From 228757b92a05f1777b05d013c7a73520d241548b Mon Sep 17 00:00:00 2001 From: "siddik.acil" Date: Mon, 21 Feb 2022 20:30:35 +0100 Subject: [PATCH] macho: review fixes --- format/macho/macho.go | 30 +-- .../testdata/darwin_aarch64/a_dynamic.fqtest | 102 +++++---- .../testdata/darwin_aarch64/a_static.fqtest | 100 ++++----- .../testdata/darwin_aarch64/a_stripped.fqtest | 102 +++++---- .../testdata/darwin_aarch64/libbbb.so.fqtest | 92 ++++---- .../testdata/darwin_amd64/a_dynamic.fqtest | 94 ++++----- .../testdata/darwin_amd64/a_static.fqtest | 92 ++++---- .../testdata/darwin_amd64/a_stripped.fqtest | 94 ++++----- .../testdata/darwin_amd64/libbbb.so.fqtest | 84 ++++---- .../testdata/darwin_fat/a_dynamic.fqtest | 196 ++++++++---------- .../macho/testdata/darwin_fat/a_static.fqtest | 192 ++++++++--------- .../testdata/darwin_fat/a_stripped.fqtest | 196 ++++++++---------- .../testdata/darwin_fat/libbbb.so.fqtest | 176 +++++++--------- 13 files changed, 704 insertions(+), 846 deletions(-) diff --git a/format/macho/macho.go b/format/macho/macho.go index 75d5c440..3dd6d2f7 100644 --- a/format/macho/macho.go +++ b/format/macho/macho.go @@ -403,7 +403,7 @@ func ofileDecode(d *decode.D) { d.FieldStructArrayLoop("load_commands", "load_command", func() bool { return ncmdsIdx < int(ncmds) }, func(d *decode.D) { - cmd := d.FieldU32("cmd", loadCommands) + cmd := d.FieldU32("cmd", loadCommands, scalar.Hex) cmdsize := d.FieldU32("cmdsize") switch cmd { case LC_UUID: @@ -452,12 +452,8 @@ func ofileDecode(d *decode.D) { d.FieldU32("reloff") d.FieldU32("nreloc") // get section type - sectionType := d.U32() - sectionTypeMasked := sectionType & 0xff - d.FieldValueStr("type", sectionTypes[sectionTypeMasked]) - // rewind 32 bits and parse flags - d.SeekRel(-4 * 8) d.FieldStruct("flags", parseSectionFlags) + d.FieldU8("type", sectionTypes) d.FieldU32("reserved1") d.FieldU32("reserved2") if archBits == 64 { @@ -635,7 +631,7 @@ func fatParse(d *decode.D) { // Go to start of the file again d.SeekAbs(0) var narchs uint64 - var ofile_offsets []uint64 + var ofileOffsets []uint64 d.FieldStruct("fat_header", func(d *decode.D) { d.FieldRawLen("magic", 4*8) narchs = d.FieldU32("narchs") @@ -649,7 +645,7 @@ func fatParse(d *decode.D) { // beware cputype and cpusubtype changes from ofile header to fat header cpuType := d.FieldU32("cputype", cpuTypes) d.FieldU32("cpusubtype", cpuSubTypes[cpuType]) - ofile_offsets = append(ofile_offsets, d.FieldU32("offset")) + ofileOffsets = append(ofileOffsets, d.FieldU32("offset")) d.FieldU32("size") d.FieldU32("align") }) @@ -660,7 +656,7 @@ func fatParse(d *decode.D) { d.FieldStructArrayLoop("files", "file", func() bool { return nfilesIdx < int(narchs) }, func(d *decode.D) { - d.SeekAbs(int64(ofile_offsets[nfilesIdx]) * 8) + d.SeekAbs(int64(ofileOffsets[nfilesIdx]) * 8) ofileDecode(d) nfilesIdx++ }) @@ -671,9 +667,7 @@ func intelSubTypeHelper(f, m uint64) uint64 { } func parseMachHeaderFlags(d *decode.D) { - d.RawLen(4) - - d.RawLen(2) + d.FieldRawLen("reserved", 6) d.FieldBool("MH_APP_EXTENSION_SAFE") d.FieldBool("MH_NO_HEAP_EXECUTION") @@ -709,7 +703,7 @@ func parseMachHeaderFlags(d *decode.D) { } func parseSegmentFlags(d *decode.D) { - d.RawLen(28) + d.FieldRawLen("reserved", 28) d.FieldBool("SG_PROTECTED_VERSION_1") d.FieldBool("SG_NORELOC") d.FieldBool("SG_FVMLIB") @@ -725,19 +719,11 @@ func parseSectionFlags(d *decode.D) { d.FieldBool("S_ATTR_LIVE_SUPPORT") d.FieldBool("S_ATTR_SELF_MODIFYING_CODE") d.FieldBool("S_ATTR_DEBUG") - d.RawLen(1) + d.FieldRawLen("reserved", 14) - d.RawLen(4) - d.RawLen(4) - d.RawLen(4) - - d.RawLen(1) d.FieldBool("S_ATTR_SOME_INSTRUCTIONS") d.FieldBool("S_ATTR_EXT_RELOC") d.FieldBool("S_ATTR_LOC_RELOC") - - d.RawLen(4) - d.RawLen(4) } var timestampMapper = scalar.Fn(func(s scalar.S) (scalar.S, error) { diff --git a/format/macho/testdata/darwin_aarch64/a_dynamic.fqtest b/format/macho/testdata/darwin_aarch64/a_dynamic.fqtest index ac46eef2..bc9ec444 100644 --- a/format/macho/testdata/darwin_aarch64/a_dynamic.fqtest +++ b/format/macho/testdata/darwin_aarch64/a_dynamic.fqtest @@ -10,7 +10,8 @@ $ fq -d macho dv a_dynamic 0x0000| 02 00 00 00| ....| filetype: "MH_EXECUTE" (2) 0xc-0xf.7 (4) 0x0010|12 00 00 00 |.... | ncdms: 18 0x10-0x13.7 (4) 0x0010| 90 05 00 00 | .... | sizeofncdms: 1424 0x14-0x17.7 (4) - | | | flags{}: 0x18.6-0x1b.7 (3.2) + | | | flags{}: 0x18-0x1b.7 (4) +0x0010| 85 | . | reserved: raw bits 0x18-0x18.5 (0.6) 0x0010| 85 | . | MH_APP_EXTENSION_SAFE: false 0x18.6-0x18.6 (0.1) 0x0010| 85 | . | MH_NO_HEAP_EXECUTION: true 0x18.7-0x18.7 (0.1) 0x0010| 00 | . | MH_HAS_TLV_DESCRIPTORS: false 0x19-0x19 (0.1) @@ -38,10 +39,9 @@ $ fq -d macho dv a_dynamic 0x0010| 00 | . | MH_INCRLINK: false 0x1b.6-0x1b.6 (0.1) 0x0010| 00 | . | MH_NOUNDEFS: false 0x1b.7-0x1b.7 (0.1) 0x0010| 00 00 00 00| ....| reserved: raw bits (all zero) 0x1c-0x1f.7 (4) -0x0010| 85 | . | unknown0: raw bits 0x18-0x18.5 (0.6) | | | load_commands[0:18]: 0x20-0x5af.7 (1424) | | | [0]{}: load_command 0x20-0x67.7 (72) -0x0020|19 00 00 00 |.... | cmd: "segment_64" (25) 0x20-0x23.7 (4) +0x0020|19 00 00 00 |.... | cmd: "segment_64" (0x19) 0x20-0x23.7 (4) 0x0020| 48 00 00 00 | H... | cmdsize: 72 0x24-0x27.7 (4) | | | segment_command{}: 0x28-0x67.7 (64) | | | arch_bits: 64 0x28-NA (0) @@ -54,14 +54,15 @@ $ fq -d macho dv a_dynamic 0x0050| 00 00 00 00 | .... | initprot: 0 0x58-0x5b.7 (4) 0x0050| 00 00 00 00| ....| maxprot: 0 0x5c-0x5f.7 (4) 0x0060|00 00 00 00 |.... | nsects: 0 0x60-0x63.7 (4) - | | | flags{}: 0x67.4-0x67.7 (0.4) + | | | flags{}: 0x64-0x67.7 (4) +0x0060| 00 00 00 00 | .... | reserved: raw bits 0x64-0x67.3 (3.4) 0x0060| 00 | . | SG_PROTECTED_VERSION_1: false 0x67.4-0x67.4 (0.1) 0x0060| 00 | . | SG_NORELOC: false 0x67.5-0x67.5 (0.1) 0x0060| 00 | . | SG_FVMLIB: false 0x67.6-0x67.6 (0.1) 0x0060| 00 | . | SG_HIGHVM: false 0x67.7-0x67.7 (0.1) | | | sections[0:0]: 0x68-NA (0) | | | [1]{}: load_command 0x68-0x23f.7 (472) -0x0060| 19 00 00 00 | .... | cmd: "segment_64" (25) 0x68-0x6b.7 (4) +0x0060| 19 00 00 00 | .... | cmd: "segment_64" (0x19) 0x68-0x6b.7 (4) 0x0060| d8 01 00 00| ....| cmdsize: 472 0x6c-0x6f.7 (4) | | | segment_command{}: 0x70-0xaf.7 (64) | | | arch_bits: 64 0x70-NA (0) @@ -73,7 +74,8 @@ $ fq -d macho dv a_dynamic 0x00a0|05 00 00 00 |.... | initprot: 5 0xa0-0xa3.7 (4) 0x00a0| 05 00 00 00 | .... | maxprot: 5 0xa4-0xa7.7 (4) 0x00a0| 05 00 00 00 | .... | nsects: 5 0xa8-0xab.7 (4) - | | | flags{}: 0xaf.4-0xaf.7 (0.4) + | | | flags{}: 0xac-0xaf.7 (4) +0x00a0| 00 00 00 00| ....| reserved: raw bits 0xac-0xaf.3 (3.4) 0x00a0| 00| .| SG_PROTECTED_VERSION_1: false 0xaf.4-0xaf.4 (0.1) 0x00a0| 00| .| SG_NORELOC: false 0xaf.5-0xaf.5 (0.1) 0x00a0| 00| .| SG_FVMLIB: false 0xaf.6-0xaf.6 (0.1) @@ -96,10 +98,11 @@ $ fq -d macho dv a_dynamic 0x00f0|00 |. | S_ATTR_LIVE_SUPPORT: false 0xf0.4-0xf0.4 (0.1) 0x00f0|00 |. | S_ATTR_SELF_MODIFYING_CODE: false 0xf0.5-0xf0.5 (0.1) 0x00f0|00 |. | S_ATTR_DEBUG: false 0xf0.6-0xf0.6 (0.1) +0x00f0|00 04 00 |... | reserved: raw bits 0xf0.7-0xf2.4 (1.6) 0x00f0| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0xf2.5-0xf2.5 (0.1) 0x00f0| 00 | . | S_ATTR_EXT_RELOC: false 0xf2.6-0xf2.6 (0.1) 0x00f0| 00 | . | S_ATTR_LOC_RELOC: false 0xf2.7-0xf2.7 (0.1) - | | | type: "S_REGULAR" 0xf4-NA (0) +0x00f0| 80 | . | type: 128 0xf3-0xf3.7 (1) 0x00f0| 00 00 00 00 | .... | reserved1: 0 0xf4-0xf7.7 (4) 0x00f0| 00 00 00 00 | .... | reserved2: 0 0xf8-0xfb.7 (4) 0x00f0| 00 00 00 00| ....| reserved3: 0 0xfc-0xff.7 (4) @@ -120,10 +123,11 @@ $ fq -d macho dv a_dynamic 0x0140|08 |. | S_ATTR_LIVE_SUPPORT: true 0x140.4-0x140.4 (0.1) 0x0140|08 |. | S_ATTR_SELF_MODIFYING_CODE: false 0x140.5-0x140.5 (0.1) 0x0140|08 |. | S_ATTR_DEBUG: false 0x140.6-0x140.6 (0.1) +0x0140|08 04 00 |... | reserved: raw bits 0x140.7-0x142.4 (1.6) 0x0140| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x142.5-0x142.5 (0.1) 0x0140| 00 | . | S_ATTR_EXT_RELOC: false 0x142.6-0x142.6 (0.1) 0x0140| 00 | . | S_ATTR_LOC_RELOC: false 0x142.7-0x142.7 (0.1) - | | | type: "S_SYMBOL_STUBS" 0x144-NA (0) +0x0140| 80 | . | type: 128 0x143-0x143.7 (1) 0x0140| 00 00 00 00 | .... | reserved1: 0 0x144-0x147.7 (4) 0x0140| 0c 00 00 00 | .... | reserved2: 12 0x148-0x14b.7 (4) 0x0140| 00 00 00 00| ....| reserved3: 0 0x14c-0x14f.7 (4) @@ -144,10 +148,11 @@ $ fq -d macho dv a_dynamic 0x0190|00 |. | S_ATTR_LIVE_SUPPORT: false 0x190.4-0x190.4 (0.1) 0x0190|00 |. | S_ATTR_SELF_MODIFYING_CODE: false 0x190.5-0x190.5 (0.1) 0x0190|00 |. | S_ATTR_DEBUG: false 0x190.6-0x190.6 (0.1) +0x0190|00 04 00 |... | reserved: raw bits 0x190.7-0x192.4 (1.6) 0x0190| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x192.5-0x192.5 (0.1) 0x0190| 00 | . | S_ATTR_EXT_RELOC: false 0x192.6-0x192.6 (0.1) 0x0190| 00 | . | S_ATTR_LOC_RELOC: false 0x192.7-0x192.7 (0.1) - | | | type: "S_REGULAR" 0x194-NA (0) +0x0190| 80 | . | type: 128 0x193-0x193.7 (1) 0x0190| 00 00 00 00 | .... | reserved1: 0 0x194-0x197.7 (4) 0x0190| 00 00 00 00 | .... | reserved2: 0 0x198-0x19b.7 (4) 0x0190| 00 00 00 00| ....| reserved3: 0 0x19c-0x19f.7 (4) @@ -168,10 +173,11 @@ $ fq -d macho dv a_dynamic 0x01e0|02 |. | S_ATTR_LIVE_SUPPORT: false 0x1e0.4-0x1e0.4 (0.1) 0x01e0|02 |. | S_ATTR_SELF_MODIFYING_CODE: false 0x1e0.5-0x1e0.5 (0.1) 0x01e0|02 |. | S_ATTR_DEBUG: true 0x1e0.6-0x1e0.6 (0.1) +0x01e0|02 00 00 |... | reserved: raw bits 0x1e0.7-0x1e2.4 (1.6) 0x01e0| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x1e2.5-0x1e2.5 (0.1) 0x01e0| 00 | . | S_ATTR_EXT_RELOC: false 0x1e2.6-0x1e2.6 (0.1) 0x01e0| 00 | . | S_ATTR_LOC_RELOC: false 0x1e2.7-0x1e2.7 (0.1) - | | | type: "S_CSTRING_LITERALS" 0x1e4-NA (0) +0x01e0| 00 | . | type: "S_REGULAR" (0) 0x1e3-0x1e3.7 (1) 0x01e0| 00 00 00 00 | .... | reserved1: 0 0x1e4-0x1e7.7 (4) 0x01e0| 00 00 00 00 | .... | reserved2: 0 0x1e8-0x1eb.7 (4) 0x01e0| 00 00 00 00| ....| reserved3: 0 0x1ec-0x1ef.7 (4) @@ -192,15 +198,16 @@ $ fq -d macho dv a_dynamic 0x0230|00 |. | S_ATTR_LIVE_SUPPORT: false 0x230.4-0x230.4 (0.1) 0x0230|00 |. | S_ATTR_SELF_MODIFYING_CODE: false 0x230.5-0x230.5 (0.1) 0x0230|00 |. | S_ATTR_DEBUG: false 0x230.6-0x230.6 (0.1) +0x0230|00 00 00 |... | reserved: raw bits 0x230.7-0x232.4 (1.6) 0x0230| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x232.5-0x232.5 (0.1) 0x0230| 00 | . | S_ATTR_EXT_RELOC: false 0x232.6-0x232.6 (0.1) 0x0230| 00 | . | S_ATTR_LOC_RELOC: false 0x232.7-0x232.7 (0.1) - | | | type: "S_REGULAR" 0x234-NA (0) +0x0230| 00 | . | type: "S_REGULAR" (0) 0x233-0x233.7 (1) 0x0230| 00 00 00 00 | .... | reserved1: 0 0x234-0x237.7 (4) 0x0230| 00 00 00 00 | .... | reserved2: 0 0x238-0x23b.7 (4) 0x0230| 00 00 00 00| ....| reserved3: 0 0x23c-0x23f.7 (4) | | | [2]{}: load_command 0x240-0x2d7.7 (152) -0x0240|19 00 00 00 |.... | cmd: "segment_64" (25) 0x240-0x243.7 (4) +0x0240|19 00 00 00 |.... | cmd: "segment_64" (0x19) 0x240-0x243.7 (4) 0x0240| 98 00 00 00 | .... | cmdsize: 152 0x244-0x247.7 (4) | | | segment_command{}: 0x248-0x287.7 (64) | | | arch_bits: 64 0x248-NA (0) @@ -213,7 +220,8 @@ $ fq -d macho dv a_dynamic 0x0270| 03 00 00 00 | .... | initprot: 3 0x278-0x27b.7 (4) 0x0270| 03 00 00 00| ....| maxprot: 3 0x27c-0x27f.7 (4) 0x0280|01 00 00 00 |.... | nsects: 1 0x280-0x283.7 (4) - | | | flags{}: 0x287.4-0x287.7 (0.4) + | | | flags{}: 0x284-0x287.7 (4) +0x0280| 10 00 00 00 | .... | reserved: raw bits 0x284-0x287.3 (3.4) 0x0280| 00 | . | SG_PROTECTED_VERSION_1: false 0x287.4-0x287.4 (0.1) 0x0280| 00 | . | SG_NORELOC: false 0x287.5-0x287.5 (0.1) 0x0280| 00 | . | SG_FVMLIB: false 0x287.6-0x287.6 (0.1) @@ -238,15 +246,16 @@ $ fq -d macho dv a_dynamic 0x02c0| 06 | . | S_ATTR_LIVE_SUPPORT: false 0x2c8.4-0x2c8.4 (0.1) 0x02c0| 06 | . | S_ATTR_SELF_MODIFYING_CODE: true 0x2c8.5-0x2c8.5 (0.1) 0x02c0| 06 | . | S_ATTR_DEBUG: true 0x2c8.6-0x2c8.6 (0.1) +0x02c0| 06 00 00 | ... | reserved: raw bits 0x2c8.7-0x2ca.4 (1.6) 0x02c0| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x2ca.5-0x2ca.5 (0.1) 0x02c0| 00 | . | S_ATTR_EXT_RELOC: false 0x2ca.6-0x2ca.6 (0.1) 0x02c0| 00 | . | S_ATTR_LOC_RELOC: false 0x2ca.7-0x2ca.7 (0.1) - | | | type: "S_NON_LAZY_SYMBOL_POINTERS" 0x2cc-NA (0) +0x02c0| 00 | . | type: "S_REGULAR" (0) 0x2cb-0x2cb.7 (1) 0x02c0| 02 00 00 00| ....| reserved1: 2 0x2cc-0x2cf.7 (4) 0x02d0|00 00 00 00 |.... | reserved2: 0 0x2d0-0x2d3.7 (4) 0x02d0| 00 00 00 00 | .... | reserved3: 0 0x2d4-0x2d7.7 (4) | | | [3]{}: load_command 0x2d8-0x3bf.7 (232) -0x02d0| 19 00 00 00 | .... | cmd: "segment_64" (25) 0x2d8-0x2db.7 (4) +0x02d0| 19 00 00 00 | .... | cmd: "segment_64" (0x19) 0x2d8-0x2db.7 (4) 0x02d0| e8 00 00 00| ....| cmdsize: 232 0x2dc-0x2df.7 (4) | | | segment_command{}: 0x2e0-0x31f.7 (64) | | | arch_bits: 64 0x2e0-NA (0) @@ -258,7 +267,8 @@ $ fq -d macho dv a_dynamic 0x0310|03 00 00 00 |.... | initprot: 3 0x310-0x313.7 (4) 0x0310| 03 00 00 00 | .... | maxprot: 3 0x314-0x317.7 (4) 0x0310| 02 00 00 00 | .... | nsects: 2 0x318-0x31b.7 (4) - | | | flags{}: 0x31f.4-0x31f.7 (0.4) + | | | flags{}: 0x31c-0x31f.7 (4) +0x0310| 00 00 00 00| ....| reserved: raw bits 0x31c-0x31f.3 (3.4) 0x0310| 00| .| SG_PROTECTED_VERSION_1: false 0x31f.4-0x31f.4 (0.1) 0x0310| 00| .| SG_NORELOC: false 0x31f.5-0x31f.5 (0.1) 0x0310| 00| .| SG_FVMLIB: false 0x31f.6-0x31f.6 (0.1) @@ -281,10 +291,11 @@ $ fq -d macho dv a_dynamic 0x0360|07 |. | S_ATTR_LIVE_SUPPORT: false 0x360.4-0x360.4 (0.1) 0x0360|07 |. | S_ATTR_SELF_MODIFYING_CODE: true 0x360.5-0x360.5 (0.1) 0x0360|07 |. | S_ATTR_DEBUG: true 0x360.6-0x360.6 (0.1) +0x0360|07 00 00 |... | reserved: raw bits 0x360.7-0x362.4 (1.6) 0x0360| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x362.5-0x362.5 (0.1) 0x0360| 00 | . | S_ATTR_EXT_RELOC: false 0x362.6-0x362.6 (0.1) 0x0360| 00 | . | S_ATTR_LOC_RELOC: false 0x362.7-0x362.7 (0.1) - | | | type: "S_LAZY_SYMBOL_POINTERS" 0x364-NA (0) +0x0360| 00 | . | type: "S_REGULAR" (0) 0x363-0x363.7 (1) 0x0360| 03 00 00 00 | .... | reserved1: 3 0x364-0x367.7 (4) 0x0360| 00 00 00 00 | .... | reserved2: 0 0x368-0x36b.7 (4) 0x0360| 00 00 00 00| ....| reserved3: 0 0x36c-0x36f.7 (4) @@ -305,15 +316,16 @@ $ fq -d macho dv a_dynamic 0x03b0|00 |. | S_ATTR_LIVE_SUPPORT: false 0x3b0.4-0x3b0.4 (0.1) 0x03b0|00 |. | S_ATTR_SELF_MODIFYING_CODE: false 0x3b0.5-0x3b0.5 (0.1) 0x03b0|00 |. | S_ATTR_DEBUG: false 0x3b0.6-0x3b0.6 (0.1) +0x03b0|00 00 00 |... | reserved: raw bits 0x3b0.7-0x3b2.4 (1.6) 0x03b0| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x3b2.5-0x3b2.5 (0.1) 0x03b0| 00 | . | S_ATTR_EXT_RELOC: false 0x3b2.6-0x3b2.6 (0.1) 0x03b0| 00 | . | S_ATTR_LOC_RELOC: false 0x3b2.7-0x3b2.7 (0.1) - | | | type: "S_REGULAR" 0x3b4-NA (0) +0x03b0| 00 | . | type: "S_REGULAR" (0) 0x3b3-0x3b3.7 (1) 0x03b0| 00 00 00 00 | .... | reserved1: 0 0x3b4-0x3b7.7 (4) 0x03b0| 00 00 00 00 | .... | reserved2: 0 0x3b8-0x3bb.7 (4) 0x03b0| 00 00 00 00| ....| reserved3: 0 0x3bc-0x3bf.7 (4) | | | [4]{}: load_command 0x3c0-0x407.7 (72) -0x03c0|19 00 00 00 |.... | cmd: "segment_64" (25) 0x3c0-0x3c3.7 (4) +0x03c0|19 00 00 00 |.... | cmd: "segment_64" (0x19) 0x3c0-0x3c3.7 (4) 0x03c0| 48 00 00 00 | H... | cmdsize: 72 0x3c4-0x3c7.7 (4) | | | segment_command{}: 0x3c8-0x407.7 (64) | | | arch_bits: 64 0x3c8-NA (0) @@ -326,14 +338,15 @@ $ fq -d macho dv a_dynamic 0x03f0| 01 00 00 00 | .... | initprot: 1 0x3f8-0x3fb.7 (4) 0x03f0| 01 00 00 00| ....| maxprot: 1 0x3fc-0x3ff.7 (4) 0x0400|00 00 00 00 |.... | nsects: 0 0x400-0x403.7 (4) - | | | flags{}: 0x407.4-0x407.7 (0.4) + | | | flags{}: 0x404-0x407.7 (4) +0x0400| 00 00 00 00 | .... | reserved: raw bits 0x404-0x407.3 (3.4) 0x0400| 00 | . | SG_PROTECTED_VERSION_1: false 0x407.4-0x407.4 (0.1) 0x0400| 00 | . | SG_NORELOC: false 0x407.5-0x407.5 (0.1) 0x0400| 00 | . | SG_FVMLIB: false 0x407.6-0x407.6 (0.1) 0x0400| 00 | . | SG_HIGHVM: false 0x407.7-0x407.7 (0.1) | | | sections[0:0]: 0x408-NA (0) | | | [5]{}: load_command 0x408-0x437.7 (48) -0x0400| 22 00 00 80 | "... | cmd: "dyld_info_only" (2147483682) 0x408-0x40b.7 (4) +0x0400| 22 00 00 80 | "... | cmd: "dyld_info_only" (0x80000022) 0x408-0x40b.7 (4) 0x0400| 30 00 00 00| 0...| cmdsize: 48 0x40c-0x40f.7 (4) | | | dyld_info{}: 0x410-0x437.7 (40) 0x0410|00 c0 00 00 |.... | rebase_off: 49152 0x410-0x413.7 (4) @@ -347,14 +360,14 @@ $ fq -d macho dv a_dynamic 0x0430|40 c0 00 00 |@... | export_off: 49216 0x430-0x433.7 (4) 0x0430| 38 00 00 00 | 8... | export_size: 56 0x434-0x437.7 (4) | | | [6]{}: load_command 0x438-0x44f.7 (24) -0x0430| 02 00 00 00 | .... | cmd: "symtab" (2) 0x438-0x43b.7 (4) +0x0430| 02 00 00 00 | .... | cmd: "symtab" (0x2) 0x438-0x43b.7 (4) 0x0430| 18 00 00 00| ....| cmdsize: 24 0x43c-0x43f.7 (4) 0x0440|80 c0 00 00 |.... | symoff: 49280 0x440-0x443.7 (4) 0x0440| 07 00 00 00 | .... | nsyms: 7 0x444-0x447.7 (4) 0x0440| 08 c1 00 00 | .... | stroff: 49416 0x448-0x44b.7 (4) 0x0440| 58 00 00 00| X...| strsize: 88 0x44c-0x44f.7 (4) | | | [7]{}: load_command 0x450-0x49f.7 (80) -0x0450|0b 00 00 00 |.... | cmd: "dysymtab" (11) 0x450-0x453.7 (4) +0x0450|0b 00 00 00 |.... | cmd: "dysymtab" (0xb) 0x450-0x453.7 (4) 0x0450| 50 00 00 00 | P... | cmdsize: 80 0x454-0x457.7 (4) 0x0450| 00 00 00 00 | .... | ilocalsym: 0 0x458-0x45b.7 (4) 0x0450| 01 00 00 00| ....| nlocalsym: 1 0x45c-0x45f.7 (4) @@ -375,19 +388,19 @@ $ fq -d macho dv a_dynamic 0x0490| 00 00 00 00 | .... | locreloff: 0 0x498-0x49b.7 (4) 0x0490| 00 00 00 00| ....| nlocrel: 0 0x49c-0x49f.7 (4) | | | [8]{}: load_command 0x4a0-0x4bf.7 (32) -0x04a0|0e 00 00 00 |.... | cmd: "load_dylinker" (14) 0x4a0-0x4a3.7 (4) +0x04a0|0e 00 00 00 |.... | cmd: "load_dylinker" (0xe) 0x4a0-0x4a3.7 (4) 0x04a0| 20 00 00 00 | ... | cmdsize: 32 0x4a4-0x4a7.7 (4) 0x04a0| 0c 00 00 00 | .... | offset: 12 0x4a8-0x4ab.7 (4) 0x04a0| 2f 75 73 72| /usr| name: "/usr/lib/dyld" 0x4ac-0x4bf.7 (20) 0x04b0|2f 6c 69 62 2f 64 79 6c 64 00 00 00 00 00 00 00|/lib/dyld.......| | | | [9]{}: load_command 0x4c0-0x4d7.7 (24) -0x04c0|1b 00 00 00 |.... | cmd: "uuid" (27) 0x4c0-0x4c3.7 (4) +0x04c0|1b 00 00 00 |.... | cmd: "uuid" (0x1b) 0x4c0-0x4c3.7 (4) 0x04c0| 18 00 00 00 | .... | cmdsize: 24 0x4c4-0x4c7.7 (4) | | | uuid_command{}: 0x4c8-0x4d7.7 (16) 0x04c0| 6a 8c 27 f0 d3 ea 34 04| j.'...4.| uuid: raw bits 0x4c8-0x4d7.7 (16) 0x04d0|84 e7 27 82 60 d7 29 b8 |..'.`.). | | | | [10]{}: load_command 0x4d8-0x4f7.7 (32) -0x04d0| 32 00 00 00 | 2... | cmd: "build_version" (50) 0x4d8-0x4db.7 (4) +0x04d0| 32 00 00 00 | 2... | cmd: "build_version" (0x32) 0x4d8-0x4db.7 (4) 0x04d0| 20 00 00 00| ...| cmdsize: 32 0x4dc-0x4df.7 (4) 0x04e0|01 00 00 00 |.... | platform: 1 0x4e0-0x4e3.7 (4) 0x04e0| 00 00 0b 00 | .... | minos: 720896 0x4e4-0x4e7.7 (4) @@ -398,18 +411,18 @@ $ fq -d macho dv a_dynamic 0x04f0|03 00 00 00 |.... | tool: 3 0x4f0-0x4f3.7 (4) 0x04f0| 00 00 c7 02 | .... | version: 46596096 0x4f4-0x4f7.7 (4) | | | [11]{}: load_command 0x4f8-0x507.7 (16) -0x04f0| 2a 00 00 00 | *... | cmd: "source_version" (42) 0x4f8-0x4fb.7 (4) +0x04f0| 2a 00 00 00 | *... | cmd: "source_version" (0x2a) 0x4f8-0x4fb.7 (4) 0x04f0| 10 00 00 00| ....| cmdsize: 16 0x4fc-0x4ff.7 (4) | | | source_version_tag{}: 0x500-0x507.7 (8) 0x0500|00 00 00 00 00 00 00 00 |........ | tag: 0 0x500-0x507.7 (8) | | | [12]{}: load_command 0x508-0x51f.7 (24) -0x0500| 28 00 00 80 | (... | cmd: "main" (2147483688) 0x508-0x50b.7 (4) +0x0500| 28 00 00 80 | (... | cmd: "main" (0x80000028) 0x508-0x50b.7 (4) 0x0500| 18 00 00 00| ....| cmdsize: 24 0x50c-0x50f.7 (4) | | | entrypoint{}: 0x510-0x51f.7 (16) 0x0510|4c 3f 00 00 00 00 00 00 |L?...... | entryoff: 16204 0x510-0x517.7 (8) 0x0510| 00 00 00 00 00 00 00 00| ........| stacksize: 0 0x518-0x51f.7 (8) | | | [13]{}: load_command 0x520-0x547.7 (40) -0x0520|0c 00 00 00 |.... | cmd: "load_dylib" (12) 0x520-0x523.7 (4) +0x0520|0c 00 00 00 |.... | cmd: "load_dylib" (0xc) 0x520-0x523.7 (4) 0x0520| 28 00 00 00 | (... | cmdsize: 40 0x524-0x527.7 (4) | | | dylib_command{}: 0x528-0x547.7 (32) 0x0520| 18 00 00 00 | .... | offset: 24 0x528-0x52b.7 (4) @@ -419,7 +432,7 @@ $ fq -d macho dv a_dynamic 0x0530| 6c 69 62 62 62 62 2e 73| libbbb.s| name: "libbbb.so" 0x538-0x547.7 (16) 0x0540|6f 00 00 00 00 00 00 00 |o....... | | | | [14]{}: load_command 0x548-0x57f.7 (56) -0x0540| 0c 00 00 00 | .... | cmd: "load_dylib" (12) 0x548-0x54b.7 (4) +0x0540| 0c 00 00 00 | .... | cmd: "load_dylib" (0xc) 0x548-0x54b.7 (4) 0x0540| 38 00 00 00| 8...| cmdsize: 56 0x54c-0x54f.7 (4) | | | dylib_command{}: 0x550-0x57f.7 (48) 0x0550|18 00 00 00 |.... | offset: 24 0x550-0x553.7 (4) @@ -429,43 +442,22 @@ $ fq -d macho dv a_dynamic 0x0560|2f 75 73 72 2f 6c 69 62 2f 6c 69 62 53 79 73 74|/usr/lib/libSyst| name: "/usr/lib/libSystem.B.dylib" 0x560-0x57f.7 (32) 0x0570|65 6d 2e 42 2e 64 79 6c 69 62 00 00 00 00 00 00|em.B.dylib......| | | | [15]{}: load_command 0x580-0x58f.7 (16) -0x0580|26 00 00 00 |&... | cmd: "function_starts" (38) 0x580-0x583.7 (4) +0x0580|26 00 00 00 |&... | cmd: "function_starts" (0x26) 0x580-0x583.7 (4) 0x0580| 10 00 00 00 | .... | cmdsize: 16 0x584-0x587.7 (4) | | | linkedit_data{}: 0x588-0x58f.7 (8) 0x0580| 78 c0 00 00 | x... | off: 49272 0x588-0x58b.7 (4) 0x0580| 08 00 00 00| ....| size: 8 0x58c-0x58f.7 (4) | | | [16]{}: load_command 0x590-0x59f.7 (16) -0x0590|29 00 00 00 |)... | cmd: "data_in_code" (41) 0x590-0x593.7 (4) +0x0590|29 00 00 00 |)... | cmd: "data_in_code" (0x29) 0x590-0x593.7 (4) 0x0590| 10 00 00 00 | .... | cmdsize: 16 0x594-0x597.7 (4) | | | linkedit_data{}: 0x598-0x59f.7 (8) 0x0590| 80 c0 00 00 | .... | off: 49280 0x598-0x59b.7 (4) 0x0590| 00 00 00 00| ....| size: 0 0x59c-0x59f.7 (4) | | | [17]{}: load_command 0x5a0-0x5af.7 (16) -0x05a0|1d 00 00 00 |.... | cmd: "code_signature" (29) 0x5a0-0x5a3.7 (4) +0x05a0|1d 00 00 00 |.... | cmd: "code_signature" (0x1d) 0x5a0-0x5a3.7 (4) 0x05a0| 10 00 00 00 | .... | cmdsize: 16 0x5a4-0x5a7.7 (4) | | | linkedit_data{}: 0x5a8-0x5af.7 (8) 0x05a0| 60 c1 00 00 | `... | off: 49504 0x5a8-0x5ab.7 (4) 0x05a0| 16 02 00 00| ....| size: 534 0x5ac-0x5af.7 (4) -0x0060| 00 00 00 00 | .... | unknown1: raw bits 0x64-0x67.3 (3.4) -0x00a0| 00 00 00 00| ....| unknown2: raw bits 0xac-0xaf.3 (3.4) -0x00f0|00 04 00 |... | unknown3: raw bits 0xf0.7-0xf2.4 (1.6) -0x00f0| 80 | . | unknown4: raw bits 0xf3-0xf3.7 (1) -0x0140|08 04 00 |... | unknown5: raw bits 0x140.7-0x142.4 (1.6) -0x0140| 80 | . | unknown6: raw bits 0x143-0x143.7 (1) -0x0190|00 04 00 |... | unknown7: raw bits 0x190.7-0x192.4 (1.6) -0x0190| 80 | . | unknown8: raw bits 0x193-0x193.7 (1) -0x01e0|02 00 00 |... | unknown9: raw bits 0x1e0.7-0x1e2.4 (1.6) -0x01e0| 00 | . | unknown10: raw bits 0x1e3-0x1e3.7 (1) -0x0230|00 00 00 |... | unknown11: raw bits 0x230.7-0x232.4 (1.6) -0x0230| 00 | . | unknown12: raw bits 0x233-0x233.7 (1) -0x0280| 10 00 00 00 | .... | unknown13: raw bits 0x284-0x287.3 (3.4) -0x02c0| 06 00 00 | ... | unknown14: raw bits 0x2c8.7-0x2ca.4 (1.6) -0x02c0| 00 | . | unknown15: raw bits 0x2cb-0x2cb.7 (1) -0x0310| 00 00 00 00| ....| unknown16: raw bits 0x31c-0x31f.3 (3.4) -0x0360|07 00 00 |... | unknown17: raw bits 0x360.7-0x362.4 (1.6) -0x0360| 00 | . | unknown18: raw bits 0x363-0x363.7 (1) -0x03b0|00 00 00 |... | unknown19: raw bits 0x3b0.7-0x3b2.4 (1.6) -0x03b0| 00 | . | unknown20: raw bits 0x3b3-0x3b3.7 (1) -0x0400| 00 00 00 00 | .... | unknown21: raw bits 0x404-0x407.3 (3.4) -0x05b0|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| unknown22: raw bits 0x5b0-0xc375.7 (48582) +0x05b0|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| unknown0: raw bits 0x5b0-0xc375.7 (48582) * |until 0xc375.7 (end) (48582) | | diff --git a/format/macho/testdata/darwin_aarch64/a_static.fqtest b/format/macho/testdata/darwin_aarch64/a_static.fqtest index cf601279..02e2560f 100644 --- a/format/macho/testdata/darwin_aarch64/a_static.fqtest +++ b/format/macho/testdata/darwin_aarch64/a_static.fqtest @@ -10,7 +10,8 @@ $ fq -d macho dv a_static 0x0000| 02 00 00 00| ....| filetype: "MH_EXECUTE" (2) 0xc-0xf.7 (4) 0x0010|11 00 00 00 |.... | ncdms: 17 0x10-0x13.7 (4) 0x0010| 68 05 00 00 | h... | sizeofncdms: 1384 0x14-0x17.7 (4) - | | | flags{}: 0x18.6-0x1b.7 (3.2) + | | | flags{}: 0x18-0x1b.7 (4) +0x0010| 85 | . | reserved: raw bits 0x18-0x18.5 (0.6) 0x0010| 85 | . | MH_APP_EXTENSION_SAFE: false 0x18.6-0x18.6 (0.1) 0x0010| 85 | . | MH_NO_HEAP_EXECUTION: true 0x18.7-0x18.7 (0.1) 0x0010| 00 | . | MH_HAS_TLV_DESCRIPTORS: false 0x19-0x19 (0.1) @@ -38,10 +39,9 @@ $ fq -d macho dv a_static 0x0010| 00 | . | MH_INCRLINK: false 0x1b.6-0x1b.6 (0.1) 0x0010| 00 | . | MH_NOUNDEFS: false 0x1b.7-0x1b.7 (0.1) 0x0010| 00 00 00 00| ....| reserved: raw bits (all zero) 0x1c-0x1f.7 (4) -0x0010| 85 | . | unknown0: raw bits 0x18-0x18.5 (0.6) | | | load_commands[0:17]: 0x20-0x587.7 (1384) | | | [0]{}: load_command 0x20-0x67.7 (72) -0x0020|19 00 00 00 |.... | cmd: "segment_64" (25) 0x20-0x23.7 (4) +0x0020|19 00 00 00 |.... | cmd: "segment_64" (0x19) 0x20-0x23.7 (4) 0x0020| 48 00 00 00 | H... | cmdsize: 72 0x24-0x27.7 (4) | | | segment_command{}: 0x28-0x67.7 (64) | | | arch_bits: 64 0x28-NA (0) @@ -54,14 +54,15 @@ $ fq -d macho dv a_static 0x0050| 00 00 00 00 | .... | initprot: 0 0x58-0x5b.7 (4) 0x0050| 00 00 00 00| ....| maxprot: 0 0x5c-0x5f.7 (4) 0x0060|00 00 00 00 |.... | nsects: 0 0x60-0x63.7 (4) - | | | flags{}: 0x67.4-0x67.7 (0.4) + | | | flags{}: 0x64-0x67.7 (4) +0x0060| 00 00 00 00 | .... | reserved: raw bits 0x64-0x67.3 (3.4) 0x0060| 00 | . | SG_PROTECTED_VERSION_1: false 0x67.4-0x67.4 (0.1) 0x0060| 00 | . | SG_NORELOC: false 0x67.5-0x67.5 (0.1) 0x0060| 00 | . | SG_FVMLIB: false 0x67.6-0x67.6 (0.1) 0x0060| 00 | . | SG_HIGHVM: false 0x67.7-0x67.7 (0.1) | | | sections[0:0]: 0x68-NA (0) | | | [1]{}: load_command 0x68-0x23f.7 (472) -0x0060| 19 00 00 00 | .... | cmd: "segment_64" (25) 0x68-0x6b.7 (4) +0x0060| 19 00 00 00 | .... | cmd: "segment_64" (0x19) 0x68-0x6b.7 (4) 0x0060| d8 01 00 00| ....| cmdsize: 472 0x6c-0x6f.7 (4) | | | segment_command{}: 0x70-0xaf.7 (64) | | | arch_bits: 64 0x70-NA (0) @@ -73,7 +74,8 @@ $ fq -d macho dv a_static 0x00a0|05 00 00 00 |.... | initprot: 5 0xa0-0xa3.7 (4) 0x00a0| 05 00 00 00 | .... | maxprot: 5 0xa4-0xa7.7 (4) 0x00a0| 05 00 00 00 | .... | nsects: 5 0xa8-0xab.7 (4) - | | | flags{}: 0xaf.4-0xaf.7 (0.4) + | | | flags{}: 0xac-0xaf.7 (4) +0x00a0| 00 00 00 00| ....| reserved: raw bits 0xac-0xaf.3 (3.4) 0x00a0| 00| .| SG_PROTECTED_VERSION_1: false 0xaf.4-0xaf.4 (0.1) 0x00a0| 00| .| SG_NORELOC: false 0xaf.5-0xaf.5 (0.1) 0x00a0| 00| .| SG_FVMLIB: false 0xaf.6-0xaf.6 (0.1) @@ -96,10 +98,11 @@ $ fq -d macho dv a_static 0x00f0|00 |. | S_ATTR_LIVE_SUPPORT: false 0xf0.4-0xf0.4 (0.1) 0x00f0|00 |. | S_ATTR_SELF_MODIFYING_CODE: false 0xf0.5-0xf0.5 (0.1) 0x00f0|00 |. | S_ATTR_DEBUG: false 0xf0.6-0xf0.6 (0.1) +0x00f0|00 04 00 |... | reserved: raw bits 0xf0.7-0xf2.4 (1.6) 0x00f0| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0xf2.5-0xf2.5 (0.1) 0x00f0| 00 | . | S_ATTR_EXT_RELOC: false 0xf2.6-0xf2.6 (0.1) 0x00f0| 00 | . | S_ATTR_LOC_RELOC: false 0xf2.7-0xf2.7 (0.1) - | | | type: "S_REGULAR" 0xf4-NA (0) +0x00f0| 80 | . | type: 128 0xf3-0xf3.7 (1) 0x00f0| 00 00 00 00 | .... | reserved1: 0 0xf4-0xf7.7 (4) 0x00f0| 00 00 00 00 | .... | reserved2: 0 0xf8-0xfb.7 (4) 0x00f0| 00 00 00 00| ....| reserved3: 0 0xfc-0xff.7 (4) @@ -120,10 +123,11 @@ $ fq -d macho dv a_static 0x0140|08 |. | S_ATTR_LIVE_SUPPORT: true 0x140.4-0x140.4 (0.1) 0x0140|08 |. | S_ATTR_SELF_MODIFYING_CODE: false 0x140.5-0x140.5 (0.1) 0x0140|08 |. | S_ATTR_DEBUG: false 0x140.6-0x140.6 (0.1) +0x0140|08 04 00 |... | reserved: raw bits 0x140.7-0x142.4 (1.6) 0x0140| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x142.5-0x142.5 (0.1) 0x0140| 00 | . | S_ATTR_EXT_RELOC: false 0x142.6-0x142.6 (0.1) 0x0140| 00 | . | S_ATTR_LOC_RELOC: false 0x142.7-0x142.7 (0.1) - | | | type: "S_SYMBOL_STUBS" 0x144-NA (0) +0x0140| 80 | . | type: 128 0x143-0x143.7 (1) 0x0140| 00 00 00 00 | .... | reserved1: 0 0x144-0x147.7 (4) 0x0140| 0c 00 00 00 | .... | reserved2: 12 0x148-0x14b.7 (4) 0x0140| 00 00 00 00| ....| reserved3: 0 0x14c-0x14f.7 (4) @@ -144,10 +148,11 @@ $ fq -d macho dv a_static 0x0190|00 |. | S_ATTR_LIVE_SUPPORT: false 0x190.4-0x190.4 (0.1) 0x0190|00 |. | S_ATTR_SELF_MODIFYING_CODE: false 0x190.5-0x190.5 (0.1) 0x0190|00 |. | S_ATTR_DEBUG: false 0x190.6-0x190.6 (0.1) +0x0190|00 04 00 |... | reserved: raw bits 0x190.7-0x192.4 (1.6) 0x0190| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x192.5-0x192.5 (0.1) 0x0190| 00 | . | S_ATTR_EXT_RELOC: false 0x192.6-0x192.6 (0.1) 0x0190| 00 | . | S_ATTR_LOC_RELOC: false 0x192.7-0x192.7 (0.1) - | | | type: "S_REGULAR" 0x194-NA (0) +0x0190| 80 | . | type: 128 0x193-0x193.7 (1) 0x0190| 00 00 00 00 | .... | reserved1: 0 0x194-0x197.7 (4) 0x0190| 00 00 00 00 | .... | reserved2: 0 0x198-0x19b.7 (4) 0x0190| 00 00 00 00| ....| reserved3: 0 0x19c-0x19f.7 (4) @@ -168,10 +173,11 @@ $ fq -d macho dv a_static 0x01e0|02 |. | S_ATTR_LIVE_SUPPORT: false 0x1e0.4-0x1e0.4 (0.1) 0x01e0|02 |. | S_ATTR_SELF_MODIFYING_CODE: false 0x1e0.5-0x1e0.5 (0.1) 0x01e0|02 |. | S_ATTR_DEBUG: true 0x1e0.6-0x1e0.6 (0.1) +0x01e0|02 00 00 |... | reserved: raw bits 0x1e0.7-0x1e2.4 (1.6) 0x01e0| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x1e2.5-0x1e2.5 (0.1) 0x01e0| 00 | . | S_ATTR_EXT_RELOC: false 0x1e2.6-0x1e2.6 (0.1) 0x01e0| 00 | . | S_ATTR_LOC_RELOC: false 0x1e2.7-0x1e2.7 (0.1) - | | | type: "S_CSTRING_LITERALS" 0x1e4-NA (0) +0x01e0| 00 | . | type: "S_REGULAR" (0) 0x1e3-0x1e3.7 (1) 0x01e0| 00 00 00 00 | .... | reserved1: 0 0x1e4-0x1e7.7 (4) 0x01e0| 00 00 00 00 | .... | reserved2: 0 0x1e8-0x1eb.7 (4) 0x01e0| 00 00 00 00| ....| reserved3: 0 0x1ec-0x1ef.7 (4) @@ -192,15 +198,16 @@ $ fq -d macho dv a_static 0x0230|00 |. | S_ATTR_LIVE_SUPPORT: false 0x230.4-0x230.4 (0.1) 0x0230|00 |. | S_ATTR_SELF_MODIFYING_CODE: false 0x230.5-0x230.5 (0.1) 0x0230|00 |. | S_ATTR_DEBUG: false 0x230.6-0x230.6 (0.1) +0x0230|00 00 00 |... | reserved: raw bits 0x230.7-0x232.4 (1.6) 0x0230| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x232.5-0x232.5 (0.1) 0x0230| 00 | . | S_ATTR_EXT_RELOC: false 0x232.6-0x232.6 (0.1) 0x0230| 00 | . | S_ATTR_LOC_RELOC: false 0x232.7-0x232.7 (0.1) - | | | type: "S_REGULAR" 0x234-NA (0) +0x0230| 00 | . | type: "S_REGULAR" (0) 0x233-0x233.7 (1) 0x0230| 00 00 00 00 | .... | reserved1: 0 0x234-0x237.7 (4) 0x0230| 00 00 00 00 | .... | reserved2: 0 0x238-0x23b.7 (4) 0x0230| 00 00 00 00| ....| reserved3: 0 0x23c-0x23f.7 (4) | | | [2]{}: load_command 0x240-0x2d7.7 (152) -0x0240|19 00 00 00 |.... | cmd: "segment_64" (25) 0x240-0x243.7 (4) +0x0240|19 00 00 00 |.... | cmd: "segment_64" (0x19) 0x240-0x243.7 (4) 0x0240| 98 00 00 00 | .... | cmdsize: 152 0x244-0x247.7 (4) | | | segment_command{}: 0x248-0x287.7 (64) | | | arch_bits: 64 0x248-NA (0) @@ -213,7 +220,8 @@ $ fq -d macho dv a_static 0x0270| 03 00 00 00 | .... | initprot: 3 0x278-0x27b.7 (4) 0x0270| 03 00 00 00| ....| maxprot: 3 0x27c-0x27f.7 (4) 0x0280|01 00 00 00 |.... | nsects: 1 0x280-0x283.7 (4) - | | | flags{}: 0x287.4-0x287.7 (0.4) + | | | flags{}: 0x284-0x287.7 (4) +0x0280| 10 00 00 00 | .... | reserved: raw bits 0x284-0x287.3 (3.4) 0x0280| 00 | . | SG_PROTECTED_VERSION_1: false 0x287.4-0x287.4 (0.1) 0x0280| 00 | . | SG_NORELOC: false 0x287.5-0x287.5 (0.1) 0x0280| 00 | . | SG_FVMLIB: false 0x287.6-0x287.6 (0.1) @@ -238,15 +246,16 @@ $ fq -d macho dv a_static 0x02c0| 06 | . | S_ATTR_LIVE_SUPPORT: false 0x2c8.4-0x2c8.4 (0.1) 0x02c0| 06 | . | S_ATTR_SELF_MODIFYING_CODE: true 0x2c8.5-0x2c8.5 (0.1) 0x02c0| 06 | . | S_ATTR_DEBUG: true 0x2c8.6-0x2c8.6 (0.1) +0x02c0| 06 00 00 | ... | reserved: raw bits 0x2c8.7-0x2ca.4 (1.6) 0x02c0| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x2ca.5-0x2ca.5 (0.1) 0x02c0| 00 | . | S_ATTR_EXT_RELOC: false 0x2ca.6-0x2ca.6 (0.1) 0x02c0| 00 | . | S_ATTR_LOC_RELOC: false 0x2ca.7-0x2ca.7 (0.1) - | | | type: "S_NON_LAZY_SYMBOL_POINTERS" 0x2cc-NA (0) +0x02c0| 00 | . | type: "S_REGULAR" (0) 0x2cb-0x2cb.7 (1) 0x02c0| 01 00 00 00| ....| reserved1: 1 0x2cc-0x2cf.7 (4) 0x02d0|00 00 00 00 |.... | reserved2: 0 0x2d0-0x2d3.7 (4) 0x02d0| 00 00 00 00 | .... | reserved3: 0 0x2d4-0x2d7.7 (4) | | | [3]{}: load_command 0x2d8-0x3bf.7 (232) -0x02d0| 19 00 00 00 | .... | cmd: "segment_64" (25) 0x2d8-0x2db.7 (4) +0x02d0| 19 00 00 00 | .... | cmd: "segment_64" (0x19) 0x2d8-0x2db.7 (4) 0x02d0| e8 00 00 00| ....| cmdsize: 232 0x2dc-0x2df.7 (4) | | | segment_command{}: 0x2e0-0x31f.7 (64) | | | arch_bits: 64 0x2e0-NA (0) @@ -258,7 +267,8 @@ $ fq -d macho dv a_static 0x0310|03 00 00 00 |.... | initprot: 3 0x310-0x313.7 (4) 0x0310| 03 00 00 00 | .... | maxprot: 3 0x314-0x317.7 (4) 0x0310| 02 00 00 00 | .... | nsects: 2 0x318-0x31b.7 (4) - | | | flags{}: 0x31f.4-0x31f.7 (0.4) + | | | flags{}: 0x31c-0x31f.7 (4) +0x0310| 00 00 00 00| ....| reserved: raw bits 0x31c-0x31f.3 (3.4) 0x0310| 00| .| SG_PROTECTED_VERSION_1: false 0x31f.4-0x31f.4 (0.1) 0x0310| 00| .| SG_NORELOC: false 0x31f.5-0x31f.5 (0.1) 0x0310| 00| .| SG_FVMLIB: false 0x31f.6-0x31f.6 (0.1) @@ -281,10 +291,11 @@ $ fq -d macho dv a_static 0x0360|07 |. | S_ATTR_LIVE_SUPPORT: false 0x360.4-0x360.4 (0.1) 0x0360|07 |. | S_ATTR_SELF_MODIFYING_CODE: true 0x360.5-0x360.5 (0.1) 0x0360|07 |. | S_ATTR_DEBUG: true 0x360.6-0x360.6 (0.1) +0x0360|07 00 00 |... | reserved: raw bits 0x360.7-0x362.4 (1.6) 0x0360| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x362.5-0x362.5 (0.1) 0x0360| 00 | . | S_ATTR_EXT_RELOC: false 0x362.6-0x362.6 (0.1) 0x0360| 00 | . | S_ATTR_LOC_RELOC: false 0x362.7-0x362.7 (0.1) - | | | type: "S_LAZY_SYMBOL_POINTERS" 0x364-NA (0) +0x0360| 00 | . | type: "S_REGULAR" (0) 0x363-0x363.7 (1) 0x0360| 02 00 00 00 | .... | reserved1: 2 0x364-0x367.7 (4) 0x0360| 00 00 00 00 | .... | reserved2: 0 0x368-0x36b.7 (4) 0x0360| 00 00 00 00| ....| reserved3: 0 0x36c-0x36f.7 (4) @@ -305,15 +316,16 @@ $ fq -d macho dv a_static 0x03b0|00 |. | S_ATTR_LIVE_SUPPORT: false 0x3b0.4-0x3b0.4 (0.1) 0x03b0|00 |. | S_ATTR_SELF_MODIFYING_CODE: false 0x3b0.5-0x3b0.5 (0.1) 0x03b0|00 |. | S_ATTR_DEBUG: false 0x3b0.6-0x3b0.6 (0.1) +0x03b0|00 00 00 |... | reserved: raw bits 0x3b0.7-0x3b2.4 (1.6) 0x03b0| 00 | . | S_ATTR_SOME_INSTRUCTIONS: false 0x3b2.5-0x3b2.5 (0.1) 0x03b0| 00 | . | S_ATTR_EXT_RELOC: false 0x3b2.6-0x3b2.6 (0.1) 0x03b0| 00 | . | S_ATTR_LOC_RELOC: false 0x3b2.7-0x3b2.7 (0.1) - | | | type: "S_REGULAR" 0x3b4-NA (0) +0x03b0| 00 | . | type: "S_REGULAR" (0) 0x3b3-0x3b3.7 (1) 0x03b0| 00 00 00 00 | .... | reserved1: 0 0x3b4-0x3b7.7 (4) 0x03b0| 00 00 00 00 | .... | reserved2: 0 0x3b8-0x3bb.7 (4) 0x03b0| 00 00 00 00| ....| reserved3: 0 0x3bc-0x3bf.7 (4) | | | [4]{}: load_command 0x3c0-0x407.7 (72) -0x03c0|19 00 00 00 |.... | cmd: "segment_64" (25) 0x3c0-0x3c3.7 (4) +0x03c0|19 00 00 00 |.... | cmd: "segment_64" (0x19) 0x3c0-0x3c3.7 (4) 0x03c0| 48 00 00 00 | H... | cmdsize: 72 0x3c4-0x3c7.7 (4) | | | segment_command{}: 0x3c8-0x407.7 (64) | | | arch_bits: 64 0x3c8-NA (0) @@ -326,14 +338,15 @@ $ fq -d macho dv a_static 0x03f0| 01 00 00 00 | .... | initprot: 1 0x3f8-0x3fb.7 (4) 0x03f0| 01 00 00 00| ....| maxprot: 1 0x3fc-0x3ff.7 (4) 0x0400|00 00 00 00 |.... | nsects: 0 0x400-0x403.7 (4) - | | | flags{}: 0x407.4-0x407.7 (0.4) + | | | flags{}: 0x404-0x407.7 (4) +0x0400| 00 00 00 00 | .... | reserved: raw bits 0x404-0x407.3 (3.4) 0x0400| 00 | . | SG_PROTECTED_VERSION_1: false 0x407.4-0x407.4 (0.1) 0x0400| 00 | . | SG_NORELOC: false 0x407.5-0x407.5 (0.1) 0x0400| 00 | . | SG_FVMLIB: false 0x407.6-0x407.6 (0.1) 0x0400| 00 | . | SG_HIGHVM: false 0x407.7-0x407.7 (0.1) | | | sections[0:0]: 0x408-NA (0) | | | [5]{}: load_command 0x408-0x437.7 (48) -0x0400| 22 00 00 80 | "... | cmd: "dyld_info_only" (2147483682) 0x408-0x40b.7 (4) +0x0400| 22 00 00 80 | "... | cmd: "dyld_info_only" (0x80000022) 0x408-0x40b.7 (4) 0x0400| 30 00 00 00| 0...| cmdsize: 48 0x40c-0x40f.7 (4) | | | dyld_info{}: 0x410-0x437.7 (40) 0x0410|00 c0 00 00 |.... | rebase_off: 49152 0x410-0x413.7 (4) @@ -347,14 +360,14 @@ $ fq -d macho dv a_static 0x0430|30 c0 00 00 |0... | export_off: 49200 0x430-0x433.7 (4) 0x0430| 48 00 00 00 | H... | export_size: 72 0x434-0x437.7 (4) | | | [6]{}: load_command 0x438-0x44f.7 (24) -0x0430| 02 00 00 00 | .... | cmd: "symtab" (2) 0x438-0x43b.7 (4) +0x0430| 02 00 00 00 | .... | cmd: "symtab" (0x2) 0x438-0x43b.7 (4) 0x0430| 18 00 00 00| ....| cmdsize: 24 0x43c-0x43f.7 (4) 0x0440|80 c0 00 00 |.... | symoff: 49280 0x440-0x443.7 (4) 0x0440| 07 00 00 00 | .... | nsyms: 7 0x444-0x447.7 (4) 0x0440| 00 c1 00 00 | .... | stroff: 49408 0x448-0x44b.7 (4) 0x0440| 58 00 00 00| X...| strsize: 88 0x44c-0x44f.7 (4) | | | [7]{}: load_command 0x450-0x49f.7 (80) -0x0450|0b 00 00 00 |.... | cmd: "dysymtab" (11) 0x450-0x453.7 (4) +0x0450|0b 00 00 00 |.... | cmd: "dysymtab" (0xb) 0x450-0x453.7 (4) 0x0450| 50 00 00 00 | P... | cmdsize: 80 0x454-0x457.7 (4) 0x0450| 00 00 00 00 | .... | ilocalsym: 0 0x458-0x45b.7 (4) 0x0450| 01 00 00 00| ....| nlocalsym: 1 0x45c-0x45f.7 (4) @@ -375,19 +388,19 @@ $ fq -d macho dv a_static 0x0490| 00 00 00 00 | .... | locreloff: 0 0x498-0x49b.7 (4) 0x0490| 00 00 00 00| ....| nlocrel: 0 0x49c-0x49f.7 (4) | | | [8]{}: load_command 0x4a0-0x4bf.7 (32) -0x04a0|0e 00 00 00 |.... | cmd: "load_dylinker" (14) 0x4a0-0x4a3.7 (4) +0x04a0|0e 00 00 00 |.... | cmd: "load_dylinker" (0xe) 0x4a0-0x4a3.7 (4) 0x04a0| 20 00 00 00 | ... | cmdsize: 32 0x4a4-0x4a7.7 (4) 0x04a0| 0c 00 00 00 | .... | offset: 12 0x4a8-0x4ab.7 (4) 0x04a0| 2f 75 73 72| /usr| name: "/usr/lib/dyld" 0x4ac-0x4bf.7 (20) 0x04b0|2f 6c 69 62 2f 64 79 6c 64 00 00 00 00 00 00 00|/lib/dyld.......| | | | [9]{}: load_command 0x4c0-0x4d7.7 (24) -0x04c0|1b 00 00 00 |.... | cmd: "uuid" (27) 0x4c0-0x4c3.7 (4) +0x04c0|1b 00 00 00 |.... | cmd: "uuid" (0x1b) 0x4c0-0x4c3.7 (4) 0x04c0| 18 00 00 00 | .... | cmdsize: 24 0x4c4-0x4c7.7 (4) | | | uuid_command{}: 0x4c8-0x4d7.7 (16) 0x04c0| a8 20 9f ff 52 b7 35 f9| . ..R.5.| uuid: raw bits 0x4c8-0x4d7.7 (16) 0x04d0|bb c4 e4 cd 80 88 20 6e |...... n | | | | [10]{}: load_command 0x4d8-0x4f7.7 (32) -0x04d0| 32 00 00 00 | 2... | cmd: "build_version" (50) 0x4d8-0x4db.7 (4) +0x04d0| 32 00 00 00 | 2... | cmd: "build_version" (0x32) 0x4d8-0x4db.7 (4) 0x04d0| 20 00 00 00| ...| cmdsize: 32 0x4dc-0x4df.7 (4) 0x04e0|01 00 00 00 |.... | platform: 1 0x4e0-0x4e3.7 (4) 0x04e0| 00 00 0b 00 | .... | minos: 720896 0x4e4-0x4e7.7 (4) @@ -398,18 +411,18 @@ $ fq -d macho dv a_static 0x04f0|03 00 00 00 |.... | tool: 3 0x4f0-0x4f3.7 (4) 0x04f0| 00 00 c7 02 | .... | version: 46596096 0x4f4-0x4f7.7 (4) | | | [11]{}: load_command 0x4f8-0x507.7 (16) -0x04f0| 2a 00 00 00 | *... | cmd: "source_version" (42) 0x4f8-0x4fb.7 (4) +0x04f0| 2a 00 00 00 | *... | cmd: "source_version" (0x2a) 0x4f8-0x4fb.7 (4) 0x04f0| 10 00 00 00| ....| cmdsize: 16 0x4fc-0x4ff.7 (4) | | | source_version_tag{}: 0x500-0x507.7 (8) 0x0500|00 00 00 00 00 00 00 00 |........ | tag: 0 0x500-0x507.7 (8) | | | [12]{}: load_command 0x508-0x51f.7 (24) -0x0500| 28 00 00 80 | (... | cmd: "main" (2147483688) 0x508-0x50b.7 (4) +0x0500| 28 00 00 80 | (... | cmd: "main" (0x80000028) 0x508-0x50b.7 (4) 0x0500| 18 00 00 00| ....| cmdsize: 24 0x50c-0x50f.7 (4) | | | entrypoint{}: 0x510-0x51f.7 (16) 0x0510|3c 3f 00 00 00 00 00 00 |