MachO

Parsers

class LIEF::MachO::Parser : public LIEF::Parser

Public Functions

Parser &operator=(const Parser &copy) = delete
Parser(const Parser &copy) = delete
~Parser(void)

Public Static Functions

std::unique_ptr<FatBinary> parse(const std::string &filename, const ParserConfig &conf = ParserConfig::deep())
std::unique_ptr<FatBinary> parse(const std::vector<uint8_t> &data, const std::string &name = "", const ParserConfig &conf = ParserConfig::deep())
class LIEF::MachO::BinaryParser : public LIEF::Parser

Class used to parse single binary (i.e. not FAT)

See

MachO::Parser

Public Functions

BinaryParser(const std::string &file, const ParserConfig &conf = ParserConfig::deep())
BinaryParser(const std::vector<uint8_t> &data, uint64_t fat_offset = 0, const ParserConfig &conf = ParserConfig::deep())
BinaryParser(void)
BinaryParser &operator=(const BinaryParser &copy) = delete
BinaryParser(const BinaryParser &copy) = delete
~BinaryParser(void)
Binary *get_binary(void)

Friends

friend class MachO::Parser
class LIEF::MachO::ParserConfig

Public Functions

ParserConfig(void)
ParserConfig &operator=(const ParserConfig&)
ParserConfig(const ParserConfig&)
~ParserConfig(void)
ParserConfig &parse_dyldinfo_deeply(bool flag)

If flag is set to true, Exports, Bindings and Rebases opcodes are parsed.

Warning

Enabling this flag can slow down the parsing

bool parse_dyldinfo_deeply(void) const

Whether or not bindings, exports, and rebases are parsed.

Public Static Functions

ParserConfig deep(void)

Return a configuration so that the all objects supported by LIEF are parsed.

With this configuration:

  • parse_dyldinfo_deeply is set to true

ParserConfig quick(void)

Return a configuration so that the parsing is quick

With this configuration:

  • parse_dyldinfo_deeply is set to false


FatBinary

class LIEF::MachO::FatBinary

Public Functions

FatBinary(const FatBinary&) = delete
~FatBinary(void)
size_t size(void) const

Number of binary registred.

it_binaries begin(void)
it_const_binaries begin(void) const
it_binaries end(void)
it_const_binaries end(void) const
Binary *pop_back(void)
Binary &at(size_t index)
const Binary &at(size_t index) const
Binary &back(void)
const Binary &back(void) const
Binary &operator[](size_t index)
const Binary &operator[](size_t index) const
void write(const std::string &filename)

Reconstruct the Fat binary object and write it in filename

Parameters
  • filename: Path to write the reconstructed binary

std::vector<uint8_t> raw(void)

Reconstruct the Fat binary object and return his content as bytes.

Friends

friend class LIEF::Parser
friend std::ostream &operator<<(std::ostream &os, const FatBinary &fatbinary)

Binary

class LIEF::MachO::Binary : public LIEF::Binary

Class which represent a MachO binary.

Public Types

using range_t = std::pair<uint64_t, uint64_t>

Public Functions

Binary(const Binary&) = delete
Header &header(void)

Return a reference to MachO::Header.

const Header &header(void) const
it_commands commands(void)

Return binary’s load commands .

it_const_commands commands(void) const
it_symbols symbols(void)

Return binary’s symbols .

it_const_symbols symbols(void) const
bool has_symbol(const std::string &name) const

If a symbol with the given name exists.

const Symbol &get_symbol(const std::string &name) const

Return Symbol from the given name.

Symbol &get_symbol(const std::string &name)
it_exported_symbols exported_symbols(void)

Return binary’s exported symbols.

it_const_exported_symbols exported_symbols(void) const
it_imported_symbols imported_symbols(void)

Return binary’s imported symbols.

it_const_imported_symbols imported_symbols(void) const
it_libraries libraries(void)

Return binary imported libraries (MachO::DylibCommand)

it_const_libraries libraries(void) const
it_segments segments(void)

Return binary’s segments .

it_const_segments segments(void) const
it_sections sections(void)

Return binary’s sections .

it_const_sections sections(void) const
it_relocations relocations(void)

Return binary’s relocations .

it_const_relocations relocations(void) const
void write(const std::string &filename) override

Reconstruct the binary object and write it in filename

Parameters
  • filename: Path to write the reconstructed binary

std::vector<uint8_t> raw(void)

Reconstruct the binary object and return his content as bytes.

bool has(LOAD_COMMAND_TYPES type) const

Check if the current binary has the given MachO::LOAD_COMMAND_TYPES.

const LoadCommand &get(LOAD_COMMAND_TYPES type) const
LoadCommand &get(LOAD_COMMAND_TYPES type)
LoadCommand &add(const LoadCommand &command)

Insert the new Load Command.

LoadCommand &add(const LoadCommand &command, size_t index)

Insert the new Load command at index

LoadCommand &add(const DylibCommand &library)

Insert the given DylibCommand.

LoadCommand &add(const SegmentCommand &segment)

Add a new LC_SEGMENT command.

LoadCommand &add_library(const std::string &name)

Insert a new shared library through a LC_LOAD_DYLIBcommand.

Section *add_section(const Section &section)

Add section in the __TEXT segment.

Section *add_section(const SegmentCommand &segment, const Section &section)

Add a section in the given MachO::SegmentCommand.

Warning

This method may corrupt the file if the segment is not the first one or the last one

void remove_section(const std::string &name, bool clear = false) override
bool remove(const LoadCommand &command)

Remove the given command.

bool remove(LOAD_COMMAND_TYPES type)

Remove all Load Command with the given type (MachO::LOAD_COMMAND_TYPES)

bool remove_command(size_t index)

Remove the Load Command at index

bool remove_signature(void)

Remove the LC_SIGNATURE command.

bool extend(const LoadCommand &command, uint64_t size)

Extend the size of the Load command.

bool extend_segment(const SegmentCommand &segment, size_t size)

Extend the content of the Segment.

bool disable_pie(void)

Remove PIE flag.

uint64_t imagebase(void) const

Return binary’s imagebase. 0 if not relevant.

const std::string &loader(void) const

Return binary’s loader (e.g. /usr/lib/dyld)

bool has_section(const std::string &name) const

Check if a section with the given name exists.

Section &get_section(const std::string &name)

Return the section from the given name.

const Section &get_section(const std::string &name) const

Return the section from the given name.

bool has_segment(const std::string &name) const

Check if a segment with the given name exists.

const SegmentCommand *get_segment(const std::string &name) const

Return the segment from the given name.

SegmentCommand *get_segment(const std::string &name)
bool remove_symbol(const std::string &name)

Remove symbol with the given name.

bool remove(const Symbol &sym)

Remove the given symbol.

bool can_remove(const Symbol &sym) const

Check if the given symbol can be safely removed.

bool can_remove_symbol(const std::string &name) const
bool unexport(const std::string &name)

Remove the given symbol from the export table.

bool unexport(const Symbol &sym)

Remove the given symbol from the export table.

Section *section_from_offset(uint64_t offset)

Return binary’s section which holds the offset

const Section *section_from_offset(uint64_t offset) const
Section *section_from_virtual_address(uint64_t virtual_address)

Return binary’s section which holds the given virtual address

const Section *section_from_virtual_address(uint64_t virtual_address) const
uint64_t virtual_address_to_offset(uint64_t virtualAddress) const

Convert a virtual address to an offset in the file.

SegmentCommand *segment_from_offset(uint64_t offset)
const SegmentCommand *segment_from_offset(uint64_t offset) const
size_t segment_index(const SegmentCommand &segment) const

Return the index of the given segment;.

uint64_t fat_offset(void) const

Return binary’s fat offset. 0 if not relevant.

SegmentCommand *segment_from_virtual_address(uint64_t virtual_address)
const SegmentCommand *segment_from_virtual_address(uint64_t virtual_address) const
range_t va_ranges(void) const

Return the range of virtual addresses.

range_t off_ranges(void) const

Return the range of offsets.

bool is_valid_addr(uint64_t address) const

Check if the given address is comprise between the lowest virtual address and the biggest one

void accept(LIEF::Visitor &visitor) const override

Method so that the visitor can visit us.

~Binary(void)
std::ostream &print(std::ostream &os) const override
void patch_address(uint64_t address, const std::vector<uint8_t> &patch_value, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the content at virtual address address with patch_value

Parameters
  • [in] address: Address to patch

  • [in] patch_value: Patch to apply

void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the address with the given value

Parameters
  • [in] address: Address to patch

  • [in] patch_value: Patch to apply

  • [in] size: Size of the value in bytes (1, 2, … 8)

std::vector<uint8_t> get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) const override

Return the content located at virtual address.

uint64_t entrypoint(void) const override

Binary’s entrypoint (if any)

bool is_pie(void) const override

Check if the binary is position independent.

bool has_nx(void) const override

Check if the binary uses NX protection.

bool has_entrypoint(void) const

true if the binary has an entrypoint.

Basically for libraries it will return false

bool has_uuid(void) const

true if the binary has a MachO::UUIDCommand command.

UUIDCommand &uuid(void)

Return the MachO::UUIDCommand.

const UUIDCommand &uuid(void) const
bool has_main_command(void) const

true if the binary has a MachO::MainCommand command.

MainCommand &main_command(void)

Return the MachO::MainCommand.

const MainCommand &main_command(void) const
bool has_dylinker(void) const

true if the binary has a MachO::DylinkerCommand.

DylinkerCommand &dylinker(void)

Return the MachO::DylinkerCommand.

const DylinkerCommand &dylinker(void) const
bool has_dyld_info(void) const

true if the binary has a MachO::DyldInfo command.

DyldInfo &dyld_info(void)

Return the MachO::Dyld command.

const DyldInfo &dyld_info(void) const
bool has_function_starts(void) const

true if the binary has a MachO::FunctionStarts command.

FunctionStarts &function_starts(void)

Return the MachO::FunctionStarts command.

const FunctionStarts &function_starts(void) const
bool has_source_version(void) const

true if the binary has a MachO::SourceVersion command.

SourceVersion &source_version(void)

Return the MachO::SourceVersion command.

const SourceVersion &source_version(void) const
bool has_version_min(void) const

true if the binary has a MachO::VersionMin command.

VersionMin &version_min(void)

Return the MachO::VersionMin command.

const VersionMin &version_min(void) const
bool has_thread_command(void) const

true if the binary has a MachO::ThreadCommand command.

ThreadCommand &thread_command(void)

Return the MachO::ThreadCommand command.

const ThreadCommand &thread_command(void) const
bool has_rpath(void) const

true if the binary has a MachO::RPathCommand command.

RPathCommand &rpath(void)

Return the MachO::RPathCommand command.

const RPathCommand &rpath(void) const
bool has_symbol_command(void) const

true if the binary has a MachO::SymbolCommand command.

SymbolCommand &symbol_command(void)

Return the MachO::SymbolCommand.

const SymbolCommand &symbol_command(void) const
bool has_dynamic_symbol_command(void) const

true if the binary has a MachO::DynamicSymbolCommand command.

DynamicSymbolCommand &dynamic_symbol_command(void)

Return the MachO::SymbolCommand.

const DynamicSymbolCommand &dynamic_symbol_command(void) const
bool has_code_signature(void) const

true if the binary is signed.

CodeSignature &code_signature(void)

Return the MachO::Signature.

const CodeSignature &code_signature(void) const
bool has_data_in_code(void) const

true if the binaryhas a MachO::DataInCode command.

DataInCode &data_in_code(void)

Return the MachO::Signature.

const DataInCode &data_in_code(void) const
bool has_segment_split_info(void) const

true if the binary has segment split info.

SegmentSplitInfo &segment_split_info(void)

Return the MachO::SegmentSplitInfo.

const SegmentSplitInfo &segment_split_info(void) const
bool has_sub_framework(void) const

true if the binary has a sub framework command.

bool has_encryption_info(void) const

true if the binary has Encryption Info.

EncryptionInfo &encryption_info(void)

Return the MachO::DyldEnvironment.

const EncryptionInfo &encryption_info(void) const
SubFramework &sub_framework(void)

Return the MachO::SubFramework.

const SubFramework &sub_framework(void) const
bool has_dyld_environment(void) const

true if the binary has Dyld envrionment variables.

DyldEnvironment &dyld_environment(void)

Return the MachO::DyldEnvironment.

const DyldEnvironment &dyld_environment(void) const
bool has_build_version(void) const

true if the binary has Build Version command.

BuildVersion &build_version(void)

Return the MachO::BuildVersion.

const BuildVersion &build_version(void) const
template<class T>
bool has_command(void) const
template<class T>
T &command(void)
template<class T>
const T &command(void) const
template<class T>
size_t count_commands(void) const
LoadCommand &operator[](LOAD_COMMAND_TYPES type)
const LoadCommand &operator[](LOAD_COMMAND_TYPES type) const
LIEF::Binary::functions_t ctor_functions(void) const override

Constructor functions that are called prior any other functions.

LIEF::Binary::functions_t functions(void) const
LIEF::Binary::functions_t unwind_functions(void) const

Public Static Functions

bool is_exported(const Symbol &symbol)

Check if the given symbol is an exported one.

bool is_imported(const Symbol &symbol)

Check if the given symbol is an imported one.



Builder

class LIEF::MachO::Builder

Public Functions

Builder(Binary *binary)
Builder(std::vector<Binary*> binaries)
Builder(FatBinary *fat)
Builder(void) = delete
~Builder(void)
std::vector<uint8_t> operator()(void)
void build(void)
const std::vector<uint8_t> &get_build(void)
void write(const std::string &filename) const

Public Static Functions

void write(Binary *binary, const std::string &filename)
void write(FatBinary *fatbinary, const std::string &filename)

DylibCommand

class LIEF::MachO::DylibCommand : public LIEF::MachO::LoadCommand

Public Types

using version_t = std::array<uint16_t, 3>

Public Functions

DylibCommand(void)
DylibCommand(const dylib_command *cmd)
DylibCommand &operator=(const DylibCommand &copy)
DylibCommand(const DylibCommand &copy)
~DylibCommand(void)
DylibCommand *clone(void) const override
const std::string &name(void) const

Library name.

uint32_t timestamp(void) const

Date and Time when the shared library was built.

version_t current_version(void) const

Current version of the shared library.

version_t compatibility_version(void) const

Compatibility version of the shared library.

void name(const std::string &name)
void timestamp(uint32_t timestamp)
void current_version(version_t currentVersion)
void compatibility_version(version_t compatibilityVersion)
std::ostream &print(std::ostream &os) const override
bool operator==(const DylibCommand &rhs) const
bool operator!=(const DylibCommand &rhs) const
void accept(Visitor &visitor) const override

Public Static Functions

version_t int2version(uint32_t version)

Helper to convert an integer into a version array.

uint32_t version2int(version_t version)

Helper to convert a version array into an integer.

DylibCommand weak_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_LOAD_WEAK_DYLIB library.

DylibCommand id_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_ID_DYLIB library.

DylibCommand load_dylib(const std::string &name, uint32_t timestamp = 2, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_LOAD_DYLIB library.

DylibCommand reexport_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_REEXPORT_DYLIB library.

DylibCommand load_upward_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_LOAD_UPWARD_DYLIB library.

DylibCommand lazy_load_dylib(const std::string &name, uint32_t timestamp = 0, uint32_t current_version = 0, uint32_t compat_version = 0)

Factory function to generate a LC_LAZY_LOAD_DYLIB library.


DylinkerCommand

class LIEF::MachO::DylinkerCommand : public LIEF::MachO::LoadCommand

Public Functions

DylinkerCommand(void)
DylinkerCommand(const dylinker_command *cmd)
DylinkerCommand &operator=(const DylinkerCommand &copy)
DylinkerCommand(const DylinkerCommand &copy)
DylinkerCommand *clone(void) const override
~DylinkerCommand(void)
std::ostream &print(std::ostream &os) const override
const std::string &name(void) const
void name(const std::string &name)
bool operator==(const DylinkerCommand &rhs) const
bool operator!=(const DylinkerCommand &rhs) const
void accept(Visitor &visitor) const override

DynamicSymbolCommand

class LIEF::MachO::DynamicSymbolCommand : public LIEF::MachO::LoadCommand

Public Functions

DynamicSymbolCommand(void)
DynamicSymbolCommand(const dysymtab_command *cmd)
DynamicSymbolCommand &operator=(const DynamicSymbolCommand &copy)
DynamicSymbolCommand(const DynamicSymbolCommand &copy)
DynamicSymbolCommand *clone(void) const override
~DynamicSymbolCommand(void)
void accept(Visitor &visitor) const override
bool operator==(const DynamicSymbolCommand &rhs) const
bool operator!=(const DynamicSymbolCommand &rhs) const
std::ostream &print(std::ostream &os) const override
uint32_t idx_local_symbol(void) const

Index of the first symbol in the group of local symbols.

uint32_t nb_local_symbols(void) const

Number of symbols in the group of local symbols.

uint32_t idx_external_define_symbol(void) const

Index of the first symbol in the group of defined external symbols.

uint32_t nb_external_define_symbols(void) const

Number of symbols in the group of defined external symbols.

uint32_t idx_undefined_symbol(void) const

Index of the first symbol in the group of undefined external symbols.

uint32_t nb_undefined_symbols(void) const

Number of symbols in the group of undefined external symbols.

uint32_t toc_offset(void) const

Byte offset from the start of the file to the table of contents data

Table of content is used by legacy Mach-O loader and this field should be set to 0

uint32_t nb_toc(void) const

Number of entries in the table of contents.

Should be set to 0 on recent Mach-O

uint32_t module_table_offset(void) const

Byte offset from the start of the file to the module table data.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t nb_module_table(void) const

Number of entries in the module table.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t external_reference_symbol_offset(void) const

Byte offset from the start of the file to the external reference table data.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t nb_external_reference_symbols(void) const

Number of entries in the external reference table

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t indirect_symbol_offset(void) const

Byte offset from the start of the file to the indirect symbol table data.

Indirect symbol table is used by the loader to speed-up symbol resolution during the lazy binding process

References:

  • dyld-519.2.1/src/ImageLoaderMachOCompressed.cpp

  • dyld-519.2.1/src/ImageLoaderMachOClassic.cpp

uint32_t nb_indirect_symbols(void) const

Number of entries in the indirect symbol table.

See

indirect_symbol_offset

uint32_t external_relocation_offset(void) const

Byte offset from the start of the file to the external relocation table data.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t nb_external_relocations(void) const

Number of entries in the external relocation table.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t local_relocation_offset(void) const

Byte offset from the start of the file to the local relocation table data.

This field seems unused by recent Mach-O loader and should be set to 0

uint32_t nb_local_relocations(void) const

Number of entries in the local relocation table.

This field seems unused by recent Mach-O loader and should be set to 0

void idx_local_symbol(uint32_t value)
void nb_local_symbols(uint32_t value)
void idx_external_define_symbol(uint32_t value)
void nb_external_define_symbols(uint32_t value)
void idx_undefined_symbol(uint32_t value)
void nb_undefined_symbols(uint32_t value)
void toc_offset(uint32_t value)
void nb_toc(uint32_t value)
void module_table_offset(uint32_t value)
void nb_module_table(uint32_t value)
void external_reference_symbol_offset(uint32_t value)
void nb_external_reference_symbols(uint32_t value)
void indirect_symbol_offset(uint32_t value)
void nb_indirect_symbols(uint32_t value)
void external_relocation_offset(uint32_t value)
void nb_external_relocations(uint32_t value)
void local_relocation_offset(uint32_t value)
void nb_local_relocations(uint32_t value)

LoadCommand

class LIEF::MachO::LoadCommand : public LIEF::Object

Subclassed by LIEF::MachO::BuildVersion, LIEF::MachO::CodeSignature, LIEF::MachO::DataInCode, LIEF::MachO::DyldEnvironment, LIEF::MachO::DyldInfo, LIEF::MachO::DylibCommand, LIEF::MachO::DylinkerCommand, LIEF::MachO::DynamicSymbolCommand, LIEF::MachO::EncryptionInfo, LIEF::MachO::FunctionStarts, LIEF::MachO::MainCommand, LIEF::MachO::RPathCommand, LIEF::MachO::SegmentCommand, LIEF::MachO::SegmentSplitInfo, LIEF::MachO::SourceVersion, LIEF::MachO::SubFramework, LIEF::MachO::SymbolCommand, LIEF::MachO::ThreadCommand, LIEF::MachO::UUIDCommand, LIEF::MachO::VersionMin

Public Types

using raw_t = std::vector<uint8_t>

Public Functions

LoadCommand(void)
LoadCommand(const load_command *command)
LoadCommand(LOAD_COMMAND_TYPES type, uint32_t size)
LoadCommand &operator=(LoadCommand copy)
LoadCommand(const LoadCommand &copy)
void swap(LoadCommand &other)
LoadCommand *clone(void) const
~LoadCommand(void)
LOAD_COMMAND_TYPES command(void) const

Command type.

uint32_t size(void) const

Size of the command (should be greather than sizeof(load_command))

const raw_t &data(void) const

Raw command.

uint64_t command_offset(void) const

Offset of the command within the Load Command Table

void data(const raw_t &data)
void command(LOAD_COMMAND_TYPES command)
void size(uint32_t size)
void command_offset(uint64_t offset)
std::ostream &print(std::ostream &os) const
bool operator==(const LoadCommand &rhs) const
bool operator!=(const LoadCommand &rhs) const
void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const LoadCommand &cmd)

MainCommand

class LIEF::MachO::MainCommand : public LIEF::MachO::LoadCommand

Public Functions

MainCommand(void)
MainCommand(const entry_point_command *cmd)
MainCommand &operator=(const MainCommand &copy)
MainCommand(const MainCommand &copy)
MainCommand *clone(void) const override
~MainCommand(void)
uint64_t entrypoint(void) const
uint64_t stack_size(void) const
void entrypoint(uint64_t entrypoint)
void stack_size(uint64_t stacksize)
bool operator==(const MainCommand &rhs) const
bool operator!=(const MainCommand &rhs) const
std::ostream &print(std::ostream &os) const override
void accept(Visitor &visitor) const override

Section

class LIEF::MachO::Section : public LIEF::Section

Public Types

using content_t = std::vector<uint8_t>
using flag_list_t = std::set<MACHO_SECTION_FLAGS>

Public Functions

Section(void)
Section(const section_32 *sectionCmd)
Section(const section_64 *sectionCmd)
Section(const std::string &name)
Section(const std::string &name, const content_t &content)
Section &operator=(Section copy)
Section(const Section &copy)
void swap(Section &other)
~Section(void)
content_t content(void) const override

section’s content

void content(const content_t &data) override

Set section content.

const std::string &segment_name(void) const

Return the name of the segment holding this section.

uint64_t address(void) const

See

virtual_address

uint32_t alignment(void) const
uint32_t relocation_offset(void) const
uint32_t numberof_relocations(void) const
uint32_t flags(void) const
MACHO_SECTION_TYPES type(void) const
uint32_t reserved1(void) const
uint32_t reserved2(void) const
uint32_t reserved3(void) const
flag_list_t flags_list(void) const
uint32_t raw_flags(void) const
bool has_segment(void) const
SegmentCommand &segment(void)
const SegmentCommand &segment(void) const
void clear(uint8_t v)
it_relocations relocations(void)
it_const_relocations relocations(void) const
void segment_name(const std::string &name)
void address(uint64_t address)
void alignment(uint32_t align)
void relocation_offset(uint32_t relocOffset)
void numberof_relocations(uint32_t nbReloc)
void flags(uint32_t flags)
void flags(flag_list_t flags)
void type(MACHO_SECTION_TYPES type)
void reserved1(uint32_t reserved1)
void reserved2(uint32_t reserved2)
void reserved3(uint32_t reserved3)
bool has(MACHO_SECTION_FLAGS flag) const
void add(MACHO_SECTION_FLAGS flag)
void remove(MACHO_SECTION_FLAGS flag)
Section &operator+=(MACHO_SECTION_FLAGS flag)
Section &operator-=(MACHO_SECTION_FLAGS flag)
void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

bool operator==(const Section &rhs) const
bool operator!=(const Section &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const Section &section)

Symbol

class LIEF::MachO::Symbol : public LIEF::Symbol

Public Functions

Symbol(void)
Symbol(const nlist_32 *cmd)
Symbol(const nlist_64 *cmd)
Symbol &operator=(Symbol other)
Symbol(const Symbol &other)
void swap(Symbol &other)
~Symbol(void)
uint8_t type(void) const
uint8_t numberof_sections(void) const
uint16_t description(void) const
bool has_export_info(void) const
const ExportInfo &export_info(void) const
ExportInfo &export_info(void)
bool has_binding_info(void) const
const BindingInfo &binding_info(void) const
BindingInfo &binding_info(void)
std::string demangled_name(void) const
void type(uint8_t type)
void numberof_sections(uint8_t nbsections)
void description(uint16_t desc)
bool is_external(void) const
const DylibCommand *library(void) const
DylibCommand *library(void)
SYMBOL_ORIGINS origin(void) const
void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

bool operator==(const Symbol &rhs) const
bool operator!=(const Symbol &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const Symbol &symbol)

SymbolCommand

class LIEF::MachO::SymbolCommand : public LIEF::MachO::LoadCommand

Public Functions

SymbolCommand(void)
SymbolCommand(const symtab_command *command)
SymbolCommand &operator=(const SymbolCommand &copy)
SymbolCommand(const SymbolCommand &copy)
SymbolCommand *clone(void) const override
~SymbolCommand(void)
uint32_t symbol_offset(void) const

Offset from the start of the file to the n_list associated with the command.

uint32_t numberof_symbols(void) const

Number of symbols registered.

uint32_t strings_offset(void) const

Offset from the start of the file to the string table.

uint32_t strings_size(void) const

Size of the size string table.

void symbol_offset(uint32_t offset)
void numberof_symbols(uint32_t nb)
void strings_offset(uint32_t offset)
void strings_size(uint32_t size)
std::ostream &print(std::ostream &os) const override
void accept(Visitor &visitor) const override
bool operator==(const SymbolCommand &rhs) const
bool operator!=(const SymbolCommand &rhs) const

UUIDCommand

class LIEF::MachO::UUIDCommand : public LIEF::MachO::LoadCommand

Public Functions

UUIDCommand(void)
UUIDCommand(const uuid_command *uuidCmd)
UUIDCommand &operator=(const UUIDCommand &copy)
UUIDCommand(const UUIDCommand &copy)
UUIDCommand *clone(void) const override
~UUIDCommand(void)
uuid_t uuid(void) const
void uuid(const uuid_t &uuid)
bool operator==(const UUIDCommand &rhs) const
bool operator!=(const UUIDCommand &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Dyld Info

class LIEF::MachO::DyldInfo : public LIEF::MachO::LoadCommand

LC_DYLD_INFO and LC_DYLD_INFO_ONLY command model.

Public Types

using info_t = std::pair<uint32_t, uint32_t>

Tuple of offset and size

Public Functions

DyldInfo(void)
DyldInfo(const dyld_info_command *dyld_info_cmd)
DyldInfo &operator=(DyldInfo other)
DyldInfo(const DyldInfo &copy)
void swap(DyldInfo &other)
DyldInfo *clone(void) const override
~DyldInfo(void)
const info_t &rebase(void) const

Rebase information

Dyld rebases an image whenever dyld loads it at an address different from its preferred address. The rebase information is a stream of byte sized opcodes whose symbolic names start with REBASE_OPCODE_. Conceptually the rebase information is a table of tuples: <seg-index, seg-offset, type> The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like “every n’th offset for m times” can be encoded in a few bytes.

See

/usr/include/mach-o/loader.h

const buffer_t &rebase_opcodes(void) const

Return Rebase’s opcodes as raw data.

buffer_t &rebase_opcodes(void)
void rebase_opcodes(const buffer_t &raw)

Set new opcodes.

std::string show_rebases_opcodes(void) const

Return the rebase opcodes in a humman-readable way.

const info_t &bind(void) const

Bind information

Dyld binds an image during the loading process, if the image requires any pointers to be initialized to symbols in other images. The rebase information is a stream of byte sized opcodes whose symbolic names start with BIND_OPCODE_. Conceptually the bind information is a table of tuples: <seg-index, seg-offset, type, symbol-library-ordinal, symbol-name, addend> The opcodes are a compressed way to encode the table by only encoding when a column changes. In addition simple patterns like for runs of pointers initialzed to the same value can be encoded in a few bytes.

See

/usr/include/mach-o/loader.h

const buffer_t &bind_opcodes(void) const

Return Binding’s opcodes as raw data.

buffer_t &bind_opcodes(void)
void bind_opcodes(const buffer_t &raw)

Set new opcodes.

std::string show_bind_opcodes(void) const

Return the bind opcodes in a humman-readable way.

const info_t &weak_bind(void) const

Weak Bind information

Some C++ programs require dyld to unique symbols so that all images in the process use the same copy of some code/data. This step is done after binding. The content of the weak_bind info is an opcode stream like the bind_info. But it is sorted alphabetically by symbol name. This enable dyld to walk all images with weak binding information in order and look for collisions. If there are no collisions, dyld does no updating. That means that some fixups are also encoded in the bind_info. For instance, all calls to “operator new” are first bound to libstdc++.dylib using the information in bind_info. Then if some image overrides operator new that is detected when the weak_bind information is processed and the call to operator new is then rebound.

See

/usr/include/mach-o/loader.h

const buffer_t &weak_bind_opcodes(void) const

Return Weak Binding’s opcodes as raw data.

buffer_t &weak_bind_opcodes(void)
void weak_bind_opcodes(const buffer_t &raw)

Set new opcodes.

std::string show_weak_bind_opcodes(void) const

Return the bind opcodes in a humman-readable way.

const info_t &lazy_bind(void) const

Lazy Bind information

Some uses of external symbols do not need to be bound immediately. Instead they can be lazily bound on first use. The lazy_bind are contains a stream of BIND opcodes to bind all lazy symbols. Normal use is that dyld ignores the lazy_bind section when loading an image. Instead the static linker arranged for the lazy pointer to initially point to a helper function which pushes the offset into the lazy_bind area for the symbol needing to be bound, then jumps to dyld which simply adds the offset to lazy_bind_off to get the information on what to bind.

See

/usr/include/mach-o/loader.h

const buffer_t &lazy_bind_opcodes(void) const

Return Lazy Binding’s opcodes as raw data.

buffer_t &lazy_bind_opcodes(void)
void lazy_bind_opcodes(const buffer_t &raw)

Set new opcodes.

std::string show_lazy_bind_opcodes(void) const

Return the lazy opcodes in a humman-readable way.

it_binding_info bindings(void)

Iterator over BindingInfo entries.

it_const_binding_info bindings(void) const
const info_t &export_info(void) const

Export information

The symbols exported by a dylib are encoded in a trie. This is a compact representation that factors out common prefixes. It also reduces LINKEDIT pages in RAM because it encodes all information (name, address, flags) in one small, contiguous range. The export area is a stream of nodes. The first node sequentially is the start node for the trie.

Nodes for a symbol start with a byte that is the length of the exported symbol information for the string so far. If there is no exported symbol, the byte is zero. If there is exported info, it follows the length byte. The exported info normally consists of a flags and offset both encoded in uleb128. The offset is location of the content named by the symbol. It is the offset from the mach_header for the image.

After the initial byte and optional exported symbol information is a byte of how many edges (0-255) that this node has leaving it, followed by each edge. Each edge is a zero terminated cstring of the addition chars in the symbol, followed by a uleb128 offset for the node that edge points to.

See

/usr/include/mach-o/loader.h

it_export_info exports(void)

Iterator over ExportInfo entries.

it_const_export_info exports(void) const
const buffer_t &export_trie(void) const

Return Export’s trie as raw data.

buffer_t &export_trie(void)
void export_trie(const buffer_t &raw)

Set new trie.

std::string show_export_trie(void) const

Return the export trie in a humman-readable way.

void rebase(const info_t &info)
void bind(const info_t &info)
void weak_bind(const info_t &info)
void lazy_bind(const info_t &info)
void export_info(const info_t &info)
void set_rebase_offset(uint32_t offset)
void set_rebase_size(uint32_t size)
void set_bind_offset(uint32_t offset)
void set_bind_size(uint32_t size)
void set_weak_bind_offset(uint32_t offset)
void set_weak_bind_size(uint32_t size)
void set_lazy_bind_offset(uint32_t offset)
void set_lazy_bind_size(uint32_t size)
void set_export_offset(uint32_t offset)
void set_export_size(uint32_t size)
bool operator==(const DyldInfo &rhs) const
bool operator!=(const DyldInfo &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Function starts

class LIEF::MachO::FunctionStarts : public LIEF::MachO::LoadCommand

Public Functions

FunctionStarts(void)
FunctionStarts(const linkedit_data_command *cmd)
FunctionStarts &operator=(const FunctionStarts &copy)
FunctionStarts(const FunctionStarts &copy)
FunctionStarts *clone(void) const override
uint32_t data_offset(void) const

Offset in the binary where start functions are located.

uint32_t data_size(void) const

Size of the functions list in the binary.

const std::vector<uint64_t> &functions(void) const

Addresses of every function entry point in the executable.

This allows for functions to exist that have no entries in the symbol table.

Warning

The address is relative to the __TEXT segment

std::vector<uint64_t> &functions(void)
void add_function(uint64_t address)

Add a new function.

void data_offset(uint32_t offset)
void data_size(uint32_t size)
void functions(const std::vector<uint64_t> &funcs)
~FunctionStarts(void)
bool operator==(const FunctionStarts &rhs) const
bool operator!=(const FunctionStarts &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Source Version

class LIEF::MachO::SourceVersion : public LIEF::MachO::LoadCommand

Public Types

using version_t = std::array<uint32_t, 5>

Version is an array of 5 integers.

Public Functions

SourceVersion(void)
SourceVersion(const source_version_command *version_cmd)
SourceVersion &operator=(const SourceVersion &copy)
SourceVersion(const SourceVersion &copy)
SourceVersion *clone(void) const override
~SourceVersion(void)
const SourceVersion::version_t &version(void) const

Return the version as an array.

void version(const SourceVersion::version_t &version)
bool operator==(const SourceVersion &rhs) const
bool operator!=(const SourceVersion &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Version Min

class LIEF::MachO::VersionMin : public LIEF::MachO::LoadCommand

Public Types

using version_t = std::array<uint32_t, 3>

Version is an array of 3 integers.

Public Functions

VersionMin(void)
VersionMin(const version_min_command *version_cmd)
VersionMin &operator=(const VersionMin &copy)
VersionMin(const VersionMin &copy)
VersionMin *clone(void) const override
~VersionMin(void)
const VersionMin::version_t &version(void) const

Return the version as an array.

void version(const VersionMin::version_t &version)
const VersionMin::version_t &sdk(void) const

Return the sdk as an array.

void sdk(const VersionMin::version_t &sdk)
bool operator==(const VersionMin &rhs) const
bool operator!=(const VersionMin &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Relocation

class LIEF::MachO::Relocation : public LIEF::Relocation

Object modeling relocation.

See

:

Subclassed by LIEF::MachO::RelocationDyld, LIEF::MachO::RelocationObject

Public Functions

Relocation(void)
Relocation(uint64_t address, uint8_t type)
Relocation(const Relocation &other)
void swap(Relocation &other)
~Relocation(void)
Relocation *clone(void) const = 0
bool is_pc_relative(void) const = 0

For object this is an offset from the start of the section to the item containing the address requiring relocation.

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

uint8_t type(void) const

Type of the relocation according to the architecture and/or origin.

See:

CPU_TYPES architecture(void) const

architecture of the relocation

RELOCATION_ORIGINS origin(void) const = 0

Origin of the relocation.

bool has_symbol(void) const

true if the relocation has a symbol associated with

Symbol &symbol(void)

Symbol associated with the relocation (if any)

const Symbol &symbol(void) const
bool has_section(void) const

true if the relocation has a section associated with

Section &section(void)

Section associated with the relocation (if any)

const Section &section(void) const
bool has_segment(void) const

true if the relocation has a SegmentCommand associated with

SegmentCommand &segment(void)

SegmentCommand associated with the relocation (if any)

const SegmentCommand &segment(void) const
void pc_relative(bool val) = 0
void type(uint8_t type)
bool operator==(const Relocation &rhs) const
bool operator!=(const Relocation &rhs) const
void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

std::ostream &print(std::ostream &os) const

Friends

friend std::ostream &operator<<(std::ostream &os, const Relocation &relocation)

Relocation Object

class LIEF::MachO::RelocationObject : public LIEF::MachO::Relocation

Public Functions

RelocationObject(void)
RelocationObject(const relocation_info *relocinfo)
RelocationObject(const scattered_relocation_info *scattered_relocinfo)
RelocationObject &operator=(RelocationObject other)
RelocationObject(const RelocationObject &other)
void swap(RelocationObject &other)
~RelocationObject(void)
RelocationObject *clone(void) const override
bool is_pc_relative(void) const override

For object this is an offset from the start of the section to the item containing the address requiring relocation.

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

size_t size(void) const override

Relocation size in bits

uint64_t address(void) const override

Relocation’s Address.

bool is_scattered(void) const

true if the relocation is a scattered one

int32_t value(void) const

For scattered relocations, The address of the relocatable expression for the item in the file that needs to be updated if the address is changed.

For relocatable expressions with the difference of two section addresses, the address from which to subtract (in mathematical terms, the minuend) is contained in the first relocation entry and the address to subtract (the subtrahend) is contained in the second relocation entry.

RELOCATION_ORIGINS origin(void) const override

Origin of the relocation.

void pc_relative(bool val) override
void size(size_t size) override
void value(int32_t value)
bool operator==(const RelocationObject &rhs) const
bool operator!=(const RelocationObject &rhs) const
void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

std::ostream &print(std::ostream &os) const override
Relocation(void)
Relocation(uint64_t address, uint8_t type)
Relocation(const Relocation &other)

Relocation Dyld

class LIEF::MachO::RelocationDyld : public LIEF::MachO::Relocation

Public Functions

RelocationDyld(void)
RelocationDyld &operator=(const RelocationDyld&)
RelocationDyld(const RelocationDyld&)
~RelocationDyld(void)
Relocation *clone(void) const override
bool is_pc_relative(void) const override

Indicates whether the item containing the address to be relocated is part of a CPU instruction that uses PC-relative addressing.

For addresses contained in PC-relative instructions, the CPU adds the address of the instruction to the address contained in the instruction.

RELOCATION_ORIGINS origin(void) const override

Origin of the relocation.

void pc_relative(bool val) override
bool operator==(const RelocationDyld &rhs) const
bool operator!=(const RelocationDyld &rhs) const
bool operator<(const RelocationDyld &rhs) const
bool operator>=(const RelocationDyld &rhs) const
bool operator>(const RelocationDyld &rhs) const
bool operator<=(const RelocationDyld &rhs) const
void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

std::ostream &print(std::ostream &os) const override
Relocation(void)
Relocation(uint64_t address, uint8_t type)
Relocation(const Relocation &other)

Binding Info

class LIEF::MachO::BindingInfo : public LIEF::Object

Public Functions

BindingInfo(void)
BindingInfo(BINDING_CLASS cls, BIND_TYPES type, uint64_t address, int64_t addend = 0, int32_t oridnal = 0, bool is_weak = false, bool is_non_weak_definition = false)
BindingInfo &operator=(BindingInfo other)
BindingInfo(const BindingInfo &other)
void swap(BindingInfo &other)
bool has_segment(void) const

Check if a segment is associated with the BindingInfo.

const SegmentCommand &segment(void) const

Segment associated with the BindingInfo

SegmentCommand &segment(void)
bool has_library(void) const

Check if a library is tied with the BindingInfo.

const DylibCommand &library(void) const

Library associated with the BindingInfo

DylibCommand &library(void)
bool has_symbol(void) const

Check if a symbol is associated with the BindingInfo.

const Symbol &symbol(void) const

Symbol associated with the BindingInfo

Symbol &symbol(void)
uint64_t address(void) const

Address of the binding.

void address(uint64_t addr)
BINDING_CLASS binding_class(void) const

Class of the binding (weak, lazy, …)

void binding_class(BINDING_CLASS bind_class)
BIND_TYPES binding_type(void) const

Type of the binding. Most of the times it’s BIND_TYPES::BIND_TYPE_POINTER.

void binding_type(BIND_TYPES type)
int32_t library_ordinal(void) const
void library_ordinal(int32_t ordinal)
int64_t addend(void) const

Value added to the segment’s virtual address when binding.

void addend(int64_t addend)
bool is_weak_import(void) const
void set_weak_import(bool val = true)
bool is_non_weak_definition(void) const
void set_non_weak_definition(bool val)
~BindingInfo(void)
bool operator==(const BindingInfo &rhs) const
bool operator!=(const BindingInfo &rhs) const
void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const BindingInfo &binding_info)

Export Info

class LIEF::MachO::ExportInfo : public LIEF::Object

Public Types

using flag_list_t = std::vector<EXPORT_SYMBOL_FLAGS>

Public Functions

ExportInfo(void)
ExportInfo(uint64_t address, uint64_t flags, uint64_t offset = 0)
ExportInfo &operator=(ExportInfo copy)
ExportInfo(const ExportInfo &copy)
void swap(ExportInfo &other)
uint64_t node_offset(void) const
uint64_t flags(void) const
void flags(uint64_t flags)
flag_list_t flags_list(void) const
bool has(EXPORT_SYMBOL_FLAGS flag) const
EXPORT_SYMBOL_KINDS kind(void) const
uint64_t other(void) const
uint64_t address(void) const
void address(uint64_t addr)
bool has_symbol(void) const
const Symbol &symbol(void) const
Symbol &symbol(void)
Symbol *alias(void)
const Symbol *alias(void) const
DylibCommand *alias_library(void)
const DylibCommand *alias_library(void) const
~ExportInfo(void)
bool operator==(const ExportInfo &rhs) const
bool operator!=(const ExportInfo &rhs) const
void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const ExportInfo &export_info)

Thread Command

class LIEF::MachO::ThreadCommand : public LIEF::MachO::LoadCommand

Public Functions

ThreadCommand(void)
ThreadCommand(const thread_command *cmd, CPU_TYPES arch = CPU_TYPES::CPU_TYPE_ANY)
ThreadCommand(uint32_t flavor, uint32_t count, CPU_TYPES arch = CPU_TYPES::CPU_TYPE_ANY)
ThreadCommand &operator=(const ThreadCommand &copy)
ThreadCommand(const ThreadCommand &copy)
ThreadCommand *clone(void) const override
~ThreadCommand(void)
uint32_t flavor(void) const
uint32_t count(void) const
CPU_TYPES architecture(void) const
const std::vector<uint8_t> &state(void) const
std::vector<uint8_t> &state(void)
uint64_t pc(void) const
void state(const std::vector<uint8_t> &state)
void flavor(uint32_t flavor)
void count(uint32_t count)
void architecture(CPU_TYPES arch)
bool operator==(const ThreadCommand &rhs) const
bool operator!=(const ThreadCommand &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

RPath Command

class LIEF::MachO::RPathCommand : public LIEF::MachO::LoadCommand

Public Functions

RPathCommand(void)
RPathCommand(const rpath_command *rpathCmd)
RPathCommand &operator=(const RPathCommand &copy)
RPathCommand(const RPathCommand &copy)
RPathCommand *clone(void) const override
~RPathCommand(void)
const std::string &path(void) const
void path(const std::string &path)
bool operator==(const RPathCommand &rhs) const
bool operator!=(const RPathCommand &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Code Signature

class LIEF::MachO::CodeSignature : public LIEF::MachO::LoadCommand

Public Functions

CodeSignature(void)
CodeSignature(const linkedit_data_command *cmd)
CodeSignature &operator=(const CodeSignature &copy)
CodeSignature(const CodeSignature &copy)
CodeSignature *clone(void) const override
uint32_t data_offset(void) const
uint32_t data_size(void) const
void data_offset(uint32_t offset)
void data_size(uint32_t size)
~CodeSignature(void)
bool operator==(const CodeSignature &rhs) const
bool operator!=(const CodeSignature &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Data In Code

class LIEF::MachO::DataInCode : public LIEF::MachO::LoadCommand

Interface of the LC_DATA_IN_CODE command.

Public Types

using entries_t = std::vector<DataCodeEntry>
using it_const_entries = const_ref_iterator<const entries_t&>
using it_entries = ref_iterator<entries_t&>

Public Functions

DataInCode(void)
DataInCode(const linkedit_data_command *cmd)
DataInCode &operator=(const DataInCode&)
DataInCode(const DataInCode&)
DataInCode *clone(void) const override
uint32_t data_offset(void) const
uint32_t data_size(void) const
void data_offset(uint32_t offset)
void data_size(uint32_t size)
DataInCode &add(const DataCodeEntry &entry)
it_const_entries entries(void) const
it_entries entries(void)
~DataInCode(void)
bool operator==(const DataInCode &rhs) const
bool operator!=(const DataInCode &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Data Code Entry

class LIEF::MachO::DataCodeEntry : public LIEF::Object

Interface of an entry in DataInCode.

Public Types

enum TYPES

Values:

enumerator UNKNOWN = 0
enumerator DATA = 1
enumerator JUMP_TABLE_8 = 2
enumerator JUMP_TABLE_16 = 3
enumerator JUMP_TABLE_32 = 4
enumerator ABS_JUMP_TABLE_32 = 5

Public Functions

DataCodeEntry(void)
DataCodeEntry(uint32_t off, uint16_t length, TYPES type)
DataCodeEntry(const data_in_code_entry *entry)
DataCodeEntry &operator=(const DataCodeEntry&)
DataCodeEntry(const DataCodeEntry&)
uint32_t offset(void) const

Offset of the data.

uint16_t length(void) const

Length of the data.

TYPES type(void) const
void offset(uint32_t off)
void length(uint16_t length)
void type(TYPES type)
~DataCodeEntry(void)
bool operator==(const DataCodeEntry &rhs) const
bool operator!=(const DataCodeEntry &rhs) const
void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const DataCodeEntry &entry)
enum LIEF::MachO::DataCodeEntry::TYPES

Values:

enumerator UNKNOWN = 0
enumerator DATA = 1
enumerator JUMP_TABLE_8 = 2
enumerator JUMP_TABLE_16 = 3
enumerator JUMP_TABLE_32 = 4
enumerator ABS_JUMP_TABLE_32 = 5

Segment Split Info

class LIEF::MachO::SegmentSplitInfo : public LIEF::MachO::LoadCommand

Public Functions

SegmentSplitInfo(void)
SegmentSplitInfo(const linkedit_data_command *cmd)
SegmentSplitInfo &operator=(const SegmentSplitInfo &copy)
SegmentSplitInfo(const SegmentSplitInfo &copy)
SegmentSplitInfo *clone(void) const override
uint32_t data_offset(void) const
uint32_t data_size(void) const
void data_offset(uint32_t offset)
void data_size(uint32_t size)
~SegmentSplitInfo(void)
bool operator==(const SegmentSplitInfo &rhs) const
bool operator!=(const SegmentSplitInfo &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Sub-Framework

class LIEF::MachO::SubFramework : public LIEF::MachO::LoadCommand

Public Functions

SubFramework(void)
SubFramework(const sub_framework_command *cmd)
SubFramework &operator=(const SubFramework &copy)
SubFramework(const SubFramework &copy)
SubFramework *clone(void) const override
const std::string &umbrella(void) const
void umbrella(const std::string &u)
~SubFramework(void)
bool operator==(const SubFramework &rhs) const
bool operator!=(const SubFramework &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Dyld Environment

class LIEF::MachO::DyldEnvironment : public LIEF::MachO::LoadCommand

Public Functions

DyldEnvironment(void)
DyldEnvironment(const dylinker_command *cmd)
DyldEnvironment &operator=(const DyldEnvironment &copy)
DyldEnvironment(const DyldEnvironment &copy)
DyldEnvironment *clone(void) const override
~DyldEnvironment(void)
std::ostream &print(std::ostream &os) const override
const std::string &value(void) const
void value(const std::string &values)
bool operator==(const DyldEnvironment &rhs) const
bool operator!=(const DyldEnvironment &rhs) const
void accept(Visitor &visitor) const override

Encryption Info

class LIEF::MachO::EncryptionInfo : public LIEF::MachO::LoadCommand

Public Functions

EncryptionInfo(void)
EncryptionInfo(const encryption_info_command *cmd)
EncryptionInfo &operator=(const EncryptionInfo &copy)
EncryptionInfo(const EncryptionInfo &copy)
~EncryptionInfo(void)
uint32_t crypt_offset(void) const
uint32_t crypt_size(void) const
uint32_t crypt_id(void) const
void crypt_offset(uint32_t offset)
void crypt_size(uint32_t size)
void crypt_id(uint32_t id)
bool operator==(const EncryptionInfo &rhs) const
bool operator!=(const EncryptionInfo &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Build Version

class LIEF::MachO::BuildVersion : public LIEF::MachO::LoadCommand

Public Types

enum PLATFORMS

Values:

enumerator UNKNOWN = 0
enumerator MACOS = 1
enumerator IOS = 2
enumerator TVOS = 3
enumerator WATCHOS = 4
using version_t = std::array<uint32_t, 3>

Version is an array of 3 integers.

using tools_list_t = std::vector<BuildToolVersion>

Public Functions

BuildVersion(void)
BuildVersion(const build_version_command *version_cmd)
BuildVersion &operator=(const BuildVersion &copy)
BuildVersion(const BuildVersion &copy)
BuildVersion *clone(void) const override
version_t minos(void) const
void minos(version_t version)
version_t sdk(void) const
void sdk(version_t version)
PLATFORMS platform(void) const
void platform(PLATFORMS plat)
tools_list_t tools(void) const
~BuildVersion(void)
bool operator==(const BuildVersion &rhs) const
bool operator!=(const BuildVersion &rhs) const
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override

Build Tool Version

class LIEF::MachO::BuildToolVersion : public LIEF::Object

Public Types

enum TOOLS

Values:

enumerator UNKNOWN = 0
enumerator CLANG = 1
enumerator SWIFT = 2
enumerator LD = 3
using version_t = std::array<uint32_t, 3>

Version is an array of 3 integers.

Public Functions

BuildToolVersion(void)
BuildToolVersion(const build_tool_version &tool)
TOOLS tool(void) const

TOOL used.

version_t version(void) const

Version associated with the tool.

~BuildToolVersion(void)
bool operator==(const BuildToolVersion &rhs) const
bool operator!=(const BuildToolVersion &rhs) const
void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const BuildToolVersion &tool)

Utilities

Warning

doxygenfunction: Unable to resolve multiple matches for function “LIEF::MachO::is_macho” with arguments (const std::string&) in doxygen xml output for project “lief” from directory: /tmp/LIEF/LIEF/build/doc/doxygen/xml. Potential matches:

- bool is_macho(const std::string &file)
- bool is_macho(const std::vector<uint8_t> &raw)

Warning

doxygenfunction: Unable to resolve multiple matches for function “LIEF::MachO::is_macho” with arguments (const std::vector<uint8_t>&) in doxygen xml output for project “lief” from directory: /tmp/LIEF/LIEF/build/doc/doxygen/xml. Potential matches:

- bool is_macho(const std::string &file)
- bool is_macho(const std::vector<uint8_t> &raw)
bool MachO::LIEF::is_fat(const std::string &file)

Check if the given Mach-O is fat.

bool MachO::LIEF::is_64(const std::string &file)

Check if the given Mach-O is 64-bits.


Enums

enum MachO::LIEF::MACHO_TYPES

Values:

enumerator MH_MAGIC = 0xFEEDFACEu

32-bit big-endian magic

enumerator MH_CIGAM = 0xCEFAEDFEu

32-bit little-endian magic

enumerator MH_MAGIC_64 = 0xFEEDFACFu

64-bit big-endian magic

enumerator MH_CIGAM_64 = 0xCFFAEDFEu

64-bit little-endian magic

enumerator FAT_MAGIC = 0xCAFEBABEu

big-endian fat magic

enumerator FAT_CIGAM = 0xBEBAFECAu

little-endian fat magic

enum MachO::LIEF::FILE_TYPES

Values:

enumerator MH_OBJECT = 0x1u
enumerator MH_EXECUTE = 0x2u
enumerator MH_FVMLIB = 0x3u
enumerator MH_CORE = 0x4u
enumerator MH_PRELOAD = 0x5u
enumerator MH_DYLIB = 0x6u
enumerator MH_DYLINKER = 0x7u
enumerator MH_BUNDLE = 0x8u
enumerator MH_DYLIB_STUB = 0x9u
enumerator MH_DSYM = 0xAu
enumerator MH_KEXT_BUNDLE = 0xBu
enum MachO::LIEF::HEADER_FLAGS

Values:

enumerator MH_NOUNDEFS = 0x00000001u
enumerator MH_INCRLINK = 0x00000002u
enumerator MH_DYLDLINK = 0x00000004u
enumerator MH_BINDATLOAD = 0x00000008u
enumerator MH_PREBOUND = 0x00000010u
enumerator MH_SPLIT_SEGS = 0x00000020u
enumerator MH_LAZY_INIT = 0x00000040u
enumerator MH_TWOLEVEL = 0x00000080u
enumerator MH_FORCE_FLAT = 0x00000100u
enumerator MH_NOMULTIDEFS = 0x00000200u
enumerator MH_NOFIXPREBINDING = 0x00000400u
enumerator MH_PREBINDABLE = 0x00000800u
enumerator MH_ALLMODSBOUND = 0x00001000u
enumerator MH_SUBSECTIONS_VIA_SYMBOLS = 0x00002000u
enumerator MH_CANONICAL = 0x00004000u
enumerator MH_WEAK_DEFINES = 0x00008000u
enumerator MH_BINDS_TO_WEAK = 0x00010000u
enumerator MH_ALLOW_STACK_EXECUTION = 0x00020000u
enumerator MH_ROOT_SAFE = 0x00040000u
enumerator MH_SETUID_SAFE = 0x00080000u
enumerator MH_NO_REEXPORTED_DYLIBS = 0x00100000u
enumerator MH_PIE = 0x00200000u
enumerator MH_DEAD_STRIPPABLE_DYLIB = 0x00400000u
enumerator MH_HAS_TLV_DESCRIPTORS = 0x00800000u
enumerator MH_NO_HEAP_EXECUTION = 0x01000000u
enumerator MH_APP_EXTENSION_SAFE = 0x02000000u
enum MachO::LIEF::LOAD_COMMAND_TYPES

Values:

enumerator LC_SEGMENT = 0x00000001u
enumerator LC_SYMTAB = 0x00000002u
enumerator LC_SYMSEG = 0x00000003u
enumerator LC_THREAD = 0x00000004u
enumerator LC_UNIXTHREAD = 0x00000005u
enumerator LC_LOADFVMLIB = 0x00000006u
enumerator LC_IDFVMLIB = 0x00000007u
enumerator LC_IDENT = 0x00000008u
enumerator LC_FVMFILE = 0x00000009u
enumerator LC_PREPAGE = 0x0000000Au
enumerator LC_DYSYMTAB = 0x0000000Bu
enumerator LC_LOAD_DYLIB = 0x0000000Cu
enumerator LC_ID_DYLIB = 0x0000000Du
enumerator LC_LOAD_DYLINKER = 0x0000000Eu
enumerator LC_ID_DYLINKER = 0x0000000Fu
enumerator LC_PREBOUND_DYLIB = 0x00000010u
enumerator LC_ROUTINES = 0x00000011u
enumerator LC_SUB_FRAMEWORK = 0x00000012u
enumerator LC_SUB_UMBRELLA = 0x00000013u
enumerator LC_SUB_CLIENT = 0x00000014u
enumerator LC_SUB_LIBRARY = 0x00000015u
enumerator LC_TWOLEVEL_HINTS = 0x00000016u
enumerator LC_PREBIND_CKSUM = 0x00000017u
enumerator LC_LOAD_WEAK_DYLIB = 0x80000018u
enumerator LC_SEGMENT_64 = 0x00000019u
enumerator LC_ROUTINES_64 = 0x0000001Au
enumerator LC_UUID = 0x0000001Bu
enumerator LC_RPATH = 0x8000001Cu
enumerator LC_CODE_SIGNATURE = 0x0000001Du
enumerator LC_SEGMENT_SPLIT_INFO = 0x0000001Eu
enumerator LC_REEXPORT_DYLIB = 0x8000001Fu
enumerator LC_LAZY_LOAD_DYLIB = 0x00000020u
enumerator LC_ENCRYPTION_INFO = 0x00000021u
enumerator LC_DYLD_INFO = 0x00000022u
enumerator LC_DYLD_INFO_ONLY = 0x80000022u
enumerator LC_LOAD_UPWARD_DYLIB = 0x80000023u
enumerator LC_VERSION_MIN_MACOSX = 0x00000024u
enumerator LC_VERSION_MIN_IPHONEOS = 0x00000025u
enumerator LC_FUNCTION_STARTS = 0x00000026u
enumerator LC_DYLD_ENVIRONMENT = 0x00000027u
enumerator LC_MAIN = 0x80000028u
enumerator LC_DATA_IN_CODE = 0x00000029u
enumerator LC_SOURCE_VERSION = 0x0000002Au
enumerator LC_DYLIB_CODE_SIGN_DRS = 0x0000002Bu
enumerator LC_ENCRYPTION_INFO_64 = 0x0000002Cu
enumerator LC_LINKER_OPTION = 0x0000002Du
enumerator LC_LINKER_OPTIMIZATION_HINT = 0x0000002Eu
enumerator LC_VERSION_MIN_TVOS = 0x0000002Fu
enumerator LC_VERSION_MIN_WATCHOS = 0x00000030u
enumerator LC_NOTE = 0x00000031u
enumerator LC_BUILD_VERSION = 0x00000032u
enum MachO::LIEF::MACHO_SEGMENTS_FLAGS

Values:

enumerator SG_HIGHVM = 0x1u

The file contents for this segment are for the high part of the virtual memory space; the low part is zero filled (for stacks in core files).

enumerator SG_FVMLIB = 0x2u

this segment is the VM that is allocated by a fixed VM library, for overlap checking in the link editor.

enumerator SG_NORELOC = 0x4u

This segment has nothing that was relocated in it and nothing relocated to it. It may be safely replaced without relocation.

enumerator SG_PROTECTED_VERSION_1 = 0x8u
enum MachO::LIEF::MACHO_SECTION_TYPES

These are the section type and attributes fields. A MachO section can have only one Type, but can have any of the attributes specified.

Values:

enumerator S_REGULAR = 0x00u

Regular section.

enumerator S_ZEROFILL = 0x01u

Zero fill on demand section.

enumerator S_CSTRING_LITERALS = 0x02u

Section with literal C strings.

enumerator S_4BYTE_LITERALS = 0x03u

Section with 4 byte literals.

enumerator S_8BYTE_LITERALS = 0x04u

Section with 8 byte literals.

enumerator S_LITERAL_POINTERS = 0x05u

Section with pointers to literals.

enumerator S_NON_LAZY_SYMBOL_POINTERS = 0x06u

Section with non-lazy symbol pointers.

enumerator S_LAZY_SYMBOL_POINTERS = 0x07u

Section with lazy symbol pointers.

enumerator S_SYMBOL_STUBS = 0x08u

Section with symbol stubs, byte size of stub in the Reserved2 field.

enumerator S_MOD_INIT_FUNC_POINTERS = 0x09u

Section with only function pointers for initialization.

enumerator S_MOD_TERM_FUNC_POINTERS = 0x0au

Section with only function pointers for termination.

enumerator S_COALESCED = 0x0bu

Section contains symbols that are to be coalesced.

enumerator S_GB_ZEROFILL = 0x0cu

Zero fill on demand section (that can be larger than 4 gigabytes).

enumerator S_INTERPOSING = 0x0du

Section with only pairs of function pointers for interposing.

enumerator S_16BYTE_LITERALS = 0x0eu

Section with only 16 byte literals.

enumerator S_DTRACE_DOF = 0x0fu

Section contains DTrace Object Format.

enumerator S_LAZY_DYLIB_SYMBOL_POINTERS = 0x10u

Section with lazy symbol pointers to lazy loaded dylibs.

enumerator S_THREAD_LOCAL_REGULAR = 0x11u

Thread local data section.

enumerator S_THREAD_LOCAL_ZEROFILL = 0x12u

Thread local zerofill section.

enumerator S_THREAD_LOCAL_VARIABLES = 0x13u

Section with thread local variable structure data.

enumerator S_THREAD_LOCAL_VARIABLE_POINTERS = 0x14u

Section with pointers to thread local structures.

enumerator S_THREAD_LOCAL_INIT_FUNCTION_POINTERS = 0x15u

Section with thread local variable initialization pointers to functions.

enumerator LAST_KNOWN_SECTION_TYPE = 0x15u
enum MachO::LIEF::MACHO_SECTION_FLAGS

Values:

enumerator S_ATTR_PURE_INSTRUCTIONS = 0x80000000u

Section contains only true machine instructions.

enumerator S_ATTR_NO_TOC = 0x40000000u

Section contains coalesced symbols that are not to be in a ranlib table of contents.

enumerator S_ATTR_STRIP_STATIC_SYMS = 0x20000000u

Ok to strip static symbols in this section in files with the MY_DYLDLINK flag.

enumerator S_ATTR_NO_DEAD_STRIP = 0x10000000u

No dead stripping.

enumerator S_ATTR_LIVE_SUPPORT = 0x08000000u

Blocks are live if they reference live blocks.

enumerator S_ATTR_SELF_MODIFYING_CODE = 0x04000000u

Used with i386 code stubs written on by dyld.

enumerator S_ATTR_DEBUG = 0x02000000u

A debug section.

enumerator S_ATTR_SOME_INSTRUCTIONS = 0x00000400u

Section contains some machine instructions.

enumerator S_ATTR_EXT_RELOC = 0x00000200u

Section has external relocation entries.

enumerator S_ATTR_LOC_RELOC = 0x00000100u

Section has local relocation entries.

enumerator INDIRECT_SYMBOL_LOCAL = 0x80000000u
enumerator INDIRECT_SYMBOL_ABS = 0x40000000u
enum MachO::LIEF::MACHO_SYMBOL_TYPES

Values:

enumerator N_STAB = 0xe0

The symbol is symbolic debugging table.

enumerator N_PEXT = 0x10

Limited global scope symbol.

enumerator N_TYPE = 0x0e

Define the type of the symbol.

See

N_LIST_TYPES

enumerator N_EXT = 0x01

External symbol, a symbol that is either defined outside this file or that is defined in this file but can be referenced by other files.

enum MachO::LIEF::SYMBOL_DESCRIPTIONS

Values:

enumerator REFERENCE_TYPE = 0x7
enumerator REFERENCE_FLAG_UNDEFINED_NON_LAZY = 0

Reference to an external non-lazy (data) symbol.

enumerator REFERENCE_FLAG_UNDEFINED_LAZY = 1

Reference to an external lazy symbol - that is, to a function call.

enumerator REFERENCE_FLAG_DEFINED = 2

Defined in this module.

enumerator REFERENCE_FLAG_PRIVATE_DEFINED = 3

Defined in this module and is visible only to modules within this shared library.

enumerator REFERENCE_FLAG_PRIVATE_UNDEFINED_NON_LAZY = 4

Defined in another module in this file, is a non-lazy (data) symbol, and is visible only to modules within this shared library.

enumerator REFERENCE_FLAG_PRIVATE_UNDEFINED_LAZY = 5

Defined in another module in this file, is a lazy (function) symbol, and is visible only to modules within this shared library.

enumerator N_ARM_THUMB_DEF = 0x0008u
enumerator REFERENCED_DYNAMICALLY = 0x0010u
enumerator N_NO_DEAD_STRIP = 0x0020u
enumerator N_WEAK_REF = 0x0040u
enumerator N_WEAK_DEF = 0x0080u
enumerator N_SYMBOL_RESOLVER = 0x0100u
enumerator N_ALT_ENTRY = 0x0200u
enumerator SELF_LIBRARY_ORDINAL = 0x0
enumerator MAX_LIBRARY_ORDINAL = 0xfd
enumerator DYNAMIC_LOOKUP_ORDINAL = 0xfe
enumerator EXECUTABLE_ORDINAL = 0xff
enum MachO::LIEF::X86_RELOCATION

Values:

enumerator GENERIC_RELOC_VANILLA = 0

A generic relocation entry for both addresses contained in data and addresses contained in CPU instructions.

enumerator GENERIC_RELOC_PAIR = 1

The second relocation entry of a pair.

enumerator GENERIC_RELOC_SECTDIFF = 2

A relocation entry for an item that contains the difference of two section addresses. This is generally used for position-independent code generation.

enumerator GENERIC_RELOC_PB_LA_PTR = 3

contains the address from which to subtract; it must be followed by a X86_RELOCATION::GENERIC_RELOC_PAIR containing the address to subtract.

enumerator GENERIC_RELOC_LOCAL_SECTDIFF = 4

Similar to X86_RELOCATION::GENERIC_RELOC_SECTDIFF except that this entry refers specifically to the address in this item. If the address is that of a globally visible coalesced symbol, this relocation entry does not change if the symbol is overridden. This is used to associate stack unwinding information with the object code this relocation entry describes.

enumerator GENERIC_RELOC_TLV = 5

A relocation entry for a prebound lazy pointer. This is always a scattered relocation entry. The value field contains the non-prebound value of the lazy pointer.

enum MachO::LIEF::X86_64_RELOCATION

Values:

enumerator X86_64_RELOC_UNSIGNED = 0

A CALL/JMP instruction with 32-bit displacement.

enumerator X86_64_RELOC_SIGNED = 1

A MOVQ load of a GOT entry.

enumerator X86_64_RELOC_BRANCH = 2

Other GOT references.

enumerator X86_64_RELOC_GOT_LOAD = 3

Signed 32-bit displacement.

enumerator X86_64_RELOC_GOT = 4

Absolute address.

enumerator X86_64_RELOC_SUBTRACTOR = 5

Must be followed by a X86_64_RELOCATION::X86_64_RELOC_UNSIGNED relocation.

enumerator X86_64_RELOC_SIGNED_1 = 6
enumerator X86_64_RELOC_SIGNED_2 = 7
enumerator X86_64_RELOC_SIGNED_4 = 8
enumerator X86_64_RELOC_TLV = 9
enum MachO::LIEF::PPC_RELOCATION

Values:

enumerator PPC_RELOC_VANILLA = 0
enumerator PPC_RELOC_PAIR = 1
enumerator PPC_RELOC_BR14 = 2
enumerator PPC_RELOC_BR24 = 3
enumerator PPC_RELOC_HI16 = 4
enumerator PPC_RELOC_LO16 = 5
enumerator PPC_RELOC_HA16 = 6
enumerator PPC_RELOC_LO14 = 7
enumerator PPC_RELOC_SECTDIFF = 8
enumerator PPC_RELOC_PB_LA_PTR = 9
enumerator PPC_RELOC_HI16_SECTDIFF = 10
enumerator PPC_RELOC_LO16_SECTDIFF = 11
enumerator PPC_RELOC_HA16_SECTDIFF = 12
enumerator PPC_RELOC_JBSR = 13
enumerator PPC_RELOC_LO14_SECTDIFF = 14
enumerator PPC_RELOC_LOCAL_SECTDIFF = 15
enum MachO::LIEF::ARM_RELOCATION

Values:

enumerator ARM_RELOC_VANILLA = 0
enumerator ARM_RELOC_PAIR = 1
enumerator ARM_RELOC_SECTDIFF = 2
enumerator ARM_RELOC_LOCAL_SECTDIFF = 3
enumerator ARM_RELOC_PB_LA_PTR = 4
enumerator ARM_RELOC_BR24 = 5
enumerator ARM_THUMB_RELOC_BR22 = 6
enumerator ARM_THUMB_32BIT_BRANCH = 7
enumerator ARM_RELOC_HALF = 8
enumerator ARM_RELOC_HALF_SECTDIFF = 9
enum MachO::LIEF::ARM64_RELOCATION

Values:

enumerator ARM64_RELOC_UNSIGNED = 0

For pointers.

enumerator ARM64_RELOC_SUBTRACTOR = 1

Must be followed by an ARM64_RELOCATION::ARM64_RELOC_UNSIGNED

enumerator ARM64_RELOC_BRANCH26 = 2

A B/BL instruction with 26-bit displacement.

enumerator ARM64_RELOC_PAGE21 = 3

PC-rel distance to page of target.

enumerator ARM64_RELOC_PAGEOFF12 = 4

Offset within page, scaled by size .

enumerator ARM64_RELOC_GOT_LOAD_PAGE21 = 5

PC-rel distance to page of GOT slot

enumerator ARM64_RELOC_GOT_LOAD_PAGEOFF12 = 6

Offset within page of GOT slot, scaled by size .

enumerator ARM64_RELOC_POINTER_TO_GOT = 7

For pointers to GOT slots.

enumerator ARM64_RELOC_TLVP_LOAD_PAGE21 = 8

PC-rel distance to page of TLVP slot.

enumerator ARM64_RELOC_TLVP_LOAD_PAGEOFF12 = 9

Offset within page of TLVP slot, scaled by size .

enumerator ARM64_RELOC_ADDEND = 10

Must be followed by ARM64_RELOCATION::ARM64_RELOC_PAGE21 or ARM64_RELOCATION::ARM64_RELOC_PAGEOFF12.

enum MachO::LIEF::CPU_TYPES

Values:

enumerator CPU_TYPE_ANY = -1
enumerator CPU_TYPE_X86 = 7
enumerator CPU_TYPE_I386 = 7
enumerator CPU_TYPE_X86_64 = 7 | 0x01000000
enumerator CPU_TYPE_MC98000 = 10
enumerator CPU_TYPE_ARM = 12
enumerator CPU_TYPE_ARM64 = 12 | 0x01000000
enumerator CPU_TYPE_SPARC = 14
enumerator CPU_TYPE_POWERPC = 18
enumerator CPU_TYPE_POWERPC64 = 18 | 0x01000000
enum MachO::LIEF::CPU_SUBTYPES_X86

Values:

enumerator CPU_SUBTYPE_I386_ALL = 3
enumerator CPU_SUBTYPE_386 = 3
enumerator CPU_SUBTYPE_486 = 4
enumerator CPU_SUBTYPE_486SX = 0x84
enumerator CPU_SUBTYPE_586 = 5
enumerator CPU_SUBTYPE_PENT = 5
enumerator CPU_SUBTYPE_PENTPRO = 0x16
enumerator CPU_SUBTYPE_PENTII_M3 = 0x36
enumerator CPU_SUBTYPE_PENTII_M5 = 0x56
enumerator CPU_SUBTYPE_CELERON = 0x67
enumerator CPU_SUBTYPE_CELERON_MOBILE = 0x77
enumerator CPU_SUBTYPE_PENTIUM_3 = 0x08
enumerator CPU_SUBTYPE_PENTIUM_3_M = 0x18
enumerator CPU_SUBTYPE_PENTIUM_3_XEON = 0x28
enumerator CPU_SUBTYPE_PENTIUM_M = 0x09
enumerator CPU_SUBTYPE_PENTIUM_4 = 0x0a
enumerator CPU_SUBTYPE_PENTIUM_4_M = 0x1a
enumerator CPU_SUBTYPE_ITANIUM = 0x0b
enumerator CPU_SUBTYPE_ITANIUM_2 = 0x1b
enumerator CPU_SUBTYPE_XEON = 0x0c
enumerator CPU_SUBTYPE_XEON_MP = 0x1c
enumerator CPU_SUBTYPE_X86_ALL = 3
enumerator CPU_SUBTYPE_X86_64_ALL = 3
enumerator CPU_SUBTYPE_X86_ARCH1 = 4
enumerator CPU_SUBTYPE_X86_64_H = 8
enum MachO::LIEF::RELOCATION_ORIGINS

Values:

enumerator ORIGIN_UNKNOWN = 0
enumerator ORIGIN_DYLDINFO = 1
enumerator ORIGIN_RELOC_TABLE = 2
enum MachO::LIEF::REBASE_TYPES

Values:

enumerator REBASE_TYPE_POINTER = 1u
enumerator REBASE_TYPE_TEXT_ABSOLUTE32 = 2u
enumerator REBASE_TYPE_TEXT_PCREL32 = 3u
enum MachO::LIEF::BINDING_CLASS

Within the dyld_info_command there are differents area of binding. These enums tag these area.

Values:

enumerator BIND_CLASS_WEAK = 1u
enumerator BIND_CLASS_LAZY = 2u
enumerator BIND_CLASS_STANDARD = 3u
enum MachO::LIEF::REBASE_OPCODES

Opcodes used by Dyld info to rebase a Mach-O image.

Values:

enumerator REBASE_OPCODE_DONE = 0x00u

It’s finished.

enumerator REBASE_OPCODE_SET_TYPE_IMM = 0x10u

Set type to immediate (lower 4-bits). Used for ordinal numbers from 0-15.

enumerator REBASE_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB = 0x20u

Set segment’s index to immediate (lower 4-bits) and segment’s offset to following ULEB128 encoding.

enumerator REBASE_OPCODE_ADD_ADDR_ULEB = 0x30u

Add segment’s offset with the following ULEB128 encoding.

enumerator REBASE_OPCODE_ADD_ADDR_IMM_SCALED = 0x40u

Add segment’s offset with immediate scaling.

enumerator REBASE_OPCODE_DO_REBASE_IMM_TIMES = 0x50u

Rebase in the range of [segment's offset; segment's offset + immediate * sizeof(ptr)]

enumerator REBASE_OPCODE_DO_REBASE_ULEB_TIMES = 0x60u

Same as REBASE_OPCODE_DO_REBASE_IMM_TIMES but immediate is replaced with ULEB128 value.

enumerator REBASE_OPCODE_DO_REBASE_ADD_ADDR_ULEB = 0x70u

Rebase and increment segment’s offset with following ULEB128 encoding + pointer’s size.

enumerator REBASE_OPCODE_DO_REBASE_ULEB_TIMES_SKIPPING_ULEB = 0x80u

Rebase and skip several bytes.

enum MachO::LIEF::BIND_TYPES

Values:

enumerator BIND_TYPE_POINTER = 1u
enumerator BIND_TYPE_TEXT_ABSOLUTE32 = 2u
enumerator BIND_TYPE_TEXT_PCREL32 = 3u
enum MachO::LIEF::BIND_SPECIAL_DYLIB

Values:

enumerator BIND_SPECIAL_DYLIB_SELF = 0
enumerator BIND_SPECIAL_DYLIB_MAIN_EXECUTABLE = -1
enumerator BIND_SPECIAL_DYLIB_FLAT_LOOKUP = -2
enum MachO::LIEF::BIND_OPCODES

Opcodes used by Dyld info to bind symbols.

Values:

enumerator BIND_OPCODE_DONE = 0x00u

It’s finished.

enumerator BIND_OPCODE_SET_DYLIB_ORDINAL_IMM = 0x10u

Set ordinal to immediate (lower 4-bits). Used for ordinal numbers from 0-15.

enumerator BIND_OPCODE_SET_DYLIB_ORDINAL_ULEB = 0x20u

Set ordinal to following ULEB128 encoding. Used for ordinal numbers from 16+.

enumerator BIND_OPCODE_SET_DYLIB_SPECIAL_IMM = 0x30u

Set ordinal, with 0 or negative number as immediate. the value is sign extended.

enumerator BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM = 0x40u

Set the following symbol (NULL-terminated char*).

enumerator BIND_OPCODE_SET_TYPE_IMM = 0x50u

Set the type to immediate (lower 4-bits). See BIND_TYPES.

enumerator BIND_OPCODE_SET_ADDEND_SLEB = 0x60u

Set the addend field to the following SLEB128 encoding.

enumerator BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB = 0x70u

Set Segment to immediate value, and address to the following SLEB128 encoding.

enumerator BIND_OPCODE_ADD_ADDR_ULEB = 0x80u

Set the address field to the following SLEB128 encoding.

enumerator BIND_OPCODE_DO_BIND = 0x90u

Perform binding of current table row.

enumerator BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB = 0xA0u

Perform binding, also add following ULEB128 as address.

enumerator BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED = 0xB0u

Perform binding, also add immediate (lower 4-bits) using scaling.

enumerator BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB = 0xC0u

Perform binding for several symbols (as following ULEB128), and skip several bytes.

enum MachO::LIEF::EXPORT_SYMBOL_KINDS

Values:

enumerator EXPORT_SYMBOL_FLAGS_KIND_REGULAR = 0x00u
enumerator EXPORT_SYMBOL_FLAGS_KIND_THREAD_LOCAL = 0x01u
enumerator EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE = 0x02u
enum MachO::LIEF::EXPORT_SYMBOL_FLAGS

Values:

enumerator EXPORT_SYMBOL_FLAGS_KIND_MASK = 0x03u

Mask to access to EXPORT_SYMBOL_KINDS.

enumerator EXPORT_SYMBOL_FLAGS_WEAK_DEFINITION = 0x04u
enumerator EXPORT_SYMBOL_FLAGS_REEXPORT = 0x08u
enumerator EXPORT_SYMBOL_FLAGS_STUB_AND_RESOLVER = 0x10u
enum MachO::LIEF::VM_PROTECTIONS

Values for segment_command.initprot. From <mach/vm_prot.h>

Values:

enumerator VM_PROT_READ = 0x1

Reading data within the segment is allowed.

enumerator VM_PROT_WRITE = 0x2

Writing data within the segment is allowed.

enumerator VM_PROT_EXECUTE = 0x4

Executing data within the segment is allowed.

enum MachO::LIEF::SYMBOL_ORIGINS

Values:

enumerator SYM_ORIGIN_UNKNOWN = 0
enumerator SYM_ORIGIN_DYLD_EXPORT = 1
enumerator SYM_ORIGIN_LC_SYMTAB = 2