Struct lief::macho::commands::thread_command::ThreadCommand
pub struct ThreadCommand<'a> { /* private fields */ }
Expand description
Structure that represents the LC_THREAD
/ LC_UNIXTHREAD
commands and that
can be used to get the binary entrypoint when the LC_MAIN
is not present
Generally speaking, this command aims at defining the original state of the main thread which includes the registers’ values
Implementations§
§impl ThreadCommand<'_>
impl ThreadCommand<'_>
pub fn flavor(&self) -> u32
pub fn flavor(&self) -> u32
Integer that defines a special flavor for the thread.
The meaning of this value depends on the architecture. The list of the values can be found in the XNU kernel files:
- xnu/osfmk/mach/arm/thread_status.h for the ARM/AArch64 architectures
- xnu/osfmk/mach/i386/thread_status.h for the x86/x86-64 architectures
pub fn architecture(&self) -> CpuType
pub fn architecture(&self) -> CpuType
The CPU architecture that is targeted by this Thread Command
pub fn count(&self) -> u32
pub fn count(&self) -> u32
Size of the thread state data with 32-bits alignment.
This value should match state().len()
pub fn pc(&self) -> u64
pub fn pc(&self) -> u64
Return the initial Program Counter regardless of the underlying architecture. This value, when non null, can be used to determine the binary’s entrypoint.
Underneath, it works by looking for the PC register value in the ThreadCommand::state
data