LIEF::MachO Namespace Reference

Namespace related to the LIEF's Mach-O module. More...

Namespaces
namespace	details

Classes
class	AtomInfo
	Class which represents the LC_ATOM_INFO command. More...
class	Binary
	Class which represents a MachO binary. More...
class	BinaryParser
	Class used to parse a single binary (i.e. non-FAT) More...
class	BindingInfo
	Class that provides an interface over a binding operation. More...
class	BindingInfoIterator
class	Builder
	Class used to rebuild a Mach-O file. More...
class	BuildToolVersion
	Class that represents a tool's version that was involved in the build of the binary. More...
class	BuildVersion
class	ChainedBindingInfo
	This class represents a symbol binding operation associated with the LC_DYLD_CHAINED_FIXUPS command. More...
class	ChainedPointerAnalysis
class	CodeSignature
class	CodeSignatureDir
class	DataCodeEntry
	Interface over an entry in the DataInCode command. More...
class	DataInCode
	Interface of the LC_DATA_IN_CODE command This command is used to list slices of code sections that contain data. The slices information are stored as an array of DataCodeEntry. More...
class	DyldBindingInfo
	This class represents a symbol binding operation associated with the LC_DYLD_INFO bytecode. More...
class	DyldChainedFixups
	Class that represents the LC_DYLD_CHAINED_FIXUPS command. More...
class	DyldChainedFixupsCreator
class	DyldEnvironment
	Class that represents a LC_DYLD_ENVIRONMENT command which is used by the Mach-O linker/loader to initialize an environment variable. More...
class	DyldExportsTrie
	Class that represents the LC_DYLD_EXPORTS_TRIE command. More...
class	DyldInfo
	Class that represents the LC_DYLD_INFO and LC_DYLD_INFO_ONLY commands. More...
class	DylibCommand
	Class which represents a library dependency. More...
class	DylinkerCommand
	Class that represents the Mach-O linker, also named loader. Most of the time, DylinkerCommand::name() should return /usr/lib/dyld More...
class	DynamicSymbolCommand
	Class that represents the LC_DYSYMTAB command. More...
class	EncryptionInfo
	Class that represents the LC_ENCRYPTION_INFO / LC_ENCRYPTION_INFO_64 commands. More...
class	ExportInfo
	Class that provides an interface over the Dyld export info. More...
class	FatBinary
	Class which represent a Mach-O (fat) binary This object is also used for representing Mach-O binaries that are NOT FAT More...
class	FilesetCommand
	Class associated with the LC_FILESET_ENTRY commands. More...
class	FunctionStarts
	Class which represents the LC_FUNCTION_STARTS command. More...
class	Hash
	Class which implements a visitor to compute a deterministic hash for LIEF MachO objects. More...
class	Header
	Class that represents the Mach-O header. More...
class	IndirectBindingInfo
	This class represents a binding operation infered from the indirect symbol table. More...
class	LinkEdit
class	LinkerOptHint
	Class which represents the LC_LINKER_OPTIMIZATION_HINT command. More...
class	LoadCommand
	Based class for the Mach-O load commands. More...
class	MainCommand
	Class that represent the LC_MAIN command. This kind of command can be used to determine the entrypoint of an executable. More...
class	Parser
	The main interface to parse a Mach-O binary. More...
struct	ParserConfig
	This structure is used to tweak the MachO Parser (MachO::Parser) More...
class	Relocation
	Class that represents a Mach-O relocation. More...
class	RelocationDyld
	Class that represents a relocation found in the DyldInfo structure. More...
class	RelocationFixup
	Class that represents a rebase relocation found in the LC_DYLD_CHAINED_FIXUPS command. More...
class	RelocationObject
	Class that represents a relocation presents in the MachO object file (.o). Usually, this kind of relocation is found in the MachO::Section. More...
class	Routine
	Class that represents the LC_ROUTINE/LC_ROUTINE64 commands. Accodring to the Mach-O loader.h documentation: More...
class	RPathCommand
	Class that represents the LC_RPATH command. More...
class	Section
	Class that represents a Mach-O section. More...
class	SegmentCommand
	Class which represents a LoadCommand::TYPE::SEGMENT / LoadCommand::TYPE::SEGMENT_64 command. More...
class	SegmentSplitInfo
	Class that represents the LoadCommand::TYPE::SEGMENT_SPLIT_INFO command. More...
class	SourceVersion
	Class that represents the MachO LoadCommand::TYPE::SOURCE_VERSION This command is used to provide the version of the sources used to build the binary. More...
class	Stub
	This class represents a stub entry in sections like __stubs,__auth_stubs. More...
class	SubClient
	Class that represents the SubClient command. Accodring to the Mach-O loader.h documentation: More...
class	SubFramework
	Class that represents the SubFramework command. Accodring to the Mach-O loader.h documentation: More...
class	Symbol
	Class that represents a Symbol in a Mach-O file. More...
class	SymbolCommand
	Class that represents the LC_SYMTAB command. More...
class	ThreadCommand
	Class that represents the LC_THREAD / LC_UNIXTHREAD commands and that can be used to get the binary entrypoint when the LC_MAIN (MainCommand) is not present. More...
class	TwoLevelHints
	Class which represents the LC_TWOLEVEL_HINTS command. More...
class	UnknownCommand
	Generic class when the command is not recognized by LIEF. More...
class	UUIDCommand
	Class that represents the UUID command. More...
class	VersionMin
	Class that wraps the LC_VERSION_MIN_MACOSX, LC_VERSION_MIN_IPHONEOS, ... commands. More...

Typedefs
using	buffer_t = std::vector<uint8_t>
using	segment_callback_t
using	uuid_t = std::array<uint8_t, 16>

Enumerations
enum class	DYLD_CHAINED_FORMAT { IMPORT = 1 , IMPORT_ADDEND = 2 , IMPORT_ADDEND64 = 3 }
enum class	DYLD_CHAINED_PTR_FORMAT {   NONE = 0 , PTR_ARM64E = 1 , PTR_64 = 2 , PTR_32 = 3 ,   PTR_32_CACHE = 4 , PTR_32_FIRMWARE = 5 , PTR_64_OFFSET = 6 , PTR_ARM64E_OFFSET = 7 ,   PTR_ARM64E_KERNEL = 7 , PTR_64_KERNEL_CACHE = 8 , PTR_ARM64E_USERLAND = 9 , PTR_ARM64E_FIRMWARE = 10 ,   PTR_X86_64_KERNEL_CACHE = 11 , PTR_ARM64E_USERLAND24 = 12 , PTR_ARM64E_SHARED_CACHE = 13 }
enum class	MACHO_TYPES : uint32_t {   UNKNOWN = 0 , MH_MAGIC = 0xFEEDFACEu , MH_CIGAM = 0xCEFAEDFEu , MH_MAGIC_64 = 0xFEEDFACFu ,   MH_CIGAM_64 = 0xCFFAEDFEu , FAT_MAGIC = 0xCAFEBABEu , FAT_CIGAM = 0xBEBAFECAu , NEURAL_MODEL = 0xbeeffaceu }
enum class	X86_RELOCATION {   GENERIC_RELOC_VANILLA = 0 , GENERIC_RELOC_PAIR = 1 , GENERIC_RELOC_SECTDIFF = 2 , GENERIC_RELOC_PB_LA_PTR = 3 ,   GENERIC_RELOC_LOCAL_SECTDIFF = 4 , GENERIC_RELOC_TLV = 5 }
enum class	X86_64_RELOCATION {   X86_64_RELOC_UNSIGNED = 0 , X86_64_RELOC_SIGNED = 1 , X86_64_RELOC_BRANCH = 2 , X86_64_RELOC_GOT_LOAD = 3 ,   X86_64_RELOC_GOT = 4 , X86_64_RELOC_SUBTRACTOR = 5 , X86_64_RELOC_SIGNED_1 = 6 , X86_64_RELOC_SIGNED_2 = 7 ,   X86_64_RELOC_SIGNED_4 = 8 , X86_64_RELOC_TLV = 9 }
enum class	PPC_RELOCATION {   PPC_RELOC_VANILLA = 0 , PPC_RELOC_PAIR = 1 , PPC_RELOC_BR14 = 2 , PPC_RELOC_BR24 = 3 ,   PPC_RELOC_HI16 = 4 , PPC_RELOC_LO16 = 5 , PPC_RELOC_HA16 = 6 , PPC_RELOC_LO14 = 7 ,   PPC_RELOC_SECTDIFF = 8 , PPC_RELOC_PB_LA_PTR = 9 , PPC_RELOC_HI16_SECTDIFF = 10 , PPC_RELOC_LO16_SECTDIFF = 11 ,   PPC_RELOC_HA16_SECTDIFF = 12 , PPC_RELOC_JBSR = 13 , PPC_RELOC_LO14_SECTDIFF = 14 , PPC_RELOC_LOCAL_SECTDIFF = 15 }
enum class	ARM_RELOCATION {   ARM_RELOC_VANILLA = 0 , ARM_RELOC_PAIR = 1 , ARM_RELOC_SECTDIFF = 2 , ARM_RELOC_LOCAL_SECTDIFF = 3 ,   ARM_RELOC_PB_LA_PTR = 4 , ARM_RELOC_BR24 = 5 , ARM_THUMB_RELOC_BR22 = 6 , ARM_THUMB_32BIT_BRANCH = 7 ,   ARM_RELOC_HALF = 8 , ARM_RELOC_HALF_SECTDIFF = 9 }
enum class	ARM64_RELOCATION {   ARM64_RELOC_UNSIGNED = 0 , ARM64_RELOC_SUBTRACTOR = 1 , ARM64_RELOC_BRANCH26 = 2 , ARM64_RELOC_PAGE21 = 3 ,   ARM64_RELOC_PAGEOFF12 = 4 , ARM64_RELOC_GOT_LOAD_PAGE21 = 5 , ARM64_RELOC_GOT_LOAD_PAGEOFF12 = 6 , ARM64_RELOC_POINTER_TO_GOT = 7 ,   ARM64_RELOC_TLVP_LOAD_PAGE21 = 8 , ARM64_RELOC_TLVP_LOAD_PAGEOFF12 = 9 , ARM64_RELOC_ADDEND = 10 }

Functions
const char *	to_string (BuildToolVersion::TOOLS tool)
const char *	to_string (BuildVersion::PLATFORMS e)
const char *	to_string (DataCodeEntry::TYPES e)
const char *	to_string (DyldBindingInfo::CLASS e)
const char *	to_string (DyldBindingInfo::TYPE e)
const char *	to_string (DYLD_CHAINED_FORMAT fmt)
const char *	to_string (DYLD_CHAINED_PTR_FORMAT ptr_fmt)
const char *	to_string (DyldInfo::REBASE_TYPE e)
const char *	to_string (DyldInfo::REBASE_OPCODES e)
const char *	to_string (DyldInfo::BIND_OPCODES e)
const char *	to_string (DyldInfo::BIND_SUBOPCODE_THREADED e)
const char *	to_string (MACHO_TYPES e)
const char *	to_string (X86_RELOCATION e)
const char *	to_string (X86_64_RELOCATION e)
const char *	to_string (PPC_RELOCATION e)
const char *	to_string (ARM_RELOCATION e)
const char *	to_string (ARM64_RELOCATION e)
const char *	to_string (ExportInfo::KIND kind)
const char *	to_string (ExportInfo::FLAGS flags)
const char *	to_string (Header::FILE_TYPE e)
const char *	to_string (Header::CPU_TYPE e)
const char *	to_string (Header::FLAGS e)
std::string	to_json (const Object &v)
const char *	to_string (LoadCommand::TYPE type)
const char *	to_string (Relocation::ORIGIN e)
const char *	to_string (Section::TYPE type)
const char *	to_string (Section::FLAGS flag)
const char *	to_string (SegmentCommand::FLAGS flag)
const char *	to_string (SegmentCommand::VM_PROTECTIONS protection)
const char *	to_string (Symbol::ORIGIN e)
const char *	to_string (Symbol::CATEGORY e)
const char *	to_string (Symbol::TYPE e)
bool	is_macho (BinaryStream &stream)
	Check if the given stream wraps a Mach-O binary.
bool	is_macho (const std::string &file)
	Check if the given file is a Mach-O binary.
bool	is_macho (const std::vector< uint8_t > &raw)
	Check if the given raw data is a Mach-O binary.
bool	is_fat (const std::string &file)
	Check if the given file is a FAT Mach-O.
bool	is_64 (const std::string &file)
	Check if the given Mach-O is 64-bits.
bool	is_64 (BinaryStream &stream)
bool	check_layout (const Binary &binary, std::string *error=nullptr)
	Check the layout of the given Mach-O binary. It checks if it can be signed according to cctools-921/libstuff/checkout.c.
bool	check_layout (const FatBinary &binary, std::string *error=nullptr)
	Check the layout of the given FAT Mach-O by checking individually the layout of the binaries embedded in the FAT.
void	foreach_segment (BinaryStream &stream, const segment_callback_t cbk)

Detailed Description

Namespace related to the LIEF's Mach-O module.

Typedef Documentation

buffer_t

using LIEF::MachO::buffer_t = std::vector<uint8_t>

segment_callback_t

using LIEF::MachO::segment_callback_t

Initial value:

 std::function<
  void(const std::string& name, uint64_t offset, uint64_t size, uint64_t addr, uint64_t vsize)
>

uuid_t

using LIEF::MachO::uuid_t = std::array<uint8_t, 16>

Enumeration Type Documentation

ARM64_RELOCATION

enum class LIEF::MachO::ARM64_RELOCATION

strong

Enumerator
ARM64_RELOC_UNSIGNED	For pointers.
ARM64_RELOC_SUBTRACTOR	Must be followed by an ARM64_RELOCATION::ARM64_RELOC_UNSIGNED
ARM64_RELOC_BRANCH26	A B/BL instruction with 26-bit displacement.
ARM64_RELOC_PAGE21	PC-rel distance to page of target.
ARM64_RELOC_PAGEOFF12	Offset within page, scaled by MachO::Relocation::size.
ARM64_RELOC_GOT_LOAD_PAGE21	PC-rel distance to page of GOT slot
ARM64_RELOC_GOT_LOAD_PAGEOFF12	Offset within page of GOT slot, scaled by MachO::Relocation::size.
ARM64_RELOC_POINTER_TO_GOT	For pointers to GOT slots.
ARM64_RELOC_TLVP_LOAD_PAGE21	PC-rel distance to page of TLVP slot.
ARM64_RELOC_TLVP_LOAD_PAGEOFF12	Offset within page of TLVP slot, scaled by MachO::Relocation::size.
ARM64_RELOC_ADDEND	Must be followed by ARM64_RELOCATION::ARM64_RELOC_PAGE21 or ARM64_RELOCATION::ARM64_RELOC_PAGEOFF12.

ARM_RELOCATION

enum class LIEF::MachO::ARM_RELOCATION

strong

Enumerator
ARM_RELOC_VANILLA
ARM_RELOC_PAIR
ARM_RELOC_SECTDIFF
ARM_RELOC_LOCAL_SECTDIFF
ARM_RELOC_PB_LA_PTR
ARM_RELOC_BR24
ARM_THUMB_RELOC_BR22
ARM_THUMB_32BIT_BRANCH
ARM_RELOC_HALF
ARM_RELOC_HALF_SECTDIFF

DYLD_CHAINED_FORMAT

enum class LIEF::MachO::DYLD_CHAINED_FORMAT

strong

Enumerator
IMPORT
IMPORT_ADDEND
IMPORT_ADDEND64

DYLD_CHAINED_PTR_FORMAT

enum class LIEF::MachO::DYLD_CHAINED_PTR_FORMAT

strong

Enumerator
NONE
PTR_ARM64E
PTR_64
PTR_32
PTR_32_CACHE
PTR_32_FIRMWARE
PTR_64_OFFSET
PTR_ARM64E_OFFSET
PTR_ARM64E_KERNEL
PTR_64_KERNEL_CACHE
PTR_ARM64E_USERLAND
PTR_ARM64E_FIRMWARE
PTR_X86_64_KERNEL_CACHE
PTR_ARM64E_USERLAND24
PTR_ARM64E_SHARED_CACHE

MACHO_TYPES

enum class LIEF::MachO::MACHO_TYPES : uint32_t

strong

Enumerator
UNKNOWN
MH_MAGIC	32-bit big-endian magic
MH_CIGAM	32-bit little-endian magic
MH_MAGIC_64	64-bit big-endian magic
MH_CIGAM_64	64-bit little-endian magic
FAT_MAGIC	big-endian fat magic
FAT_CIGAM	little-endian fat magic
NEURAL_MODEL

PPC_RELOCATION

enum class LIEF::MachO::PPC_RELOCATION

strong

Enumerator
PPC_RELOC_VANILLA
PPC_RELOC_PAIR
PPC_RELOC_BR14
PPC_RELOC_BR24
PPC_RELOC_HI16
PPC_RELOC_LO16
PPC_RELOC_HA16
PPC_RELOC_LO14
PPC_RELOC_SECTDIFF
PPC_RELOC_PB_LA_PTR
PPC_RELOC_HI16_SECTDIFF
PPC_RELOC_LO16_SECTDIFF
PPC_RELOC_HA16_SECTDIFF
PPC_RELOC_JBSR
PPC_RELOC_LO14_SECTDIFF
PPC_RELOC_LOCAL_SECTDIFF

X86_64_RELOCATION

enum class LIEF::MachO::X86_64_RELOCATION

strong

Enumerator
X86_64_RELOC_UNSIGNED	A CALL/JMP instruction with 32-bit displacement.
X86_64_RELOC_SIGNED	A MOVQ load of a GOT entry.
X86_64_RELOC_BRANCH	Other GOT references.
X86_64_RELOC_GOT_LOAD	Signed 32-bit displacement.
X86_64_RELOC_GOT	Absolute address.
X86_64_RELOC_SUBTRACTOR	Must be followed by a X86_64_RELOCATION::X86_64_RELOC_UNSIGNED relocation.
X86_64_RELOC_SIGNED_1
X86_64_RELOC_SIGNED_2
X86_64_RELOC_SIGNED_4
X86_64_RELOC_TLV

X86_RELOCATION

enum class LIEF::MachO::X86_RELOCATION

strong

Enumerator
GENERIC_RELOC_VANILLA	A generic relocation entry for both addresses contained in data and addresses contained in CPU instructions.
GENERIC_RELOC_PAIR	The second relocation entry of a pair.
GENERIC_RELOC_SECTDIFF	A relocation entry for an item that contains the difference of two section addresses. This is generally used for position-independent code generation.
GENERIC_RELOC_PB_LA_PTR	contains the address from which to subtract; it must be followed by a X86_RELOCATION::GENERIC_RELOC_PAIR containing the address to subtract.
GENERIC_RELOC_LOCAL_SECTDIFF	Similar to X86_RELOCATION::GENERIC_RELOC_SECTDIFF except that this entry refers specifically to the address in this item. If the address is that of a globally visible coalesced symbol, this relocation entry does not change if the symbol is overridden. This is used to associate stack unwinding information with the object code this relocation entry describes.
GENERIC_RELOC_TLV	A relocation entry for a prebound lazy pointer. This is always a scattered relocation entry. The MachO::Relocation::value field contains the non-prebound value of the lazy pointer.

Function Documentation

check_layout() [1/2]

bool LIEF::MachO::check_layout	(	const Binary &	binary,
		std::string *	error = nullptr )

Check the layout of the given Mach-O binary. It checks if it can be signed according to cctools-921/libstuff/checkout.c.

check_layout() [2/2]

bool LIEF::MachO::check_layout	(	const FatBinary &	binary,
		std::string *	error = nullptr )

Check the layout of the given FAT Mach-O by checking individually the layout of the binaries embedded in the FAT.

foreach_segment()

void LIEF::MachO::foreach_segment	(	BinaryStream &	stream,
		const segment_callback_t	cbk )

is_64() [1/2]

bool LIEF::MachO::is_64

(

BinaryStream &

stream

)

is_64() [2/2]

bool LIEF::MachO::is_64

(

const std::string &

file

)

Check if the given Mach-O is 64-bits.

is_fat()

bool LIEF::MachO::is_fat

(

const std::string &

file

)

Check if the given file is a FAT Mach-O.

is_macho() [1/3]

bool LIEF::MachO::is_macho

(

BinaryStream &

stream

)

Check if the given stream wraps a Mach-O binary.

is_macho() [2/3]

bool LIEF::MachO::is_macho

(

const std::string &

file

)

Check if the given file is a Mach-O binary.

is_macho() [3/3]

bool LIEF::MachO::is_macho

(

const std::vector< uint8_t > &

raw

)

Check if the given raw data is a Mach-O binary.

to_json()

std::string LIEF::MachO::to_json

(

const Object &

v

)

to_string() [1/31]

const char * LIEF::MachO::to_string

(

ARM64_RELOCATION

e

)

to_string() [2/31]

const char * LIEF::MachO::to_string

(

ARM_RELOCATION

e

)

to_string() [3/31]

const char * LIEF::MachO::to_string

(

BuildToolVersion::TOOLS

tool

)

to_string() [4/31]

const char * LIEF::MachO::to_string

(

BuildVersion::PLATFORMS

e

)

to_string() [5/31]

const char * LIEF::MachO::to_string

(

DataCodeEntry::TYPES

e

)

to_string() [6/31]

const char * LIEF::MachO::to_string

(

DYLD_CHAINED_FORMAT

fmt

)

to_string() [7/31]

const char * LIEF::MachO::to_string

(

DYLD_CHAINED_PTR_FORMAT

ptr_fmt

)

to_string() [8/31]

const char * LIEF::MachO::to_string

(

DyldBindingInfo::CLASS

e

)

to_string() [9/31]

const char * LIEF::MachO::to_string

(

DyldBindingInfo::TYPE

e

)

to_string() [10/31]

const char * LIEF::MachO::to_string

(

DyldInfo::BIND_OPCODES

e

)

to_string() [11/31]

const char * LIEF::MachO::to_string

(

DyldInfo::BIND_SUBOPCODE_THREADED

e

)

to_string() [12/31]

const char * LIEF::MachO::to_string

(

DyldInfo::REBASE_OPCODES

e

)

to_string() [13/31]

const char * LIEF::MachO::to_string

(

DyldInfo::REBASE_TYPE

e

)

to_string() [14/31]

const char * LIEF::MachO::to_string

(

ExportInfo::FLAGS

flags

)

to_string() [15/31]

const char * LIEF::MachO::to_string

(

ExportInfo::KIND

kind

)

to_string() [16/31]

const char * LIEF::MachO::to_string

(

Header::CPU_TYPE

e

)

to_string() [17/31]

const char * LIEF::MachO::to_string

(

Header::FILE_TYPE

e

)

to_string() [18/31]

const char * LIEF::MachO::to_string

(

Header::FLAGS

e

)

to_string() [19/31]

const char * LIEF::MachO::to_string

(

LoadCommand::TYPE

type

)

to_string() [20/31]

const char * LIEF::MachO::to_string

(

MACHO_TYPES

e

)

to_string() [21/31]

const char * LIEF::MachO::to_string

(

PPC_RELOCATION

e

)

to_string() [22/31]

const char * LIEF::MachO::to_string

(

Relocation::ORIGIN

e

)

to_string() [23/31]

const char * LIEF::MachO::to_string

(

Section::FLAGS

flag

)

to_string() [24/31]

const char * LIEF::MachO::to_string

(

Section::TYPE

type

)

to_string() [25/31]

const char * LIEF::MachO::to_string

(

SegmentCommand::FLAGS

flag

)

to_string() [26/31]

const char * LIEF::MachO::to_string

(

SegmentCommand::VM_PROTECTIONS

protection

)

to_string() [27/31]

const char * LIEF::MachO::to_string

(

Symbol::CATEGORY

e

)

to_string() [28/31]

const char * LIEF::MachO::to_string

(

Symbol::ORIGIN

e

)

to_string() [29/31]

const char * LIEF::MachO::to_string

(

Symbol::TYPE

e

)

to_string() [30/31]

const char * LIEF::MachO::to_string

(

X86_64_RELOCATION

e

)

to_string() [31/31]

const char * LIEF::MachO::to_string

(

X86_RELOCATION

e

)