Namespace related to the LIEF's Mach-O module. More...

Classes
class	Binary
	Class which represents a MachO binary. More...

class	BinaryParser
	Class used to parse a single binary (i.e. non-FAT) More...

class	BindingInfo
	Class that provides an interface over a binding operation. More...

class	Builder
	Class used to rebuild a Mach-O file. More...

class	BuildToolVersion
	Class that represents a tool's version that was involved in the build of the binary. More...

class	BuildVersion

class	ChainedBindingInfo
	This class represents a symbol binding operation associated with the LC_DYLD_CHAINED_FIXUPS command. More...

class	CodeSignature

class	CodeSignatureDir

class	DataCodeEntry
	Interface over an entry in the DataInCode command. More...

class	DataInCode
	Interface of the LC_DATA_IN_CODE command This command is used to list slices of code sections that contain data. The slices information are stored as an array of DataCodeEntry. More...

class	DyldBindingInfo
	This class represents a symbol binding operation associated with the LC_DYLD_INFO bytecode. More...

class	DyldChainedFixups
	Class that represents the LC_DYLD_CHAINED_FIXUPS command. More...

class	DyldEnvironment
	Class that represents a LC_DYLD_ENVIRONMENT which is used by the Mach-O linker/loader to initialize an environment variable. More...

class	DyldExportsTrie
	Class that represents the LC_DYLD_EXPORTS_TRIE command. More...

class	DyldInfo
	Class that represents the LC_DYLD_INFO and LC_DYLD_INFO_ONLY commands. More...

class	DylibCommand
	Class which represents a library dependency. More...

class	DylinkerCommand
	Class that represents the Mach-O linker, also named loader Most of the time, DylinkerCommand::name() returns `/usr/lib/dyld` More...

class	DynamicSymbolCommand
	Class that represents the LC_DYSYMTAB command. More...

class	EncryptionInfo
	Class that represents the LC_ENCRYPTION_INFO / LC_ENCRYPTION_INFO_64 commands. More...

class	ExportInfo
	Class that provides an interface over the Dyld export info. More...

class	FatBinary
	Class which represent a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are NOT FAT More...

class	FilesetCommand
	Class associated with the LC_FILESET_ENTRY commands. More...

class	FunctionStarts
	Class which represents the LC_FUNCTION_STARTS command. More...

class	Hash
	Class which implements a visitor to compute a deterministic hash for LIEF MachO objects. More...

class	Header
	Class that represents the Mach-O header. More...

class	LinkEdit

class	LinkerOptHint
	Class which represents the `LC_LINKER_OPTIMIZATION_HINT` command. More...

class	LoadCommand
	Based class for the Mach-O load commands. More...

class	MainCommand
	Class that represent the LC_MAIN command. This kind of command can be used to determine the entrypoint of an executable. More...

class	Parser
	The main interface to parse a Mach-O binary. More...

struct	ParserConfig
	This structure is used to tweak the MachO Parser (MachO::Parser) More...

class	Relocation
	Class that represents a Mach-O relocation. More...

class	RelocationDyld
	Class that represents a relocation found in the DyldInfo structure. More...

class	RelocationFixup
	Class that represents a rebase relocation found in the LC_DYLD_CHAINED_FIXUPS command. More...

class	RelocationObject
	Class that represents a relocation presents in the MachO object file (`.o`). Usually, this kind of relocation is found in the MachO::Section. More...

class	RPathCommand
	Class that represents the LC_RPATH command. More...

class	Section
	Class that represents a Mach-O section. More...

class	SegmentCommand
	Class which represents a LoadCommand::TYPE::SEGMENT / LoadCommand::TYPE::SEGMENT_64 command. More...

class	SegmentSplitInfo
	Class that represents the LoadCommand::TYPE::SEGMENT_SPLIT_INFO command. More...

class	SourceVersion
	Class that represents the MachO LoadCommand::TYPE::SOURCE_VERSION This command is used to provide the version of the sources used to build the binary. More...

class	SubFramework
	Class that represents the SubFramework command. Accodring to the Mach-O `loader.h` documentation: More...

class	Symbol
	Class that represents a Symbol in a Mach-O file. More...

class	SymbolCommand
	Class that represents the LC_SYMTAB command. More...

class	ThreadCommand
	Class that represents the LC_THREAD / LC_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC_MAIN (MainCommand) is not present. More...

class	TwoLevelHints
	Class which represents the `LC_TWOLEVEL_HINTS` command. More...

class	UUIDCommand
	Class that represents the UUID command. More...

class	VersionMin
	Class that wraps the LC_VERSION_MIN_MACOSX, LC_VERSION_MIN_IPHONEOS, ... commands. More...

Typedefs
using	buffer_t = std::vector<uint8_t>

using	uuid_t = std::array<uint8_t, 16>

Enumerations
enum class	DYLD_CHAINED_FORMAT { IMPORT = 1 , IMPORT_ADDEND = 2 , IMPORT_ADDEND64 = 3 }

enum	DYLD_CHAINED_PTR_FORMAT { PTR_ARM64E = 1 , PTR_64 = 2 , PTR_32 = 3 , PTR_32_CACHE = 4 , PTR_32_FIRMWARE = 5 , PTR_64_OFFSET = 6 , PTR_ARM64E_OFFSET = 7 , PTR_ARM64E_KERNEL = 7 , PTR_64_KERNEL_CACHE = 8 , PTR_ARM64E_USERLAND = 9 , PTR_ARM64E_FIRMWARE = 10 , PTR_X86_64_KERNEL_CACHE = 11 , PTR_ARM64E_USERLAND24 = 12 }

enum class	MACHO_TYPES : uint32_t { UNKNOWN = 0 , MH_MAGIC = 0xFEEDFACEu , MH_CIGAM = 0xCEFAEDFEu , MH_MAGIC_64 = 0xFEEDFACFu , MH_CIGAM_64 = 0xCFFAEDFEu , FAT_MAGIC = 0xCAFEBABEu , FAT_CIGAM = 0xBEBAFECAu }

enum class	N_LIST_TYPES : uint64_t { N_UNDF = 0x0u , N_ABS = 0x2u , N_SECT = 0xeu , N_PBUD = 0xcu , N_INDR = 0xau }
	Constants for the "n_type & SYMBOL_TYPES::N_TYPE" in nlist. More...

enum class	X86_RELOCATION { GENERIC_RELOC_VANILLA = 0 , GENERIC_RELOC_PAIR = 1 , GENERIC_RELOC_SECTDIFF = 2 , GENERIC_RELOC_PB_LA_PTR = 3 , GENERIC_RELOC_LOCAL_SECTDIFF = 4 , GENERIC_RELOC_TLV = 5 }

enum class	X86_64_RELOCATION { X86_64_RELOC_UNSIGNED = 0 , X86_64_RELOC_SIGNED = 1 , X86_64_RELOC_BRANCH = 2 , X86_64_RELOC_GOT_LOAD = 3 , X86_64_RELOC_GOT = 4 , X86_64_RELOC_SUBTRACTOR = 5 , X86_64_RELOC_SIGNED_1 = 6 , X86_64_RELOC_SIGNED_2 = 7 , X86_64_RELOC_SIGNED_4 = 8 , X86_64_RELOC_TLV = 9 }

enum class	PPC_RELOCATION { PPC_RELOC_VANILLA = 0 , PPC_RELOC_PAIR = 1 , PPC_RELOC_BR14 = 2 , PPC_RELOC_BR24 = 3 , PPC_RELOC_HI16 = 4 , PPC_RELOC_LO16 = 5 , PPC_RELOC_HA16 = 6 , PPC_RELOC_LO14 = 7 , PPC_RELOC_SECTDIFF = 8 , PPC_RELOC_PB_LA_PTR = 9 , PPC_RELOC_HI16_SECTDIFF = 10 , PPC_RELOC_LO16_SECTDIFF = 11 , PPC_RELOC_HA16_SECTDIFF = 12 , PPC_RELOC_JBSR = 13 , PPC_RELOC_LO14_SECTDIFF = 14 , PPC_RELOC_LOCAL_SECTDIFF = 15 }

enum class	ARM_RELOCATION { ARM_RELOC_VANILLA = 0 , ARM_RELOC_PAIR = 1 , ARM_RELOC_SECTDIFF = 2 , ARM_RELOC_LOCAL_SECTDIFF = 3 , ARM_RELOC_PB_LA_PTR = 4 , ARM_RELOC_BR24 = 5 , ARM_THUMB_RELOC_BR22 = 6 , ARM_THUMB_32BIT_BRANCH = 7 , ARM_RELOC_HALF = 8 , ARM_RELOC_HALF_SECTDIFF = 9 }

enum class	ARM64_RELOCATION { ARM64_RELOC_UNSIGNED = 0 , ARM64_RELOC_SUBTRACTOR = 1 , ARM64_RELOC_BRANCH26 = 2 , ARM64_RELOC_PAGE21 = 3 , ARM64_RELOC_PAGEOFF12 = 4 , ARM64_RELOC_GOT_LOAD_PAGE21 = 5 , ARM64_RELOC_GOT_LOAD_PAGEOFF12 = 6 , ARM64_RELOC_POINTER_TO_GOT = 7 , ARM64_RELOC_TLVP_LOAD_PAGE21 = 8 , ARM64_RELOC_TLVP_LOAD_PAGEOFF12 = 9 , ARM64_RELOC_ADDEND = 10 }

Functions
const char *	to_string (BuildToolVersion::TOOLS tool)

const char *	to_string (BuildVersion::PLATFORMS e)

const char *	to_string (DataCodeEntry::TYPES e)

const char *	to_string (DyldBindingInfo::CLASS e)

const char *	to_string (DyldBindingInfo::TYPE e)

const char *	to_string (DYLD_CHAINED_FORMAT fmt)

const char *	to_string (DYLD_CHAINED_PTR_FORMAT ptr_fmt)

const char *	to_string (DyldInfo::REBASE_TYPE e)

const char *	to_string (DyldInfo::REBASE_OPCODES e)

const char *	to_string (DyldInfo::BIND_OPCODES e)

const char *	to_string (DyldInfo::BIND_SUBOPCODE_THREADED e)

const char *	to_string (MACHO_TYPES e)

const char *	to_string (N_LIST_TYPES e)

const char *	to_string (X86_RELOCATION e)

const char *	to_string (X86_64_RELOCATION e)

const char *	to_string (PPC_RELOCATION e)

const char *	to_string (ARM_RELOCATION e)

const char *	to_string (ARM64_RELOCATION e)

const char *	to_string (ExportInfo::KIND kind)

const char *	to_string (ExportInfo::FLAGS flags)

const char *	to_string (Header::FILE_TYPE e)

const char *	to_string (Header::CPU_TYPE e)

const char *	to_string (Header::FLAGS e)

std::string	to_json (const Object &v)

const char *	to_string (LoadCommand::TYPE type)

const char *	to_string (Relocation::ORIGIN e)

const char *	to_string (Section::TYPE type)

const char *	to_string (Section::FLAGS flag)

const char *	to_string (SegmentCommand::FLAGS flag)

const char *	to_string (SegmentCommand::VM_PROTECTIONS protection)

const char *	to_string (Symbol::ORIGIN e)

const char *	to_string (Symbol::CATEGORY e)

bool	is_macho (BinaryStream &stream)
	Check if the given stream wraps a Mach-O binary.

bool	is_macho (const std::string &file)
	Check if the given file is a Mach-O binary.

bool	is_macho (const std::vector< uint8_t > &raw)
	Check if the given raw data is a Mach-O binary.

bool	is_fat (const std::string &file)
	Check if the given file is a FAT Mach-O.

bool	is_64 (const std::string &file)
	Check if the given Mach-O is 64-bits.

bool	check_layout (const Binary &binary, std::string *error=nullptr)
	Check the layout of the given Mach-O binary. It checks if it can be signed according to cctools-921/libstuff/checkout.c.

bool	check_layout (const FatBinary &binary, std::string *error=nullptr)
	Check the layout of the given FAT Mach-O by checking individually the layout of the binaries embedded in the FAT.

Detailed Description

Namespace related to the LIEF's Mach-O module.

Enumeration Type Documentation

◆ ARM64_RELOCATION

enum class LIEF::MachO::ARM64_RELOCATION

strong

Enumerator
ARM64_RELOC_UNSIGNED	For pointers.
ARM64_RELOC_SUBTRACTOR	Must be followed by an ARM64_RELOCATION::ARM64_RELOC_UNSIGNED
ARM64_RELOC_BRANCH26	A B/BL instruction with 26-bit displacement.
ARM64_RELOC_PAGE21	PC-rel distance to page of target.
ARM64_RELOC_PAGEOFF12	Offset within page, scaled by MachO::Relocation::size.
ARM64_RELOC_GOT_LOAD_PAGE21	PC-rel distance to page of GOT slot
ARM64_RELOC_GOT_LOAD_PAGEOFF12	Offset within page of GOT slot, scaled by MachO::Relocation::size.
ARM64_RELOC_POINTER_TO_GOT	For pointers to GOT slots.
ARM64_RELOC_TLVP_LOAD_PAGE21	PC-rel distance to page of TLVP slot.
ARM64_RELOC_TLVP_LOAD_PAGEOFF12	Offset within page of TLVP slot, scaled by MachO::Relocation::size.
ARM64_RELOC_ADDEND	Must be followed by ARM64_RELOCATION::ARM64_RELOC_PAGE21 or ARM64_RELOCATION::ARM64_RELOC_PAGEOFF12.

◆ MACHO_TYPES

enum class LIEF::MachO::MACHO_TYPES : uint32_t

strong

Enumerator
MH_MAGIC	32-bit big-endian magic
MH_CIGAM	32-bit little-endian magic
MH_MAGIC_64	64-bit big-endian magic
MH_CIGAM_64	64-bit little-endian magic
FAT_MAGIC	big-endian fat magic
FAT_CIGAM	little-endian fat magic

◆ N_LIST_TYPES

enum class LIEF::MachO::N_LIST_TYPES : uint64_t

strong

Constants for the "n_type & SYMBOL_TYPES::N_TYPE" in nlist.

See also: nlist

Enumerator
N_UNDF	The symbol is undefined. It is referenced in a different module.
N_ABS	The symbol is absolute. The linker doesn't update his value.
N_SECT	The symbol is defined in the section number given in nlist_base.n_sect .
N_PBUD	The symbol is undefined and the image is using a prebound value for the symbol. Set the n_sect field to NO_SECT .
N_INDR	The symbol is defined to be the same as another symbol. The n_value field is an index into the string table specifying the name of the other symbol. When that symbol is linked, both this and the other symbol point to the same defined type and value.

◆ X86_64_RELOCATION

enum class LIEF::MachO::X86_64_RELOCATION

strong

Enumerator
X86_64_RELOC_UNSIGNED	A CALL/JMP instruction with 32-bit displacement.
X86_64_RELOC_SIGNED	A MOVQ load of a GOT entry.
X86_64_RELOC_BRANCH	Other GOT references.
X86_64_RELOC_GOT_LOAD	Signed 32-bit displacement.
X86_64_RELOC_GOT	Absolute address.
X86_64_RELOC_SUBTRACTOR	Must be followed by a X86_64_RELOCATION::X86_64_RELOC_UNSIGNED relocation.

◆ X86_RELOCATION

enum class LIEF::MachO::X86_RELOCATION

strong

Enumerator
GENERIC_RELOC_VANILLA	A generic relocation entry for both addresses contained in data and addresses contained in CPU instructions.
GENERIC_RELOC_PAIR	The second relocation entry of a pair.
GENERIC_RELOC_SECTDIFF	A relocation entry for an item that contains the difference of two section addresses. This is generally used for position-independent code generation.
GENERIC_RELOC_PB_LA_PTR	contains the address from which to subtract; it must be followed by a X86_RELOCATION::GENERIC_RELOC_PAIR containing the address to subtract.
GENERIC_RELOC_LOCAL_SECTDIFF	Similar to X86_RELOCATION::GENERIC_RELOC_SECTDIFF except that this entry refers specifically to the address in this item. If the address is that of a globally visible coalesced symbol, this relocation entry does not change if the symbol is overridden. This is used to associate stack unwinding information with the object code this relocation entry describes.
GENERIC_RELOC_TLV	A relocation entry for a prebound lazy pointer. This is always a scattered relocation entry. The MachO::Relocation::value field contains the non-prebound value of the lazy pointer.

Classes

Typedefs

Enumerations

Functions

Detailed Description

Enumeration Type Documentation

◆ ARM64_RELOCATION

◆ MACHO_TYPES

◆ N_LIST_TYPES

◆ X86_64_RELOCATION

◆ X86_RELOCATION