if any)

bool is_pie(void) const

Check if the binary is position independent.

bool has_nx(void) const

Check if the binary uses NX protection.

bool has_entrypoint(void) const

true if the binary has an entrypoint.

Basically for libraries it will return false

bool has_uuid(void) const

true if the binary has a MachO::UUIDCommand command.

UUIDCommand &uuid(void)

Return the MachO::UUIDCommand.

const UUIDCommand &uuid(void) const
bool has_main_command(void) const

true if the binary has a MachO::MainCommand command.

MainCommand &main_command(void)

Return the MachO::MainCommand.

const MainCommand &main_command(void) const
bool has_dylinker(void) const

true if the binary has a MachO::DylinkerCommand.

DylinkerCommand &dylinker(void)

Return the MachO::DylinkerCommand.

const DylinkerCommand &dylinker(void) const
bool has_dyld_info(void) const

true if the binary has a MachO::DyldInfo command.

DyldInfo &dyld_info(void)

Return the MachO::Dyld command.

const DyldInfo &dyld_info(void) const
bool has_function_starts(void) const

true if the binary has a MachO::FunctionStarts command.

FunctionStarts &function_starts(void)

Return the MachO::FunctionStarts command.

const FunctionStarts &function_starts(void) const
bool has_source_version(void) const

true if the binary has a MachO::SourceVersion command.

SourceVersion &source_version(void)

Return the MachO::SourceVersion command.

const SourceVersion &source_version(void) const
bool has_version_min(void) const

true if the binary has a MachO::VersionMin command.

VersionMin &version_min(void)

Return the MachO::VersionMin command.

const VersionMin &version_min(void) const
bool has_thread_command(void) const

true if the binary has a MachO::ThreadCommand command.

ThreadCommand &thread_command(void)

Return the MachO::ThreadCommand command.

const ThreadCommand &thread_command(void) const
bool has_rpath(void) const

true if the binary has a MachO::RPathCommand command.

RPathCommand &rpath(void)

Return the MachO::RPathCommand command.

const RPathCommand &rpath(void) const
bool has_symbol_command(void) const

true if the binary has a MachO::SymbolCommand command.

SymbolCommand &symbol_command(void)

Return the MachO::SymbolCommand.

const SymbolCommand &symbol_command(void) const
bool has_dynamic_symbol_command(void) const

true if the binary has a MachO::DynamicSymbolCommand command.

DynamicSymbolCommand &dynamic_symbol_command(void)

Return the MachO::SymbolCommand.

const DynamicSymbolCommand &dynamic_symbol_command(void) const
bool has_code_signature(void) const

true if the binary is signed.

CodeSignature &code_signature(void)

Return the MachO::Signature.

const CodeSignature &code_signature(void) const
bool has_data_in_code(void) const

true if the binaryhas a MachO::DataInCode command.

DataInCode &data_in_code(void)

Return the MachO::Signature.

const DataInCode &data_in_code(void) const
bool has_segment_split_info(void) const

true if the binary has segment split info.

SegmentSplitInfo &segment_split_info(void)

Return the MachO::SegmentSplitInfo.

const SegmentSplitInfo &segment_split_info(void) const
bool has_sub_framework(void) const

true if the binary has a sub framework command.

bool has_encryption_info(void) const

true if the binary has Encryption Info.

EncryptionInfo &encryption_info(void)

Return the MachO::DyldEnvironment.

const EncryptionInfo &encryption_info(void) const
SubFramework &sub_framework(void)

Return the MachO::SubFramework.

const SubFramework &sub_framework(void) const
bool has_dyld_environment(void) const

true if the binary has Dyld envrionment variables.

DyldEnvironment &dyld_environment(void)

Return the MachO::DyldEnvironment.

const DyldEnvironment &dyld_environment(void) const
bool has_build_version(void) const

true if the binary has Build Version command.

BuildVersion &build_version(void)

Return the MachO::BuildVersion.

const BuildVersion &build_version(void) const
template<class T>
bool has_command(void) const
template<class T>
T &command(void)
template<class T>
const T &command(void) const
template<class T>
size_t count_commands(void) const
LoadCommand &operator[](LOAD_COMMAND_TYPES type)
const LoadCommand &operator[](LOAD_COMMAND_TYPES type) const
LIEF::Binary::functions_t ctor_functions(void) const

Constructor functions that are called prior any other functions.

LIEF::Binary::functions_t functions(void) const
LIEF::Binary::functions_t unwind_functions(void) const

Public Static Functions

bool is_exported(const Symbol &symbol)

Check if the given symbol is an exported one.

bool is_imported(const Symbol &symbol)

Check if the given symbol is an imported one.



Builder

class Builder

Public Functions

Builder(Binary *binary)
Builder(std::vector<Binary *> binaries)
Builder(FatBinary *fat)
Builder(void)
~Builder(void)
std::vector<uint8_t> operator()(void)
void build(void)
const std::vector<uint8_t> &get_build(void)
void write(const std::string &filename) const

Public Static Functions

void write(Binary *binary, const std::string &filename)
void write(FatBinary *fatbinary, const std::string &filename)

DylibCommand

class DylibCommand : public LIEF::MachO::LoadCommand

Public Types

using version_t = std::array<uint16_t, 3>

Public Functions

DylibCommand(void)
DylibCommand(const dylib_command *cmd)
DylibCommand &operator=(const DylibCommand &copy)
DylibCommand(const DylibCommand &copy)
~DylibCommand(void)
DylibCommand *clone(void) const
const std::string &name(void) const

Library name.

uint32_t timestamp(void) const

Date and Time when the shared library was built.

DylibCommand::version_t current_version(void) const

Current version of the shared library.

DylibCommand::version_t compatibility_version(void) const

Compatibility version of the shared library.

void name(const std::string &name)
void timestamp(uint32_t timestamp)
void current_version(version_t currentVersion)
void compatibility_version(version_t compatibilityVersion)
std::ostream &print(std::ostream &os) const
bool operator==(const DylibCommand &rhs) const
bool operator!=(const DylibCommand &rhs) const
void accept(Visitor &visitor) const

Public Static Functions

DylibCommand::version_t int2version(uint32_t version)

Helper to convert an integer into a version array.

uint32_t version2int(version_t version)

Helper to convert a version array into an integer.

DylibCommand weak_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_LOAD_WEAK_DYLIB library.

DylibCommand id_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_ID_DYLIB library.

DylibCommand load_dylib(const std::string &name, uint32_t timestamp = 2, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_LOAD_DYLIB library.

DylibCommand reexport_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_REEXPORT_DYLIB library.

DylibCommand load_upward_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_LOAD_UPWARD_DYLIB library.

DylibCommand lazy_load_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_LAZY_LOAD_DYLIB library.


DylinkerCommand

class DylinkerCommand : public LIEF::MachO::LoadCommand

Public Functions

DylinkerCommand(void)
DylinkerCommand(const dylinker_command *cmd)
DylinkerCommand &operator=(const DylinkerCommand &copy)
DylinkerCommand(const DylinkerCommand &copy)
DylinkerCommand *clone(void) const
~DylinkerCommand(void)
std::ostream &print(std::ostream &os) const
const std::string &name(void) const
void name(const std::string &name)
bool operator==(const DylinkerCommand &rhs) const
bool operator!=(const DylinkerCommand &rhs) const
void accept(Visitor &visitor) const

DynamicSymbolCommand

class DynamicSymbolCommand : public LIEF::MachO::LoadCommand

Public Functions

DynamicSymbolCommand(void)
DynamicSymbolCommand(const dysymtab_command *cmd)
DynamicSymbolCommand &operator=(const DynamicSymbolCommand &copy)
DynamicSymbolCommand(const DynamicSymbolCommand &copy)
DynamicSymbolCommand *clone(void) const
~DynamicSymbolCommand(void)
void accept(Visitor &visitor) const
bool operator==(const DynamicSymbolCommand &rhs) const
bool operator!=(const DynamicSymbolCommand &rhs) const
std::ostream &print(std::ostream &os) const
uint32_t idx_local_symbol(void) const

Index of the first symbol in the group of local symbols.

uint32_t nb_local_symbols(void) const

Number of symbols in the group of local symbols.

uint32_t idx_external_define_symbol(void) const

Index of the first symbol in the group of defined external symbols.

uint32_t nb_external_define_symbols(void) const

Number of symbols in the group of defined external symbols.

uint32_t idx_undefined_symbol(void) const

Index of the first symbol in the group of undefined external symbols.

uint32_t nb_undefined_symbols(void) const

Number of symbols in the group of undefined external symbols.

uint32_t toc_offset(void) const

Byte offset from the start of the file to the table of contents data

Table of content is used by legacy Mach-O loader and this field should be set to 0

uint32_t nb_toc(void) const

Number of entries in the table of contents.

Should be set to 0 on recent Mach-O

uint32_t module_table_offset(void) const

Byte offset from the start of the file to the module table data.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t nb_module_table(void) const

Number of entries in the module table.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t external_reference_symbol_offset(void) const

Byte offset from the start of the file to the external reference table data.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t nb_external_reference_symbols(void) const

Number of entries in the external reference table

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t indirect_symbol_offset(void) const

Byte offset from the start of the file to the indirect symbol table data.

Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process

References:

  • dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp

  • dyld-519.2.1/src/ImageLoaderMachOClassic.cpp

uint32_t nb_indirect_symbols(void) const

Number of entries in the indirect symbol table.

See

indirect_symbol_offset

uint32_t external_relocation_offset(void) const

Byte offset from the start of the file to the external relocation table data.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t nb_external_relocations(void) const

Number of entries in the external relocation table.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t local_relocation_offset(void) const

Byte offset from the start of the file to the local relocation table data.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t nb_local_relocations(void) const

Number of entries in the local relocation table.

This field seems unused by recent Mach-O loader and should be set to 0

void idx_local_symbol(uint32_t value)
void nb_local_symbols(uint32_t value)
void idx_external_define_symbol(uint32_t value)
void nb_external_define_symbols(uint32_t value)
void idx_undefined_symbol(uint32_t value)
void nb_undefined_symbols(uint32_t value)
void toc_offset(uint32_t value)
void nb_toc(uint32_t value)
void module_table_offset(uint32_t value)
void nb_module_table(uint32_t value)
void external_reference_symbol_offset(uint32_t value)
void nb_external_reference_symbols(uint32_t value)
void indirect_symbol_offset(uint32_t value)
void nb_indirect_symbols(uint32_t value)
void external_relocation_offset(uint32_t value)
void nb_external_relocations(uint32_t value)
void local_relocation_offset(uint32_t value)
void nb_local_relocations(uint32_t value)

LoadCommand

class LoadCommand : public LIEF::Object

Subclassed by LIEF::MachO::BuildVersion, LIEF::MachO::CodeSignature, LIEF::MachO::DataInCode, LIEF::MachO::DyldEnvironment, LIEF::MachO::DyldInfo, LIEF::MachO::DylibCommand, LIEF::MachO::DylinkerCommand, LIEF::MachO::DynamicSymbolCommand, LIEF::MachO::EncryptionInfo, LIEF::MachO::FunctionStarts, LIEF::MachO::MainCommand, LIEF::MachO::RPathCommand, LIEF::MachO::SegmentCommand, LIEF::MachO::SegmentSplitInfo, LIEF::MachO::SourceVersion, LIEF::MachO::SubFramework, LIEF::MachO::SymbolCommand, LIEF::MachO::ThreadCommand, LIEF::MachO::UUIDCommand, LIEF::MachO::VersionMin

Public Types

using raw_t = std::vector<uint8_t>

Public Functions

LoadCommand(void)
LoadCommand(const load_command *command)
LoadCommand(LOAD_COMMAND_TYPES type, uint32_t size)
LoadCommand &operator=(LoadCommand copy)
LoadCommand(const LoadCommand &copy)
void swap(LoadCommand &other)
LoadCommand *clone(void) const
~LoadCommand(void)
LOAD_COMMAND_TYPES command(void) const

Command type.

uint32_t size(void) const

Size of the command (should be greather than sizeof(load_command))

const LoadCommand::raw_t &data(void) const

Raw command.

uint64_t command_offset(void) const

Offset of the command within the Load Command Table

void data(const raw_t &data)
void command(LOAD_COMMAND_TYPES command)
void size(uint32_t size)
void command_offset(uint64_t offset)
std::ostream &print(std::ostream &os) const
bool operator==(const LoadCommand &rhs) const
bool operator!=(const LoadCommand &rhs) const
void accept(Visitor &visitor) const

Friends

std::ostream &operator<<(std::ostream &os, const LoadCommand &cmd)

MainCommand

class MainCommand : public LIEF::MachO::LoadCommand

Public Functions

MainCommand(void)
MainCommand(const entry_point_command *cmd)
MainCommand &operator=(const MainCommand &copy)
MainCommand(const MainCommand &copy)
MainCommand *clone(void) const
~MainCommand(void)
uint64_t entrypoint(void) const
uint64_t stack_size(void) const
void entrypoint(uint64_t entrypoint)
void stack_size(uint64_t stacksize)
bool operator==(const MainCommand &rhs) const
bool operator!=(const MainCommand &rhs) const
std::ostream &print(std::ostream &os) const
void accept(Visitor &visitor) const

Section

class Section : public LIEF::Section

Public Types

using content_t = std::vector<uint8_t>
using flag_list_t = std::set<MACHO_SECTION_FLAGS>

Public Functions

Section(void)
Section(const section_32 *sectionCmd)
Section(const section_64 *sectionCmd)
Section(const std::string &name)
Section(const std::string &name, const content_t &content)
Section &operator=(Section copy)
Section(const Section &copy)
void swap(Section &other)
~Section(void)
Section::content_t content(void) const

section’s content

void content(const content_t &data)

Set section content.

const std::string &segment_name(void) const

Return the name of the segment holding this section.

uint64_t address(void) const

See

virtual_address

uint32_t alignment(void) const
uint32_t relocation_offset(void) const
uint32_t numberof_relocations(void) const
uint32_t flags(void) const
MACHO_SECTION_TYPES type(void) const
uint32_t reserved1(void) const
uint32_t reserved2(void) const
uint32_t reserved3(void) const
Section::flag_list_t flags_list(void) const
uint32_t raw_flags(void) const
bool has_segment(void) const
SegmentCommand &segment(void)
const SegmentCommand &segment(void) const
void clear(uint8_t v)
it_relocations relocations(void)
it_const_relocations relocations(void) const
void segment_name(const std::string &name)
void address(uint64_t address)
void alignment(uint32_t align)
void relocation_offset(uint32_t relocOffset)
void numberof_relocations(uint32_t nbReloc)
void flags(uint32_t flags)
void flags(flag_list_t flags)
void type(MACHO_SECTION_TYPES type)
void reserved1(uint32_t reserved1)
void reserved2(uint32_t reserved2)
void reserved3(uint32_t reserved3)
bool has(MACHO_SECTION_FLAGS flag) const
void add(MACHO_SECTION_FLAGS flag)
void remove(MACHO_SECTION_FLAGS flag)
Section &operator+=(MACHO_SECTION_FLAGS flag)
Section &operator-=(MACHO_SECTION_FLAGS flag)
void accept(Visitor &visitor) const

Method so that the visitor can visit us.

bool operator==(const Section &rhs) const
bool operator!=(const Section &rhs) const

Friends

std::ostream &operator<<(std::ostream &os, const Section &section)

Symbol

class Symbol : public LIEF::Symbol

Public Functions

Symbol(void)
Symbol(const nlist_32 *cmd)
Symbol(const nlist_64 *cmd)
Symbol &operator=(Symbol other)
Symbol(const Symbol &other)
void swap(Symbol &other)
~Symbol(void)
uint8_t type(void) const
uint8_t numberof_sections(void) const
uint16_t description(void) const
bool has_export_info(void) const
const ExportInfo &export_info(void) const
ExportInfo &export_info(void)
bool has_binding_info(void) const
const BindingInfo &binding_info(void) const
BindingInfo &binding_info(void)
std::string demangled_name(void) const
void type(uint8_t type)
void numberof_sections(uint8_t nbsections)
void description(uint16_t desc)
bool is_external(void) const
const DylibCommand *library(void) const
DylibCommand *library(void)
SYMBOL_ORIGINS origin(void) const
void accept(Visitor &visitor) const

Method so that the visitor can visit us.

bool operator==(const Symbol &rhs) const
bool operator!=(const Symbol &rhs) const

Friends

std::ostream &operator<<(std::ostream &os, const Symbol &symbol)

SymbolCommand

class SymbolCommand : public LIEF::MachO::LoadCommand

Public Functions

SymbolCommand(void)
SymbolCommand(const symtab_command *command)
SymbolCommand &operator=(const SymbolCommand &copy)
SymbolCommand(const SymbolCommand &copy)
SymbolCommand *clone(void) const
~SymbolCommand(void)
uint32_t symbol_offset(void) const

Offset from the start of the file to the n_list associated with the command.

uint32_t numberof_symbols(void) const

Number of symbols registered.

uint32_t strings_offset(void) const

Offset from the start of the file to the string table.

uint32_t strings_size(void) const

Size of the size string table.

void symbol_offset(uint32_t offset)
void numberof_symbols(uint32_t nb)
void strings_offset(uint32_t offset)
void strings_size(uint32_t size)
std::ostream &print(std::ostream &os) const
void accept(Visitor &visitor) const
bool operator==(const SymbolCommand &rhs) const
bool operator!=(const SymbolCommand &rhs) const

UUIDCommand

class UUIDCommand : public LIEF::MachO::LoadCommand

Public Functions

UUIDCommand(void)
UUIDCommand(const uuid_command *uuidCmd)
UUIDCommand &operator=(const UUIDCommand &copy)
UUIDCommand(const UUIDCommand &copy)
UUIDCommand *clone(void) const
~UUIDCommand(void)
uuid_t uuid(void) const
void uuid(const uuid_t &uuid)
bool operator==(const UUIDCommand &rhs) const
bool operator!=(const UUIDCommand &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Dyld Info

class DyldInfo : public LIEF::MachO::LoadCommand

LC_DYLD_INFO and LC_DYLD_INFO_ONLY command model.

Public Types

using info_t = std::pair<uint32_t, uint32_t>

Tuple of offset and size

Public Functions

DyldInfo(void)
DyldInfo(const dyld_info_command *dyld_info_cmd)
DyldInfo &operator=(DyldInfo other)
DyldInfo(const DyldInfo &copy)
void swap(DyldInfo &other)
DyldInfo *clone(void) const
~DyldInfo(void)
const DyldInfo::info_t &rebase(void) const

Rebase information

Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes whose symbolic names start with REBASE_OPCODE_. Conceptually the rebase information is a table of tuples: <seg-index, seg-offset, type> The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes.

See

/usr/include/mach-o/loader.h

const buffer_t &rebase_opcodes(void) const

Return Rebase’s opcodes as raw data.

buffer_t &rebase_opcodes(void)
void rebase_opcodes(const buffer_t &raw)

Set new opcodes.

std::string show_rebases_opcodes(void) const

Return the rebase opcodes in a humman-readable way.

const DyldInfo::info_t &bind(void) const

Bind information

Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes whose symbolic names start with BIND_OPCODE_. Conceptually the bind information is a table of tuples: <seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend> The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialzed to the same value can be encoded in a few bytes.

See

/usr/include/mach-o/loader.h

const buffer_t &bind_opcodes(void) const

Return Binding’s opcodes as raw data.

buffer_t &bind_opcodes(void)
void bind_opcodes(const buffer_t &raw)

Set new opcodes.

std::string show_bind_opcodes(void) const

Return the bind opcodes in a humman-readable way.

const DyldInfo::info_t &weak_bind(void) const

Weak Bind information

Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data. This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enable dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to “operator new” are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound.

See

/usr/include/mach-o/loader.h

const buffer_t &weak_bind_opcodes(void) const

Return Weak Binding’s opcodes as raw data.

buffer_t &weak_bind_opcodes(void)
void weak_bind_opcodes(const buffer_t &raw)

Set new opcodes.

std::string show_weak_bind_opcodes(void) const

Return the bind opcodes in a humman-readable way.

const DyldInfo::info_t &lazy_bind(void) const

Lazy Bind information

Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind are contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.

See

/usr/include/mach-o/loader.h

const buffer_t &lazy_bind_opcodes(void) const

Return Lazy Binding’s opcodes as raw data.

buffer_t &lazy_bind_opcodes(void)
void lazy_bind_opcodes(const buffer_t &raw)

Set new opcodes.

std::string show_lazy_bind_opcodes(void) const

Return the lazy opcodes in a humman-readable way.

it_binding_info bindings(void)

Iterator over BindingInfo entries.

it_const_binding_info bindings(void) const
const DyldInfo::info_t &export_info(void) const

Export information

The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes. It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie.

Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.

After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.

See

/usr/include/mach-o/loader.h

it_export_info exports(void)

Iterator over ExportInfo entries.

it_const_export_info exports(void) const
const buffer_t &export_trie(void) const

Return Export’s trie as raw data.

buffer_t &export_trie(void)
void export_trie(const buffer_t &raw)

Set new trie.

std::string show_export_trie(void) const

Return the export trie in a humman-readable way.

void rebase(const info_t &info)
void bind(const info_t &info)
void weak_bind(const info_t &info)
void lazy_bind(const info_t &info)
void export_info(const info_t &info)
void set_rebase_offset(uint32_t offset)
void set_rebase_size(uint32_t size)
void set_bind_offset(uint32_t offset)
void set_bind_size(uint32_t size)
void set_weak_bind_offset(uint32_t offset)
void set_weak_bind_size(uint32_t size)
void set_lazy_bind_offset(uint32_t offset)
void set_lazy_bind_size(uint32_t size)
void set_export_offset(uint32_t offset)
void set_export_size(uint32_t size)
bool operator==(const DyldInfo &rhs) const
bool operator!=(const DyldInfo &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Function starts

class FunctionStarts : public LIEF::MachO::LoadCommand

Public Functions

FunctionStarts(void)
FunctionStarts(const linkedit_data_command *cmd)
FunctionStarts &operator=(const FunctionStarts &copy)
FunctionStarts(const FunctionStarts &copy)
FunctionStarts *clone(void) const
uint32_t data_offset(void) const

Offset in the binary where start functions are located.

uint32_t data_size(void) const

Size of the functions list in the binary.

const std::vector<uint64_t> &functions(void) const

Addresses of every function entry point in the executable.

This allows for functions to exist that have no entries in the symbol table.

Warning

The address is relative to the __TEXT segment

std::vector<uint64_t> &functions(void)
void add_function(uint64_t address)

Add a new function.

void data_offset(uint32_t offset)
void data_size(uint32_t size)
void functions(const std::vector<uint64_t> &funcs)
~FunctionStarts(void)
bool operator==(const FunctionStarts &rhs) const
bool operator!=(const FunctionStarts &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Source Version

class SourceVersion : public LIEF::MachO::LoadCommand

Public Types

using version_t = std::array<uint32_t, 5>

Version is an array of 5 integers.

Public Functions

SourceVersion(void)
SourceVersion(const source_version_command *version_cmd)
SourceVersion &operator=(const SourceVersion &copy)
SourceVersion(const SourceVersion &copy)
SourceVersion *clone(void) const
~SourceVersion(void)
const SourceVersion::version_t &version(void) const

Return the version as an array.

void version(const SourceVersion::version_t &version)
bool operator==(const SourceVersion &rhs) const
bool operator!=(const SourceVersion &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Version Min

class VersionMin : public LIEF::MachO::LoadCommand

Public Types

using version_t = std::array<uint32_t, 3>

Version is an array of 3 integers.

Public Functions

VersionMin(void)
VersionMin(const version_min_command *version_cmd)
VersionMin &operator=(const VersionMin &copy)
VersionMin(const VersionMin &copy)
VersionMin *clone(void) const
~VersionMin(void)
const VersionMin::version_t &version(void) const

Return the version as an array.

void version(const VersionMin::version_t &version)
const VersionMin::version_t &sdk(void) const

Return the sdk as an array.

void sdk(const VersionMin::version_t &sdk)
bool operator==(const VersionMin &rhs) const
bool operator!=(const VersionMin &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Relocation

class Relocation : public LIEF::Relocation

Object modeling relocation.

See

:

Subclassed by LIEF::MachO::RelocationDyld, LIEF::MachO::RelocationObject

Public Functions

Relocation(void)
Relocation(uint64_t address, uint8_t type)
Relocation(const Relocation &other)
void swap(Relocation &other)
~Relocation(void)
virtual Relocation *clone(void) const = 0
virtual bool is_pc_relative(void) const = 0

For object this is an offset from the start of the section to the item containing the address requiring relocation.

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

uint8_t type(void) const

Type of the relocation according to the architecture and/or origin.

See:

CPU_TYPES architecture(void) const

architecture of the relocation

virtual RELOCATION_ORIGINS origin(void) const = 0

Origin of the relocation.

bool has_symbol(void) const

true if the relocation has a symbol associated with

Symbol &symbol(void)

Symbol associated with the relocation (if any)

const Symbol &symbol(void) const
bool has_section(void) const

true if the relocation has a section associated with

Section &section(void)

Section associated with the relocation (if any)

const Section &section(void) const
bool has_segment(void) const

true if the relocation has a SegmentCommand associated with

SegmentCommand &segment(void)

SegmentCommand associated with the relocation (if any)

const SegmentCommand &segment(void) const
virtual void pc_relative(bool val) = 0
void type(uint8_t type)
bool operator==(const Relocation &rhs) const
bool operator!=(const Relocation &rhs) const
void accept(Visitor &visitor) const

Method so that the visitor can visit us.

std::ostream &print(std::ostream &os) const

Friends

std::ostream &operator<<(std::ostream &os, const Relocation &relocation)

Relocation Object

class RelocationObject : public LIEF::MachO::Relocation

Public Functions

RelocationObject(void)
RelocationObject(const relocation_info *relocinfo)
RelocationObject(const scattered_relocation_info *scattered_relocinfo)
RelocationObject &operator=(RelocationObject other)
RelocationObject(const RelocationObject &other)
void swap(RelocationObject &other)
~RelocationObject(void)
RelocationObject *clone(void) const
bool is_pc_relative(void) const

For object this is an offset from the start of the section to the item containing the address requiring relocation.

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

size_t size(void) const

Relocation size in bits

uint64_t address(void) const

Relocation’s Address.

bool is_scattered(void) const

true if the relocation is a scattered one

int32_t value(void) const

For scattered relocations, The address of the relocatable expression for the item in the file that needs to be updated if the address is changed.

For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.

RELOCATION_ORIGINS origin(void) const

Origin of the relocation.

void pc_relative(bool val)
void size(size_t size)
void value(int32_t value)
bool operator==(const RelocationObject &rhs) const
bool operator!=(const RelocationObject &rhs) const
void accept(Visitor &visitor) const

Method so that the visitor can visit us.

std::ostream &print(std::ostream &os) const

Relocation Dyld

class RelocationDyld : public LIEF::MachO::Relocation

Public Functions

RelocationDyld(void)
RelocationDyld &operator=(const RelocationDyld&)
RelocationDyld(const RelocationDyld&)
~RelocationDyld(void)
Relocation *clone(void) const
bool is_pc_relative(void) const

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

RELOCATION_ORIGINS origin(void) const

Origin of the relocation.

void pc_relative(bool val)
bool operator==(const RelocationDyld &rhs) const
bool operator!=(const RelocationDyld &rhs) const
bool operator<(const RelocationDyld &rhs) const
bool operator>=(const RelocationDyld &rhs) const
bool operator>(const RelocationDyld &rhs) const
bool operator<=(const RelocationDyld &rhs) const
void accept(Visitor &visitor) const

Method so that the visitor can visit us.

std::ostream &print(std::ostream &os) const

Binding Info

class BindingInfo : public LIEF::Object

Public Functions

BindingInfo(void)
BindingInfo(BINDING_CLASS cls, BIND_TYPES type, uint64_t address, int64_t addend = 0, int32_t oridnal = 0, bool is_weak = false, bool is_non_weak_definition = false)
BindingInfo &operator=(BindingInfo other)
BindingInfo(const BindingInfo &other)
void swap(BindingInfo &other)
bool has_segment(void) const

Check if a segment is associated with the BindingInfo.

const SegmentCommand &segment(void) const

Segment associated with the BindingInfo

SegmentCommand &segment(void)
bool has_library(void) const

Check if a library is tied with the BindingInfo.

const DylibCommand &library(void) const

Library associated with the BindingInfo

DylibCommand &library(void)
bool has_symbol(void) const

Check if a symbol is associated with the BindingInfo.

const Symbol &symbol(void) const

Symbol associated with the BindingInfo

Symbol &symbol(void)
uint64_t address(void) const

Address of the binding.

void address(uint64_t addr)
BINDING_CLASS binding_class(void) const

Class of the binding (weak, lazy, …)

void binding_class(BINDING_CLASS bind_class)
BIND_TYPES binding_type(void) const

Type of the binding. Most of the times it’s BIND_TYPES::BIND_TYPE_POINTER.

void binding_type(BIND_TYPES type)
int32_t library_ordinal(void) const
void library_ordinal(int32_t ordinal)
int64_t addend(void) const

Value added to the segment’s virtual address when binding.

void addend(int64_t addend)
bool is_weak_import(void) const
void set_weak_import(bool val = true)
bool is_non_weak_definition(void) const
void set_non_weak_definition(bool val)
~BindingInfo(void)
bool operator==(const BindingInfo &rhs) const
bool operator!=(const BindingInfo &rhs) const
void accept(Visitor &visitor) const

Friends

std::ostream &operator<<(std::ostream &os, const BindingInfo &binding_info)

Export Info

class ExportInfo : public LIEF::Object

Public Types

using flag_list_t = std::vector<EXPORT_SYMBOL_FLAGS>

Public Functions

ExportInfo(void)
ExportInfo(uint64_t address, uint64_t flags, uint64_t offset = 0)
ExportInfo &operator=(ExportInfo copy)
ExportInfo(const ExportInfo &copy)
void swap(ExportInfo &other)
uint64_t node_offset(void) const
uint64_t flags(void) const
void flags(uint64_t flags)
ExportInfo::flag_list_t flags_list(void) const
bool has(EXPORT_SYMBOL_FLAGS flag) const
EXPORT_SYMBOL_KINDS kind(void) const
uint64_t other(void) const
uint64_t address(void) const
void address(uint64_t addr)
bool has_symbol(void) const
const Symbol &symbol(void) const
Symbol &symbol(void)
Symbol *alias(void)
const Symbol *alias(void) const
DylibCommand *alias_library(void)
const DylibCommand *alias_library(void) const
~ExportInfo(void)
bool operator==(const ExportInfo &rhs) const
bool operator!=(const ExportInfo &rhs) const
void accept(Visitor &visitor) const

Friends

std::ostream &operator<<(std::ostream &os, const ExportInfo &export_info)

Thread Command

class ThreadCommand : public LIEF::MachO::LoadCommand

Public Functions

ThreadCommand(void)
ThreadCommand(const thread_command *cmd, CPU_TYPES arch = CPU_TYPES::CPU_TYPE_ANY)
ThreadCommand(uint32_t flavor, uint32_t count, CPU_TYPES arch = CPU_TYPES::CPU_TYPE_ANY)
ThreadCommand &operator=(const ThreadCommand &copy)
ThreadCommand(const ThreadCommand &copy)
ThreadCommand *clone(void) const
~ThreadCommand(void)
uint32_t flavor(void) const
uint32_t count(void) const
CPU_TYPES architecture(void) const
const std::vector<uint8_t> &state(void) const
std::vector<uint8_t> &state(void)
uint64_t pc(void) const
void state(const std::vector<uint8_t> &state)
void flavor(uint32_t flavor)
void count(uint32_t count)
void architecture(CPU_TYPES arch)
bool operator==(const ThreadCommand &rhs) const
bool operator!=(const ThreadCommand &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

RPath Command

class RPathCommand : public LIEF::MachO::LoadCommand

Public Functions

RPathCommand(void)
RPathCommand(const rpath_command *rpathCmd)
RPathCommand &operator=(const RPathCommand &copy)
RPathCommand(const RPathCommand &copy)
RPathCommand *clone(void) const
~RPathCommand(void)
const std::string &path(void) const
void path(const std::string &path)
bool operator==(const RPathCommand &rhs) const
bool operator!=(const RPathCommand &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Code Signature

class CodeSignature : public LIEF::MachO::LoadCommand

Public Functions

CodeSignature(void)
CodeSignature(const linkedit_data_command *cmd)
CodeSignature &operator=(const CodeSignature &copy)
CodeSignature(const CodeSignature &copy)
CodeSignature *clone(void) const
uint32_t data_offset(void) const
uint32_t data_size(void) const
void data_offset(uint32_t offset)
void data_size(uint32_t size)
~CodeSignature(void)
bool operator==(const CodeSignature &rhs) const
bool operator!=(const CodeSignature &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Data In Code

class DataInCode : public LIEF::MachO::LoadCommand

Interface of the LC_DATA_IN_CODE command.

Public Types

using entries_t = std::vector<DataCodeEntry>
using it_const_entries = const_ref_iterator<const entries_t&>
using it_entries = ref_iterator<entries_t&>

Public Functions

DataInCode(void)
DataInCode(const linkedit_data_command *cmd)
DataInCode &operator=(const DataInCode&)
DataInCode(const DataInCode&)
DataInCode *clone(void) const
uint32_t data_offset(void) const
uint32_t data_size(void) const
void data_offset(uint32_t offset)
void data_size(uint32_t size)
DataInCode &add(const DataCodeEntry &entry)
DataInCode::it_const_entries entries(void) const
DataInCode::it_entries entries(void)
~DataInCode(void)
bool operator==(const DataInCode &rhs) const
bool operator!=(const DataInCode &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Data Code Entry

class DataCodeEntry : public LIEF::Object

Interface of an entry in DataInCode.

Public Types

enum TYPES

Values:

UNKNOWN = 0
DATA = 1
JUMP_TABLE_8 = 2
JUMP_TABLE_16 = 3
JUMP_TABLE_32 = 4
ABS_JUMP_TABLE_32 = 5

Public Functions

DataCodeEntry(void)
DataCodeEntry(uint32_t off, uint16_t length, TYPES type)
DataCodeEntry(const data_in_code_entry *entry)
DataCodeEntry &operator=(const DataCodeEntry&)
DataCodeEntry(const DataCodeEntry&)
uint32_t offset(void) const

Offset of the data.

uint16_t length(void) const

Length of the data.

DataCodeEntry::TYPES type(void) const
void offset(uint32_t off)
void length(uint16_t length)
void type(TYPES type)
~DataCodeEntry(void)
bool operator==(const DataCodeEntry &rhs) const
bool operator!=(const DataCodeEntry &rhs) const
void accept(Visitor &visitor) const

Friends

std::ostream &operator<<(std::ostream &os, const DataCodeEntry &entry)
enum LIEF::MachO::DataCodeEntry::TYPES

Values:

UNKNOWN = 0
DATA = 1
JUMP_TABLE_8 = 2
JUMP_TABLE_16 = 3
JUMP_TABLE_32 = 4
ABS_JUMP_TABLE_32 = 5

Segment Split Info

class SegmentSplitInfo : public LIEF::MachO::LoadCommand

Public Functions

SegmentSplitInfo(void)
SegmentSplitInfo(const linkedit_data_command *cmd)
SegmentSplitInfo &operator=(const SegmentSplitInfo &copy)
SegmentSplitInfo(const SegmentSplitInfo &copy)
SegmentSplitInfo *clone(void) const
uint32_t data_offset(void) const
uint32_t data_size(void) const
void data_offset(uint32_t offset)
void data_size(uint32_t size)
~SegmentSplitInfo(void)
bool operator==(const SegmentSplitInfo &rhs) const
bool operator!=(const SegmentSplitInfo &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Sub-Framework

class SubFramework : public LIEF::MachO::LoadCommand

Public Functions

SubFramework(void)
SubFramework(const sub_framework_command *cmd)
SubFramework &operator=(const SubFramework &copy)
SubFramework(const SubFramework &copy)
SubFramework *clone(void) const
const std::string &umbrella(void) const
void umbrella(const std::string &u)
~SubFramework(void)
bool operator==(const SubFramework &rhs) const
bool operator!=(const SubFramework &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Dyld Environment

class DyldEnvironment : public LIEF::MachO::LoadCommand

Public Functions

DyldEnvironment(void)
DyldEnvironment(const dylinker_command *cmd)
DyldEnvironment &operator=(const DyldEnvironment &copy)
DyldEnvironment(const DyldEnvironment &copy)
DyldEnvironment *clone(void) const
~DyldEnvironment(void)
std::ostream &print(std::ostream &os) const
const std::string &value(void) const
void value(const std::string &values)
bool operator==(const DyldEnvironment &rhs) const
bool operator!=(const DyldEnvironment &rhs) const
void accept(Visitor &visitor) const

Encryption Info

class EncryptionInfo : public LIEF::MachO::LoadCommand

Public Functions

EncryptionInfo(void)
EncryptionInfo(const encryption_info_command *cmd)
EncryptionInfo &operator=(const EncryptionInfo &copy)
EncryptionInfo(const EncryptionInfo &copy)
~EncryptionInfo(void)
uint32_t crypt_offset(void) const
uint32_t crypt_size(void) const
uint32_t crypt_id(void) const
void crypt_offset(uint32_t offset)
void crypt_size(uint32_t size)
void crypt_id(uint32_t id)
bool operator==(const EncryptionInfo &rhs) const
bool operator!=(const EncryptionInfo &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Build Version

class BuildVersion : public LIEF::MachO::LoadCommand

Public Types

enum PLATFORMS

Values:

UNKNOWN = 0
MACOS = 1
IOS = 2
TVOS = 3
WATCHOS = 4
using version_t = std::array<uint32_t, 3>

Version is an array of 3 integers.

using tools_list_t = std::vector<BuildToolVersion>

Public Functions

BuildVersion(void)
BuildVersion(const build_version_command *version_cmd)
BuildVersion &operator=(const BuildVersion &copy)
BuildVersion(const BuildVersion &copy)
BuildVersion *clone(void) const
BuildVersion::version_t minos(void) const
void minos(version_t version)
BuildVersion::version_t sdk(void) const
void sdk(version_t version)
BuildVersion::PLATFORMS platform(void) const
void platform(PLATFORMS plat)
BuildVersion::tools_list_t tools(void) const
~BuildVersion(void)
bool operator==(const BuildVersion &rhs) const
bool operator!=(const BuildVersion &rhs) const
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Build Tool Version

class BuildToolVersion : public LIEF::Object

Public Types

enum TOOLS

Values:

UNKNOWN = 0
CLANG = 1
SWIFT = 2
LD = 3
using version_t = std::array<uint32_t, 3>

Version is an array of 3 integers.

Public Functions

BuildToolVersion(void)
BuildToolVersion(const build_tool_version &tool)
BuildToolVersion::TOOLS tool(void) const

TOOL used.

BuildToolVersion::version_t version(void) const

Version associated with the tool.

~BuildToolVersion(void)
bool operator==(const BuildToolVersion &rhs) const
bool operator!=(const BuildToolVersion &rhs) const
void accept(Visitor &visitor) const

Friends

std::ostream &operator<<(std::ostream &os, const BuildToolVersion &tool)

Utilities

bool LIEF::MachO::is_macho(const std::string &file)
bool LIEF::MachO::is_macho(const std::vector<uint8_t> &raw)
bool LIEF::MachO::is_fat(const std::string &file)

Check if the given Mach-O is fat.

bool LIEF::MachO::is_64(const std::string &file)

Check if the given Mach-O is 64-bits.


Enums

enum LIEF::MachO::MACHO_TYPES

Values:

MH_MAGIC = 0xFEEDFACEu

32-bit big-endian magic

MH_CIGAM = 0xCEFAEDFEu

32-bit little-endian magic

MH_MAGIC_64 = 0xFEEDFACFu

64-bit big-endian magic

MH_CIGAM_64 = 0xCFFAEDFEu

64-bit little-endian magic

FAT_MAGIC = 0xCAFEBABEu

big-endian fat magic

FAT_CIGAM = 0xBEBAFECAu

little-endian fat magic

enum LIEF::MachO::FILE_TYPES

Values:

MH_OBJECT = 0x1u
MH_EXECUTE = 0x2u
MH_FVMLIB = 0x3u
MH_CORE = 0x4u
MH_PRELOAD = 0x5u
MH_DYLIB = 0x6u
MH_DYLINKER = 0x7u
MH_BUNDLE = 0x8u
MH_DYLIB_STUB = 0x9u
MH_DSYM = 0xAu
MH_KEXT_BUNDLE = 0xBu
enum LIEF::MachO::HEADER_FLAGS

Values:

MH_NOUNDEFS = 0x00000001u
MH_INCRLINK = 0x00000002u
MH_DYLDLINK = 0x00000004u
MH_BINDATLOAD = 0x00000008u
MH_PREBOUND = 0x00000010u
MH_SPLIT_SEGS = 0x00000020u
MH_LAZY_INIT = 0x00000040u
MH_TWOLEVEL = 0x00000080u
MH_FORCE_FLAT = 0x00000100u
MH_NOMULTIDEFS = 0x00000200u
MH_NOFIXPREBINDING = 0x00000400u
MH_PREBINDABLE = 0x00000800u
MH_ALLMODSBOUND = 0x00001000u
MH_SUBSECTIONS_VIA_SYMBOLS = 0x00002000u
MH_CANONICAL = 0x00004000u
MH_WEAK_DEFINES = 0x00008000u
MH_BINDS_TO_WEAK = 0x00010000u
MH_ALLOW_STACK_EXECUTION = 0x00020000u
MH_ROOT_SAFE = 0x00040000u
MH_SETUID_SAFE = 0x00080000u
MH_NO_REEXPORTED_DYLIBS = 0x00100000u
MH_PIE = 0x00200000u
MH_DEAD_STRIPPABLE_DYLIB = 0x00400000u
MH_HAS_TLV_DESCRIPTORS = 0x00800000u
MH_NO_HEAP_EXECUTION = 0x01000000u
MH_APP_EXTENSION_SAFE = 0x02000000u
enum LIEF::MachO::LOAD_COMMAND_TYPES

Values:

LC_SEGMENT = 0x00000001u
LC_SYMTAB = 0x00000002u
LC_SYMSEG = 0x00000003u
LC_THREAD = 0x00000004u
LC_UNIXTHREAD = 0x00000005u
LC_LOADFVMLIB = 0x00000006u
LC_IDFVMLIB = 0x00000007u
LC_IDENT = 0x00000008u
LC_FVMFILE = 0x00000009u
LC_PREPAGE = 0x0000000Au
LC_DYSYMTAB = 0x0000000Bu
LC_LOAD_DYLIB = 0x0000000Cu
LC_ID_DYLIB = 0x0000000Du
LC_LOAD_DYLINKER = 0x0000000Eu
LC_ID_DYLINKER = 0x0000000Fu
LC_PREBOUND_DYLIB = 0x00000010u
LC_ROUTINES = 0x00000011u
LC_SUB_FRAMEWORK = 0x00000012u
LC_SUB_UMBRELLA = 0x00000013u
LC_SUB_CLIENT = 0x00000014u
LC_SUB_LIBRARY = 0x00000015u
LC_TWOLEVEL_HINTS = 0x00000016u
LC_PREBIND_CKSUM = 0x00000017u
LC_LOAD_WEAK_DYLIB = 0x80000018u
LC_SEGMENT_64 = 0x00000019u
LC_ROUTINES_64 = 0x0000001Au
LC_UUID = 0x0000001Bu
LC_RPATH = 0x8000001Cu
LC_CODE_SIGNATURE = 0x0000001Du
LC_SEGMENT_SPLIT_INFO = 0x0000001Eu
LC_REEXPORT_DYLIB = 0x8000001Fu
LC_LAZY_LOAD_DYLIB = 0x00000020u
LC_ENCRYPTION_INFO = 0x00000021u
LC_DYLD_INFO = 0x00000022u
LC_DYLD_INFO_ONLY = 0x80000022u
LC_LOAD_UPWARD_DYLIB = 0x80000023u
LC_VERSION_MIN_MACOSX = 0x00000024u
LC_VERSION_MIN_IPHONEOS = 0x00000025u
LC_FUNCTION_STARTS = 0x00000026u
LC_DYLD_ENVIRONMENT = 0x00000027u
LC_MAIN = 0x80000028u
LC_DATA_IN_CODE = 0x00000029u
LC_SOURCE_VERSION = 0x0000002Au
LC_DYLIB_CODE_SIGN_DRS = 0x0000002Bu
LC_ENCRYPTION_INFO_64 = 0x0000002Cu
LC_LINKER_OPTION = 0x0000002Du
LC_LINKER_OPTIMIZATION_HINT = 0x0000002Eu
LC_VERSION_MIN_TVOS = 0x0000002Fu
LC_VERSION_MIN_WATCHOS = 0x00000030u
LC_NOTE = 0x00000031u
LC_BUILD_VERSION = 0x00000032u
enum LIEF::MachO::MACHO_SEGMENTS_FLAGS

Values:

SG_HIGHVM = 0x1u

The file contents for this segment are for the high part of the virtual memory space; the low part is zero filled (for stacks in core files).

SG_FVMLIB = 0x2u

this segment is the VM that is allocated by a fixed VM library, for overlap checking in the link editor.

SG_NORELOC = 0x4u

This segment has nothing that was relocated in it and nothing relocated to it. It may be safely replaced without relocation.

SG_PROTECTED_VERSION_1 = 0x8u
enum LIEF::MachO::MACHO_SECTION_TYPES

These are the section type and attributes fields. A MachO section can have only one Type, but can have any of the attributes specified.

Values:

S_REGULAR = 0x00u

Regular section.

S_ZEROFILL = 0x01u

Zero fill on demand section.

S_CSTRING_LITERALS = 0x02u

Section with literal C strings.

S_4BYTE_LITERALS = 0x03u

Section with 4 byte literals.

S_8BYTE_LITERALS = 0x04u

Section with 8 byte literals.

S_LITERAL_POINTERS = 0x05u

Section with pointers to literals.

S_NON_LAZY_SYMBOL_POINTERS = 0x06u

Section with non-lazy symbol pointers.

S_LAZY_SYMBOL_POINTERS = 0x07u

Section with lazy symbol pointers.

S_SYMBOL_STUBS = 0x08u

Section with symbol stubs, byte size of stub in the Reserved2 field.

S_MOD_INIT_FUNC_POINTERS = 0x09u

Section with only function pointers for initialization.

S_MOD_TERM_FUNC_POINTERS = 0x0au

Section with only function pointers for termination.

S_COALESCED = 0x0bu

Section contains symbols that are to be coalesced.

S_GB_ZEROFILL = 0x0cu

Zero fill on demand section (that can be larger than 4 gigabytes).

S_INTERPOSING = 0x0du

Section with only pairs of function pointers for interposing.

S_16BYTE_LITERALS = 0x0eu

Section with only 16 byte literals.

S_DTRACE_DOF = 0x0fu

Section contains DTrace Object Format.

S_LAZY_DYLIB_SYMBOL_POINTERS = 0x10u

Section with lazy symbol pointers to lazy loaded dylibs.

S_THREAD_LOCAL_REGULAR = 0x11u

Thread local data section.

S_THREAD_LOCAL_ZEROFILL = 0x12u

Thread local zerofill section.

S_THREAD_LOCAL_VARIABLES = 0x13u

Section with thread local variable structure data.

S_THREAD_LOCAL_VARIABLE_POINTERS = 0x14u

Section with pointers to thread local structures.

S_THREAD_LOCAL_INIT_FUNCTION_POINTERS = 0x15u

Section with thread local variable initialization pointers to functions.

LAST_KNOWN_SECTION_TYPE = 0x15u
enum LIEF::MachO::MACHO_SECTION_FLAGS

Values:

S_ATTR_PURE_INSTRUCTIONS = 0x80000000u

Section contains only true machine instructions.

S_ATTR_NO_TOC = 0x40000000u

Section contains coalesced symbols that are not to be in a ranlib table of contents.

S_ATTR_STRIP_STATIC_SYMS = 0x20000000u

Ok to strip static symbols in this section in files with the MY_DYLDLINK flag.

S_ATTR_NO_DEAD_STRIP = 0x10000000u

No dead stripping.

S_ATTR_LIVE_SUPPORT = 0x08000000u

Blocks are live if they reference live blocks.

S_ATTR_SELF_MODIFYING_CODE = 0x04000000u

Used with i386 code stubs written on by dyld.

S_ATTR_DEBUG = 0x02000000u

A debug section.

S_ATTR_SOME_INSTRUCTIONS = 0x00000400u

Section contains some machine instructions.

S_ATTR_EXT_RELOC = 0x00000200u

Section has external relocation entries.

S_ATTR_LOC_RELOC = 0x00000100u

Section has local relocation entries.

INDIRECT_SYMBOL_LOCAL = 0x80000000u
INDIRECT_SYMBOL_ABS = 0x40000000u
enum LIEF::MachO::MACHO_SYMBOL_TYPES

Values:

N_STAB = 0xe0

The symbol is symbolic debugging table.

N_PEXT = 0x10

Limited global scope symbol.

N_TYPE = 0x0e

Define the type of the symbol.

See

N_LIST_TYPES

N_EXT = 0x01

External symbol, a symbol that is either defined outside this file or that is defined in this file but can be referenced by other files.

enum LIEF::MachO::SYMBOL_DESCRIPTIONS

Values:

REFERENCE_TYPE = 0x7
REFERENCE_FLAG_UNDEFINED_NON_LAZY = 0

Reference to an external non-lazy (data) symbol.

REFERENCE_FLAG_UNDEFINED_LAZY = 1

Reference to an external lazy symbol - that is, to a function call.

REFERENCE_FLAG_DEFINED = 2

Defined in this module.

REFERENCE_FLAG_PRIVATE_DEFINED = 3

Defined in this module and is visible only to modules within this shared library.

REFERENCE_FLAG_PRIVATE_UNDEFINED_NON_LAZY = 4

Defined in another module in this file, is a non-lazy (data) symbol, and is visible only to modules within this shared library.

REFERENCE_FLAG_PRIVATE_UNDEFINED_LAZY = 5

Defined in another module in this file, is a lazy (function) symbol, and is visible only to modules within this shared library.

N_ARM_THUMB_DEF = 0x0008u
REFERENCED_DYNAMICALLY = 0x0010u
N_NO_DEAD_STRIP = 0x0020u
N_WEAK_REF = 0x0040u
N_WEAK_DEF = 0x0080u
N_SYMBOL_RESOLVER = 0x0100u
N_ALT_ENTRY = 0x0200u
SELF_LIBRARY_ORDINAL = 0x0
MAX_LIBRARY_ORDINAL = 0xfd
DYNAMIC_LOOKUP_ORDINAL = 0xfe
EXECUTABLE_ORDINAL = 0xff
enum LIEF::MachO::X86_RELOCATION

Values:

GENERIC_RELOC_VANILLA = 0

A generic relocation entry for both addresses contained in data and addresses contained in CPU instructions.

GENERIC_RELOC_PAIR = 1

The second relocation entry of a pair.

GENERIC_RELOC_SECTDIFF = 2

A relocation entry for an item that contains the difference of two section addresses. This is generally used for position-independent code generation.

GENERIC_RELOC_PB_LA_PTR = 3

contains the address from which to subtract; it must be followed by a X86_RELOCATION::GENERIC_RELOC_PAIR containing the address to subtract.

GENERIC_RELOC_LOCAL_SECTDIFF = 4

Similar to X86_RELOCATION::GENERIC_RELOC_SECTDIFF except that this entry refers specifically to the address in this item. If the address is that of a globally visible coalesced symbol, this relocation entry does not change if the symbol is overridden. This is used to associate stack unwinding information with the object code this relocation entry describes.

GENERIC_RELOC_TLV = 5

A relocation entry for a prebound lazy pointer. This is always a scattered relocation entry. The value field contains the non-prebound value of the lazy pointer.

enum LIEF::MachO::X86_64_RELOCATION

Values:

X86_64_RELOC_UNSIGNED = 0

A CALL/JMP instruction with 32-bit displacement.

X86_64_RELOC_SIGNED = 1

A MOVQ load of a GOT entry.

X86_64_RELOC_BRANCH = 2

Other GOT references.

X86_64_RELOC_GOT_LOAD = 3

Signed 32-bit displacement.

X86_64_RELOC_GOT = 4

Absolute address.

X86_64_RELOC_SUBTRACTOR = 5

Must be followed by a X86_64_RELOCATION::X86_64_RELOC_UNSIGNED relocation.

X86_64_RELOC_SIGNED_1 = 6
X86_64_RELOC_SIGNED_2 = 7
X86_64_RELOC_SIGNED_4 = 8
X86_64_RELOC_TLV = 9
enum LIEF::MachO::PPC_RELOCATION

Values:

PPC_RELOC_VANILLA = 0
PPC_RELOC_PAIR = 1
PPC_RELOC_BR14 = 2
PPC_RELOC_BR24 = 3
PPC_RELOC_HI16 = 4
PPC_RELOC_LO16 = 5
PPC_RELOC_HA16 = 6
PPC_RELOC_LO14 = 7
PPC_RELOC_SECTDIFF = 8
PPC_RELOC_PB_LA_PTR = 9
PPC_RELOC_HI16_SECTDIFF = 10
PPC_RELOC_LO16_SECTDIFF = 11
PPC_RELOC_HA16_SECTDIFF = 12
PPC_RELOC_JBSR = 13
PPC_RELOC_LO14_SECTDIFF = 14
PPC_RELOC_LOCAL_SECTDIFF = 15
enum LIEF::MachO::ARM_RELOCATION

Values:

ARM_RELOC_VANILLA = 0
ARM_RELOC_PAIR = 1
ARM_RELOC_SECTDIFF = 2
ARM_RELOC_LOCAL_SECTDIFF = 3
ARM_RELOC_PB_LA_PTR = 4
ARM_RELOC_BR24 = 5
ARM_THUMB_RELOC_BR22 = 6
ARM_THUMB_32BIT_BRANCH = 7
ARM_RELOC_HALF = 8
ARM_RELOC_HALF_SECTDIFF = 9
enum LIEF::MachO::ARM64_RELOCATION

Values:

ARM64_RELOC_UNSIGNED = 0

For pointers.

ARM64_RELOC_SUBTRACTOR = 1

Must be followed by an ARM64_RELOCATION::ARM64_RELOC_UNSIGNED

ARM64_RELOC_BRANCH26 = 2

A B/BL instruction with 26-bit displacement.

ARM64_RELOC_PAGE21 = 3

PC-rel distance to page of target.

ARM64_RELOC_PAGEOFF12 = 4

Offset within page, scaled by size .

ARM64_RELOC_GOT_LOAD_PAGE21 = 5

PC-rel distance to page of GOT slot

ARM64_RELOC_GOT_LOAD_PAGEOFF12 = 6

Offset within page of GOT slot, scaled by size .

ARM64_RELOC_POINTER_TO_GOT = 7

For pointers to GOT slots.

ARM64_RELOC_TLVP_LOAD_PAGE21 = 8

PC-rel distance to page of TLVP slot.

ARM64_RELOC_TLVP_LOAD_PAGEOFF12 = 9

Offset within page of TLVP slot, scaled by size .

ARM64_RELOC_ADDEND = 10

Must be followed by ARM64_RELOCATION::ARM64_RELOC_PAGE21 or ARM64_RELOCATION::ARM64_RELOC_PAGEOFF12.

enum LIEF::MachO::CPU_TYPES

Values:

CPU_TYPE_ANY = -1
CPU_TYPE_X86 = 7
CPU_TYPE_I386 = 7
CPU_TYPE_X86_64 = 7 | 0x01000000
CPU_TYPE_MC98000 = 10
CPU_TYPE_ARM = 12
CPU_TYPE_ARM64 = 12 | 0x01000000
CPU_TYPE_SPARC = 14
CPU_TYPE_POWERPC = 18
CPU_TYPE_POWERPC64 = 18 | 0x01000000
enum LIEF::MachO::CPU_SUBTYPES_X86

Values:

CPU_SUBTYPE_I386_ALL = 3
CPU_SUBTYPE_386 = 3
CPU_SUBTYPE_486 = 4
CPU_SUBTYPE_486SX = 0x84
CPU_SUBTYPE_586 = 5
CPU_SUBTYPE_PENT = 5
CPU_SUBTYPE_PENTPRO = 0x16
CPU_SUBTYPE_PENTII_M3 = 0x36
CPU_SUBTYPE_PENTII_M5 = 0x56
CPU_SUBTYPE_CELERON = 0x67
CPU_SUBTYPE_CELERON_MOBILE = 0x77
CPU_SUBTYPE_PENTIUM_3 = 0x08
CPU_SUBTYPE_PENTIUM_3_M = 0x18
CPU_SUBTYPE_PENTIUM_3_XEON = 0x28
CPU_SUBTYPE_PENTIUM_M = 0x09
CPU_SUBTYPE_PENTIUM_4 = 0x0a
CPU_SUBTYPE_PENTIUM_4_M = 0x1a
CPU_SUBTYPE_ITANIUM = 0x0b
CPU_SUBTYPE_ITANIUM_2 = 0x1b
CPU_SUBTYPE_XEON = 0x0c
CPU_SUBTYPE_XEON_MP = 0x1c
CPU_SUBTYPE_X86_ALL = 3
CPU_SUBTYPE_X86_64_ALL = 3
CPU_SUBTYPE_X86_ARCH1 = 4
CPU_SUBTYPE_X86_64_H = 8
enum LIEF::MachO::RELOCATION_ORIGINS

Values:

ORIGIN_UNKNOWN = 0
ORIGIN_DYLDINFO = 1
ORIGIN_RELOC_TABLE = 2
enum LIEF::MachO::REBASE_TYPES

Values:

REBASE_TYPE_POINTER = 1u
REBASE_TYPE_TEXT_ABSOLUTE32 = 2u
REBASE_TYPE_TEXT_PCREL32 = 3u
enum LIEF::MachO::BINDING_CLASS

Within the dyld_info_command there are differents area of binding. These enums tag these area.

Values:

BIND_CLASS_WEAK = 1u
BIND_CLASS_LAZY = 2u
BIND_CLASS_STANDARD = 3u
enum LIEF::MachO::REBASE_OPCODES

Opcodes used by Dyld info to rebase a Mach-O image.

Values:

REBASE_OPCODE_DONE = 0x00u

It’s finished.

REBASE_OPCODE_SET_TYPE_IMM = 0x10u

Set type to immediate (lower 4-bits). Used for ordinal numbers from 0-15.

REBASE_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB = 0x20u

Set segment’s index to immediate (lower 4-bits) and segment’s offset to following ULEB128 encoding.

REBASE_OPCODE_ADD_ADDR_ULEB = 0x30u

Add segment’s offset with the following ULEB128 encoding.

REBASE_OPCODE_ADD_ADDR_IMM_SCALED = 0x40u

Add segment’s offset with immediate scaling.

REBASE_OPCODE_DO_REBASE_IMM_TIMES = 0x50u

Rebase in the range of [segment's offset; segment's offset + immediate * sizeof(ptr)]

REBASE_OPCODE_DO_REBASE_ULEB_TIMES = 0x60u

Same as REBASE_OPCODE_DO_REBASE_IMM_TIMES but immediate is replaced with ULEB128 value.

REBASE_OPCODE_DO_REBASE_ADD_ADDR_ULEB = 0x70u

Rebase and increment segment’s offset with following ULEB128 encoding + pointer’s size.

REBASE_OPCODE_DO_REBASE_ULEB_TIMES_SKIPPING_ULEB = 0x80u

Rebase and skip several bytes.

enum LIEF::MachO::BIND_TYPES

Values:

BIND_TYPE_POINTER = 1u
BIND_TYPE_TEXT_ABSOLUTE32 = 2u
BIND_TYPE_TEXT_PCREL32 = 3u
enum LIEF::MachO::BIND_SPECIAL_DYLIB

Values:

BIND_SPECIAL_DYLIB_SELF = 0
BIND_SPECIAL_DYLIB_MAIN_EXECUTABLE = -1
BIND_SPECIAL_DYLIB_FLAT_LOOKUP = -2
enum LIEF::MachO::BIND_OPCODES

Opcodes used by Dyld info to bind symbols.

Values:

BIND_OPCODE_DONE = 0x00u

It’s finished.

BIND_OPCODE_SET_DYLIB_ORDINAL_IMM = 0x10u

Set ordinal to immediate (lower 4-bits). Used for ordinal numbers from 0-15.

BIND_OPCODE_SET_DYLIB_ORDINAL_ULEB = 0x20u

Set ordinal to following ULEB128 encoding. Used for ordinal numbers from 16+.

BIND_OPCODE_SET_DYLIB_SPECIAL_IMM = 0x30u

Set ordinal, with 0 or negative number as immediate. the value is sign extended.

BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM = 0x40u

Set the following symbol (NULL-terminated char*).

BIND_OPCODE_SET_TYPE_IMM = 0x50u

Set the type to immediate (lower 4-bits). See BIND_TYPES.

BIND_OPCODE_SET_ADDEND_SLEB = 0x60u

Set the addend field to the following SLEB128 encoding.

BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB = 0x70u

Set Segment to immediate value, and address to the following SLEB128 encoding.

BIND_OPCODE_ADD_ADDR_ULEB = 0x80u

Set the address field to the following SLEB128 encoding.

BIND_OPCODE_DO_BIND = 0x90u

Perform binding of current table row.

BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB = 0xA0u

Perform binding, also add following ULEB128 as address.

BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED = 0xB0u

Perform binding, also add immediate (lower 4-bits) using scaling.

BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB = 0xC0u

Perform binding for several symbols (as following ULEB128), and skip several bytes.

enum LIEF::MachO::EXPORT_SYMBOL_KINDS

Values:

EXPORT_SYMBOL_FLAGS_KIND_REGULAR = 0x00u
EXPORT_SYMBOL_FLAGS_KIND_THREAD_LOCAL = 0x01u
EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE = 0x02u
enum LIEF::MachO::EXPORT_SYMBOL_FLAGS

Values:

EXPORT_SYMBOL_FLAGS_KIND_MASK = 0x03u

Mask to access to EXPORT_SYMBOL_KINDS.

EXPORT_SYMBOL_FLAGS_WEAK_DEFINITION = 0x04u
EXPORT_SYMBOL_FLAGS_REEXPORT = 0x08u
EXPORT_SYMBOL_FLAGS_STUB_AND_RESOLVER = 0x10u
enum LIEF::MachO::VM_PROTECTIONS

Values for segment_command.initprot. From <mach/vm_prot.h>

Values:

VM_PROT_READ = 0x1

Reading data within the segment is allowed.

VM_PROT_WRITE = 0x2

Writing data within the segment is allowed.

VM_PROT_EXECUTE = 0x4

Executing data within the segment is allowed.

enum LIEF::MachO::SYMBOL_ORIGINS

Values:

SYM_ORIGIN_UNKNOWN = 0
SYM_ORIGIN_DYLD_EXPORT = 1
SYM_ORIGIN_LC_SYMTAB = 2