//
// main.cpp
// mach-o
//
// Created by Allenboy on 2018/4/16.
// Copyright 2018年 Allenboy. All rights reserved.
//
#include <stdio.h>
#include <stdlib.h>
#include <mach-o/loader.h>
#include <mach-o/swap.h>
#include <mach-o/fat.h>
//解析segments
//struct segment_command_64 { /* for 64-bit architectures */
// uint32_t cmd; /* LC_SEGMENT_64 */
// uint32_t cmdsize; /* includes sizeof section_64 structs */
// char segname[16]; /* segment name */
// uint64_t vmaddr; /* memory address of this segment */
// uint64_t vmsize; /* memory size of this segment */
// uint64_t fileoff; /* file offset of this segment */
// uint64_t filesize; /* amount to map from the file */
// vm_prot_t maxprot; /* maximum VM protection */
// vm_prot_t initprot; /* initial VM protection */
// uint32_t nsects; /* number of sections in segment */
// uint32_t flags; /* flags */
//};
void dump_segments(FILE *obj_file);
//----------------------------------------------------------------------main------------------------------------------------------------------------------//
int main(int argc, char *argv[]) {
const char *filename ="/Applications/Notes.app/Contents/MacOS/Notes";
//打开一个 mach-o 文件
FILE *obj_file = fopen(filename, "rb");
//解析
dump_segments(obj_file);
//关闭
fclose(obj_file);
return 0;
}
//读文件头magic
uint32_t read_magic(FILE *obj_file, int offset) {
uint32_t magic;
fseek(obj_file, offset, SEEK_SET);
fread(&magic, sizeof(uint32_t), 1, obj_file);
return magic;
}
//判断是多少位
int is_magic_64(uint32_t magic) {
return magic == MH_MAGIC_64 || magic == MH_CIGAM_64;
}
//要让 Linux 系统访问虚拟内存,则必须有一个交换分区,当内存(RAM)用完的时候,将硬盘中指定分区(即 Swap 分区)当做内存来使用。因此,当有足够的系统内存(RAM)来满足系统的所有的需求时,我们并不需要划分交换分区。尽管如此,是否使用交换分区取决于管理员。
//判断要用哪各格式去虚拟分区
int should_swap_bytes(uint32_t magic) {
return magic == MH_CIGAM || magic == MH_CIGAM_64 || magic == FAT_CIGAM;
}
//判断是胖二进制(fat)还是普通二进制
int is_fat(uint32_t magic) {
return magic == FAT_MAGIC || magic == FAT_CIGAM;
}
//cpu 类型
struct _cpu_type_names {
cpu_type_t cputype;
const char *cpu_name;
};
static struct _cpu_type_names cpu_type_names[] = {
{ CPU_TYPE_I386, "i386" },
{ CPU_TYPE_X86_64, "x86_64" },
{ CPU_TYPE_ARM, "arm" },
{ CPU_TYPE_ARM64, "arm64" }
};
//找出cpu 类型名称
static const char *cpu_type_name(cpu_type_t cpu_type) {
static int cpu_type_names_size = sizeof(cpu_type_names) / sizeof(struct _cpu_type_names);
for (int i = 0; i < cpu_type_names_size; i++ ) {
if (cpu_type == cpu_type_names[i].cputype) {
return cpu_type_names[i].cpu_name;
}
}
return "unknown";
}
//根据结构体大小解析的
void *load_bytes(FILE *obj_file, int offset, int size) {
//分配 1 块size大小的内存
void *buf = calloc(1, size);
fseek(obj_file, offset, SEEK_SET);
fread(buf, size, 1, obj_file);
return buf;
}
//解析segment_command
void dump_segment_commands(FILE *obj_file, int offset, int is_swap, uint32_t ncmds) {
int actual_offset = offset;
//解析所有命令
printf("---------------------------------------segment_command_64-----------------------------------\n");
for (int i = 0; i < ncmds; i++) {
struct load_command *cmd = load_bytes(obj_file, actual_offset, sizeof(struct load_command));
if (is_swap) {
swap_load_command(cmd, 0);
}
//判断是哪种命令
//#define LC_LOAD_WEAK_DYLIB (0x18 | LC_REQ_DYLD)
//
//#define LC_SEGMENT_64 0x19 /* 64-bit segment of this file to be
//mapped */
//#define LC_ROUTINES_64 0x1a /* 64-bit image routines */
//#define LC_UUID 0x1b /* the uuid */
//#define LC_RPATH (0x1c | LC_REQ_DYLD) /* runpath additions */
//#define LC_CODE_SIGNATURE 0x1d /* local of code signature */
//#define LC_SEGMENT_SPLIT_INFO 0x1e /* local of info to split segments */
//#define LC_REEXPORT_DYLIB (0x1f | LC_REQ_DYLD) /* load and re-export dylib */
//#define LC_LAZY_LOAD_DYLIB 0x20 /* delay load of dylib until first use */
//#define LC_ENCRYPTION_INFO 0x21 /* encrypted segment information */
//#define LC_DYLD_INFO 0x22 /* compressed dyld information */
//#define LC_DYLD_INFO_ONLY (0x22|LC_REQ_DYLD) /* compressed dyld information only */
//#define LC_LOAD_UPWARD_DYLIB (0x23 | LC_REQ_DYLD) /* load upward dylib */
//#define LC_VERSION_MIN_MACOSX 0x24 /* build for MacOSX min OS version */
//#define LC_VERSION_MIN_IPHONEOS 0x25 /* build for iPhoneOS min OS version */
//#define LC_FUNCTION_STARTS 0x26 /* compressed table of function start addresses */
//#define LC_DYLD_ENVIRONMENT 0x27 /* string for dyld to treat
//like environment variable */
//#define LC_MAIN (0x28|LC_REQ_DYLD) /* replacement for LC_UNIXTHREAD */
//#define LC_DATA_IN_CODE 0x29 /* table of non-instructions in __text */
//#define LC_SOURCE_VERSION 0x2A /* source version used to build binary */
//#define LC_DYLIB_CODE_SIGN_DRS 0x2B /* Code signing DRs copied from linked dylibs */
//#define LC_ENCRYPTION_INFO_64 0x2C /* 64-bit encrypted segment information */
//#define LC_LINKER_OPTION 0x2D /* linker options in MH_OBJECT files */
//#define LC_LINKER_OPTIMIZATION_HINT 0x2E /* optimization hints in MH_OBJECT files */
//#define LC_VERSION_MIN_TVOS 0x2F /* build for AppleTV min OS version */
//#define LC_VERSION_MIN_WATCHOS 0x30 /* build for Watch min OS version */
//#define LC_NOTE 0x31 /* arbitrary data included within a Mach-O file */
//#define LC_BUILD_VERSION 0x32 /* build for platform min OS version */
if (cmd->cmd == LC_SEGMENT_64) {
struct segment_command_64 *segment = load_bytes(obj_file, actual_offset, sizeof(struct segment_command_64));
if (is_swap) {
swap_segment_command_64(segment, 0);
}
// struct segment_command_64 { /* for 64-bit architectures */
// uint32_t cmd; /* LC_SEGMENT_64 */
// uint32_t cmdsize; /* includes sizeof section_64 structs */
// char segname[16]; /* segment name */
// uint64_t vmaddr; /* memory address of this segment */
// uint64_t vmsize; /* memory size of this segment */
// uint64_t fileoff; /* file offset of this segment */
// uint64_t filesize; /* amount to map from the file */
// vm_prot_t maxprot; /* maximum VM protection */
// vm_prot_t initprot; /* initial VM protection */
// uint32_t nsects; /* number of sections in segment */
// uint32_t flags; /* flags */
// };
//-----------------------------------------------------------------------------------------------------------------------
printf("------------------------------------LC_SEGMENT_64-------------------------------------------\n");
printf("uint32_t cmd; %x\n",segment->cmd);
printf("uint32_t cmdsize; %x\n",segment->cmdsize);
printf("char segname[16]; %s\n",segment->segname);
printf("uint64_t vmaddr; %llx\n",segment->vmaddr);
printf("uint64_t vmsize; %llx\n",segment->vmsize);
printf("uint64_t fileoff; %llx\n",segment->fileoff);
printf("uint64_t filesize; %llx\n",segment->filesize);
printf("vm_prot_t maxprot; %x\n",segment->maxprot);
printf("vm_prot_t initprot; %x\n",segment->initprot);
printf("uint32_t nsects; %x\n",segment->nsects);
printf("uint32_t flags; %x\n",segment->flags);
//------------------------------------------------------------------------------------------------------------------------
printf("segname: %s\n", segment->segname);
for (int i=0; i<segment->nsects; i++) {
// struct section_64 { /* for 64-bit architectures */
// char sectname[16]; /* name of this section */
// char segname[16]; /* segment this section goes in */
// uint64_t addr; /* memory address of this section */
// uint64_t size; /* size in bytes of this section */
// uint32_t offset; /* file offset of this section */
// uint32_t align; /* section alignment (power of 2) */
// uint32_t reloff; /* file offset of relocation entries */
// uint32_t nreloc; /* number of relocation entries */
// uint32_t flags; /* flags (section type and attributes)*/
// uint32_t reserved1; /* reserved (for offset or index) */
// uint32_t reserved2; /* reserved (for count or sizeof) */
// uint32_t reserved3; /* reserved */
// };
//当前的地址
// struct section_64 * mysection = load_bytes(obj_file, actual_offset, sizeof(struct section_64));
}
free(segment);
} else if (cmd->cmd == LC_SEGMENT) {
struct segment_command *segment = load_bytes(obj_file, actual_offset, sizeof(struct segment_command));
if (is_swap) {
swap_segment_command(segment, 0);
}
// struct segment_command { /* for 32-bit architectures */
// uint32_t cmd; /* LC_SEGMENT */
// uint32_t cmdsize; /* includes sizeof section structs */
// char segname[16]; /* segment name */
// uint32_t vmaddr; /* memory address of this segment */
// uint32_t vmsize; /* memory size of this segment */
// uint32_t fileoff; /* file offset of this segment */
// uint32_t filesize; /* amount to map from the file */
// vm_prot_t maxprot; /* maximum VM protection */
// vm_prot_t initprot; /* initial VM protection */
// uint32_t nsects; /* number of sections in segment */
// uint32_t flags; /* flags */
// };
//-----------------------------------------------------------------------------------------------------------------------
printf("-------------------------------------LC_SEGMENT---------------------------------------------\n");
printf("uint32_t cmd; %x\n",segment->cmd);
printf("uint32_t cmdsize; %x\n",segment->cmdsize);
printf("char segname[16]; %s\n",segment->segname);
printf("uint64_t vmaddr; %x\n",segment->vmaddr);
printf("uint64_t vmsize; %x\n",segment->vmsize);
printf("uint64_t fileoff; %x\n",segment->fileoff);
printf("uint64_t filesize; %x\n",segment->filesize);
printf("vm_prot_t maxprot; %x\n",segment->maxprot);
printf("vm_prot_t initprot; %x\n",segment->initprot);
printf("uint32_t nsects; %x\n",segment->nsects);
printf("uint32_t flags; %x\n",segment->flags);
//------------------------------------------------------------------------------------------------------------------------
printf("segname: %s\n", segment->segname);
free(segment);
}
else if (cmd->cmd == LC_IDFVMLIB||cmd->cmd == LC_LOADFVMLIB) {
struct fvmlib_command *segment = load_bytes(obj_file, actual_offset, sizeof(struct fvmlib_command));
if (is_swap) {
swap_fvmlib_command(segment, 0);
}
// struct fvmlib_command {
// uint32_t cmd; /* LC_IDFVMLIB or LC_LOADFVMLIB */
// uint32_t cmdsize; /* includes pathname string */
// struct fvmlib fvmlib; /* the library identification */
// };
//-----------------------------------------------------------------------------------------------------------------------
printf("-------------------------------------LC_SEGMENT---------------------------------------------\n");
printf("uint32_t cmd; %x\n",segment->cmd);
printf("uint32_t cmdsize; %x\n",segment->cmdsize);
printf("struct fvmlib fvmlib; %x\n",segment->fvmlib);
//------------------------------------------------------------------------------------------------------------------------
free(segment);
}
else if (cmd->cmd == LC_ID_DYLIB||cmd->cmd == LC_REEXPORT_DYLIB||cmd->cmd == LC_LOAD_UPWARD_DYLIB) {
struct dylib_command *segment = load_bytes(obj_file, actual_offset, sizeof(struct dylib_command));
if (is_swap) {
swap_dylib_command(segment, 0);
}
// struct dylib_command {
// uint32_t cmd; /* LC_ID_DYLIB, LC_LOAD_{,WEAK_}DYLIB,
// LC_REEXPORT_DYLIB */
// uint32_t cmdsize; /* includes pathname string */
// struct dylib dylib; /* the library identification */
// };
//-----------------------------------------------------------------------------------------------------------------------
printf("-------------------------------------LC_ID_DYLIB---------------------------------------------\n");
printf("uint32_t cmd; %x\n",segment->cmd);
printf("uint32_t cmdsize; %x\n",segment->cmdsize);
printf("struct dylib dylib; %x\n",segment->dylib);
//------------------------------------------------------------------------------------------------------------------------
free(segment);
}
//加上当前的cmdsize到就是下一个命令
actual_offset += cmd->cmdsize;
free(cmd);
}
}
//解析mach头
void dump_mach_header(FILE *obj_file, int offset, int is_64, int is_swap) {
uint32_t ncmds;
//加载命令偏移
int load_commands_offset = offset;
if (is_64) {//64 位
int header_size = sizeof(struct mach_header_64);
struct mach_header_64 *header = load_bytes(obj_file, offset, header_size);
if (is_swap) {
swap_mach_header_64(header, 0);
}
// struct mach_header_64 {
// uint32_t magic; /* mach magic number identifier */
// cpu_type_t cputype; /* cpu specifier */
// cpu_subtype_t cpusubtype; /* machine specifier */
// uint32_t filetype; /* type of file */
// uint32_t ncmds; /* number of load commands */
// uint32_t sizeofcmds; /* the size of all the load commands */
// uint32_t flags; /* flags */
// uint32_t reserved; /* reserved */
// };
//-----------------------------------------------------------------------------------------------------------------------
printf("------------------------------------mach_header_64------------------------------------------\n");
printf("uint32_t magic; %x\n",header->magic);
printf("cpu_type_t cputype; %x\n",header->cputype);
printf("cpu_subtype_t cpusubtype; %x\n",header->cpusubtype);
printf("uint32_t filetype; %x\n",header->filetype);
printf("uint32_t ncmds; %x\n",header->ncmds);
printf("uint32_t sizeofcmds; %x\n",header->sizeofcmds);
printf("uint32_t flags; %x\n",header->flags);
printf("uint32_t reserved; %x\n",header->reserved);
//------------------------------------------------------------------------------------------------------------------------
//加载命令个数
ncmds = header->ncmds;
//++
load_commands_offset += header_size;
//打印 cpu 类型
printf("%s\n", cpu_type_name(header->cputype));
//
free(header);
} else {//32 位
int header_size = sizeof(struct mach_header);
struct mach_header *header = load_bytes(obj_file, offset, header_size);
if (is_swap) {
swap_mach_header(header, 0);
}
// struct mach_header {
// uint32_t magic; /* mach magic number identifier */
// cpu_type_t cputype; /* cpu specifier */
// cpu_subtype_t cpusubtype; /* machine specifier */
// uint32_t filetype; /* type of file */
// uint32_t ncmds; /* number of load commands */
// uint32_t sizeofcmds; /* the size of all the load commands */
// uint32_t flags; /* flags */
// };
//-----------------------------------------------------------------------------------------------------------------------
printf("------------------------------------mach_header_32----------------------------------------------\n");
printf("uint32_t magic; %x\n",header->magic);
printf("cpu_type_t cputype; %x\n",header->cputype);
printf("cpu_subtype_t cpusubtype; %x\n",header->cpusubtype);
printf("uint32_t filetype; %x\n",header->filetype);
printf("uint32_t ncmds; %x\n",header->ncmds);
printf("uint32_t sizeofcmds; %x\n",header->sizeofcmds);
printf("uint32_t flags; %x\n",header->flags);
//------------------------------------------------------------------------------------------------------------------------
ncmds = header->ncmds;
load_commands_offset += header_size;
printf("%s\n", cpu_type_name(header->cputype));
free(header);
}
//解析commands命令
dump_segment_commands(obj_file, load_commands_offset, is_swap, ncmds);
}
//struct fat_header {
// uint32_t magic; /* FAT_MAGIC or FAT_MAGIC_64 */
// uint32_t nfat_arch; /* number of structs that follow */
//};
//
//struct fat_arch {
// cpu_type_t cputype; /* cpu specifier (int) */
// cpu_subtype_t cpusubtype; /* machine specifier (int) */
// uint32_t offset; /* file offset to this object file */
// uint32_t size; /* size of this object file */
// uint32_t align; /* alignment as a power of 2 */
//};
void dump_fat_header(FILE *obj_file, int is_swap) {
//头结构体大小
int header_size = sizeof(struct fat_header);
//cpu 架构结构体大小
int arch_size = sizeof(struct fat_arch);
//解析 fat 头结构体
struct fat_header *header = load_bytes(obj_file, 0, header_size);
//在传进来的判断是否合法
if (is_swap) {
//虚拟分区
swap_fat_header(header, 0);
}
//arch架构偏移
int arch_offset = header_size;
//遍历所有架构
for (int i = 0; i < header->nfat_arch; i++) {
//解析
struct fat_arch *arch = load_bytes(obj_file, arch_offset, arch_size);
if (is_swap) {
swap_fat_arch(arch, 1, 0);
}
//
int mach_header_offset = arch->offset;
free(arch);
//下一个结构体
arch_offset += arch_size;
//读header magic
uint32_t magic = read_magic(obj_file, mach_header_offset);
//判断
int is_64 = is_magic_64(magic);
//
int is_swap_mach = should_swap_bytes(magic);
//解析头
dump_mach_header(obj_file, mach_header_offset, is_64, is_swap_mach);
}
free(header);
}
//解析
void dump_segments(FILE *obj_file) {
//先读文件头
uint32_t magic = read_magic(obj_file, 0);
//判断多少位
int is_64 = is_magic_64(magic);
//判断什么格式虚拟分区(把磁盘虚拟成内存使用的作用)
int is_swap = should_swap_bytes(magic);
//判断是胖二进制还是普通二进制
int fat = is_fat(magic);
if (fat) {
//解析 fat 头
dump_fat_header(obj_file, is_swap);
} else {
//解析mach 头
dump_mach_header(obj_file, 0, is_64, is_swap);
}
}
转载于:https://blog.51cto.com/haidragon/2104590
文章浏览阅读290次,点赞8次,收藏10次。1.背景介绍稀疏编码是一种用于处理稀疏数据的编码技术,其主要应用于信息传输、存储和处理等领域。稀疏数据是指数据中大部分元素为零或近似于零的数据,例如文本、图像、音频、视频等。稀疏编码的核心思想是将稀疏数据表示为非零元素和它们对应的位置信息,从而减少存储空间和计算复杂度。稀疏编码的研究起源于1990年代,随着大数据时代的到来,稀疏编码技术的应用范围和影响力不断扩大。目前,稀疏编码已经成为计算...
文章浏览阅读217次。EasyGBS - GB28181 国标方案安装使用文档下载安装包下载,正式使用需商业授权, 功能一致在线演示在线API架构图EasySIPCMSSIP 中心信令服务, 单节点, 自带一个 Redis Server, 随 EasySIPCMS 自启动, 不需要手动运行EasySIPSMSSIP 流媒体服务, 根..._easygbs-windows-2.6.0-23042316使用文档
文章浏览阅读1.2k次,点赞27次,收藏7次。2023巅峰极客 BabyURL之前AliyunCTF Bypassit I这题考查了这样一条链子:其实就是Jackson的原生反序列化利用今天复现的这题也是大同小异,一起来整一下。_原生jackson 反序列化链子
文章浏览阅读734次,点赞9次,收藏7次。微服务架构简单的说就是将单体应用进一步拆分,拆分成更小的服务,每个服务都是一个可以独立运行的项目。这么多小服务,如何管理他们?(服务治理 注册中心[服务注册 发现 剔除])这么多小服务,他们之间如何通讯?这么多小服务,客户端怎么访问他们?(网关)这么多小服务,一旦出现问题了,应该如何自处理?(容错)这么多小服务,一旦出现问题了,应该如何排错?(链路追踪)对于上面的问题,是任何一个微服务设计者都不能绕过去的,因此大部分的微服务产品都针对每一个问题提供了相应的组件来解决它们。_spring cloud
文章浏览阅读5.9k次,点赞6次,收藏20次。Js实现图片点击切换与轮播图片点击切换<!DOCTYPE html><html> <head> <meta charset="UTF-8"> <title></title> <script type="text/ja..._点击图片进行轮播图切换
文章浏览阅读10w+次,点赞245次,收藏1.5k次。在开始安装前,如果你的电脑装过tensorflow,请先把他们卸载干净,包括依赖的包(tensorflow-estimator、tensorboard、tensorflow、keras-applications、keras-preprocessing),不然后续安装了tensorflow-gpu可能会出现找不到cuda的问题。cuda、cudnn。..._tensorflow gpu版本安装
文章浏览阅读243次。0x00 简介权限滥用漏洞一般归类于逻辑问题,是指服务端功能开放过多或权限限制不严格,导致攻击者可以通过直接或间接调用的方式达到攻击效果。随着物联网时代的到来,这种漏洞已经屡见不鲜,各种漏洞组合利用也是千奇百怪、五花八门,这里总结漏洞是为了更好地应对和预防,如有不妥之处还请业内人士多多指教。0x01 背景2014年4月,在比特币飞涨的时代某网站曾经..._使用物联网漏洞的使用者
文章浏览阅读786次。A. Epipolar geometry and triangulationThe epipolar geometry mainly adopts the feature point method, such as SIFT, SURF and ORB, etc. to obtain the feature points corresponding to two frames of images. As shown in Figure 1, let the first image be and th_normalized plane coordinates
文章浏览阅读708次,点赞2次,收藏3次。开放信息抽取(OIE)系统(三)-- 第二代开放信息抽取系统(人工规则, rule-based, 先关系再实体)一.第二代开放信息抽取系统背景 第一代开放信息抽取系统(Open Information Extraction, OIE, learning-based, 自学习, 先抽取实体)通常抽取大量冗余信息,为了消除这些冗余信息,诞生了第二代开放信息抽取系统。二.第二代开放信息抽取系统历史第二代开放信息抽取系统着眼于解决第一代系统的三大问题: 大量非信息性提取(即省略关键信息的提取)、_语义角色增强的关系抽取
文章浏览阅读1.1w次,点赞6次,收藏51次。快速完成网页设计,10个顶尖响应式HTML5网页模板助你一臂之力为了寻找一个优质的网页模板,网页设计师和开发者往往可能会花上大半天的时间。不过幸运的是,现在的网页设计师和开发人员已经开始共享HTML5,Bootstrap和CSS3中的免费网页模板资源。鉴于网站模板的灵活性和强大的功能,现在广大设计师和开发者对html5网站的实际需求日益增长。为了造福大众,Mockplus的小伙伴整理了2018年最..._html欢迎页面
文章浏览阅读282次。原标题:2018全国计算机等级考试调整,一、二级都增加了考试科目全国计算机等级考试将于9月15-17日举行。在备考的最后冲刺阶段,小编为大家整理了今年新公布的全国计算机等级考试调整方案,希望对备考的小伙伴有所帮助,快随小编往下看吧!从2018年3月开始,全国计算机等级考试实施2018版考试大纲,并按新体系开考各个考试级别。具体调整内容如下:一、考试级别及科目1.一级新增“网络安全素质教育”科目(代..._计算机二级增报科目什么意思
文章浏览阅读240次。conan简单使用。_apt install conan