diff --git a/format/macho/macho.go b/format/macho/macho.go index 5b28c990..d710bf47 100644 --- a/format/macho/macho.go +++ b/format/macho/macho.go @@ -46,155 +46,173 @@ var endianNames = scalar.UToSymStr{ } var cpuTypes = scalar.UToSymStr{ - 0xff_ff_ff_ff: "cpu_type_any", - 1: "cpu_type_vax", - 2: "cpu_type_romp", - 4: "cpu_type_ns32032", - 5: "cpu_type_ns32332", - 6: "cpu_type_mc680x0", - 7: "cpu_type_x86", - 8: "cpu_type_mips", - 9: "cpu_type_ns32532", - 10: "cpu_type_mc98000", - 11: "cpu_type_hppa", - 12: "cpu_type_arm", - 13: "cpu_type_mc88000", - 14: "cpu_type_sparc", - 15: "cpu_type_i860", - 16: "cpu_type_i860_little", - 17: "cpu_type_rs6000", - 18: "cpu_type_powerpc", - 0x1000007: "cpu_type_x86_64", - 0x100000c: "cpu_type_arm64", - 0x1000013: "cpu_type_powerpc64", - 255: "cpu_type_veo", + 0xff_ff_ff_ff: "any", + 1: "vax", + 2: "romp", + 4: "ns32032", + 5: "ns32332", + 6: "mc680x0", + 7: "x86", + 8: "mips", + 9: "ns32532", + 10: "mc98000", + 11: "hppa", + 12: "arm", + 13: "mc88000", + 14: "sparc", + 15: "i860", + 16: "i860_little", + 17: "rs6000", + 18: "powerpc", + 0x1000007: "x86_64", + 0x100000c: "arm64", + 0x1000013: "powerpc64", + 255: "veo", +} + +func intelSubTypeHelper(f, m uint64) uint64 { + return f + (m << 4) } var cpuSubTypes = map[uint64]scalar.UToSymStr{ 0xff_ff_ff_ff: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", + 0xff_ff_ff_ff: "multiple", }, 1: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - 0: "cpu_subtype_vax_all", - 1: "cpu_subtype_vax780", - 2: "cpu_subtype_vax785", - 3: "cpu_subtype_vax750", - 4: "cpu_subtype_vax730", - 5: "cpu_subtype_uvaxi", - 6: "cpu_subtype_uvaxii", - 7: "cpu_subtype_vax8200", - 8: "cpu_subtype_vax8500", - 9: "cpu_subtype_vax8600", - 10: "cpu_subtype_vax8650", - 11: "cpu_subtype_vax8800", - 12: "cpu_subtype_uvaxiii", + 0xff_ff_ff_ff: "multiple", + 0: "vax_all", + 1: "vax780", + 2: "vax785", + 3: "vax750", + 4: "vax730", + 5: "uvaxi", + 6: "uvaxii", + 7: "vax8200", + 8: "vax8500", + 9: "vax8600", + 10: "vax8650", + 11: "vax8800", + 12: "uvaxiii", }, 6: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - 1: "cpu_subtype_mc680x0_all", // 1: cpu_subtype_mc68030 - 2: "cpu_subtype_mc68040", - 3: "cpu_subtype_mc68030_only", + 0xff_ff_ff_ff: "multiple", + 1: "mc680x0_all", // 1: mc68030 + 2: "mc68040", + 3: "mc68030_only", }, 7: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - intelSubTypeHelper(3, 0): "cpu_subtype_i386_all", // cpu_subtype_i386 - intelSubTypeHelper(4, 0): "cpu_subtype_i486", - intelSubTypeHelper(4, 8): "cpu_subtype_486sx", - intelSubTypeHelper(5, 0): "cpu_subtype_pent", - intelSubTypeHelper(6, 1): "cpu_subtype_pentpro", - intelSubTypeHelper(6, 3): "cpu_subtype_pentii_m3", - intelSubTypeHelper(6, 5): "cpu_subtype_pentii_m5", - intelSubTypeHelper(7, 6): "cpu_subtype_celeron", - intelSubTypeHelper(7, 7): "cpu_subtype_celeron_mobile", - intelSubTypeHelper(8, 0): "cpu_subtype_pentium_3", - intelSubTypeHelper(8, 1): "cpu_subtype_pentium_3_m", - intelSubTypeHelper(8, 2): "cpu_subtype_pentium_3_xeon", - intelSubTypeHelper(9, 0): "cpu_subtype_pentium_m", - intelSubTypeHelper(10, 0): "cpu_subtype_pentium_4", - intelSubTypeHelper(10, 1): "cpu_subtype_pentium_4_m", - intelSubTypeHelper(11, 0): "cpu_subtype_itanium", - intelSubTypeHelper(11, 1): "cpu_subtype_itanium_2", - intelSubTypeHelper(12, 0): "cpu_subtype_xeon", - intelSubTypeHelper(12, 1): "cpu_subtype_xeon_2", + 0xff_ff_ff_ff: "multiple", + intelSubTypeHelper(3, 0): "i386_all", // i386 + intelSubTypeHelper(4, 0): "i486", + intelSubTypeHelper(4, 8): "486sx", + intelSubTypeHelper(5, 0): "pent", + intelSubTypeHelper(6, 1): "pentpro", + intelSubTypeHelper(6, 3): "pentii_m3", + intelSubTypeHelper(6, 5): "pentii_m5", + intelSubTypeHelper(7, 6): "celeron", + intelSubTypeHelper(7, 7): "celeron_mobile", + intelSubTypeHelper(8, 0): "pentium_3", + intelSubTypeHelper(8, 1): "pentium_3_m", + intelSubTypeHelper(8, 2): "pentium_3_xeon", + intelSubTypeHelper(9, 0): "pentium_m", + intelSubTypeHelper(10, 0): "pentium_4", + intelSubTypeHelper(10, 1): "pentium_4_m", + intelSubTypeHelper(11, 0): "itanium", + intelSubTypeHelper(11, 1): "itanium_2", + intelSubTypeHelper(12, 0): "xeon", + intelSubTypeHelper(12, 1): "xeon_2", }, 8: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - 0: "cpu_subtype_mips_all", - 1: "cpu_subtype_mips_r2300", - 2: "cpu_subtype_mips_r2600", - 3: "cpu_subtype_mips_r2800", - 4: "cpu_subtype_mips_r2000a", - 5: "cpu_subtype_mips_r2000", - 6: "cpu_subtype_mips_r3000a", - 7: "cpu_subtype_mips_r3000", + 0xff_ff_ff_ff: "multiple", + 0: "mips_all", + 1: "mips_r2300", + 2: "mips_r2600", + 3: "mips_r2800", + 4: "mips_r2000a", + 5: "mips_r2000", + 6: "mips_r3000a", + 7: "mips_r3000", }, 10: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - 0: "cpu_subtype_mc98000_all", - 1: "cpu_subtype_mc98001", + 0xff_ff_ff_ff: "multiple", + 0: "mc98000_all", + 1: "mc98001", }, 11: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - 0: "cpu_subtype_hppa_all", - 1: "cpu_subtype_hppa_7100", - 2: "cpu_subtype_hppa_7100_lc", + 0xff_ff_ff_ff: "multiple", + 0: "hppa_all", + 1: "hppa_7100", + 2: "hppa_7100_lc", }, 12: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - 0: "cpu_subtype_arm_all", - 5: "cpu_subtype_arm_v4t", - 6: "cpu_subtype_arm_v6", - 7: "cpu_subtype_arm_v5tej", - 8: "cpu_subtype_arm_xscale", - 9: "cpu_subtype_arm_v7", - 10: "cpu_subtype_arm_v7f", - 11: "cpu_subtype_arm_v7s", - 12: "cpu_subtype_arm_v7k", - 13: "cpu_subtype_arm_v8", - 14: "cpu_subtype_arm_v6m", - 15: "cpu_subtype_arm_v7m", - 16: "cpu_subtype_arm_v7em", + 0xff_ff_ff_ff: "multiple", + 0: "arm_all", + 5: "arm_v4t", + 6: "arm_v6", + 7: "arm_v5tej", + 8: "arm_xscale", + 9: "arm_v7", + 10: "arm_v7f", + 11: "arm_v7s", + 12: "arm_v7k", + 13: "arm_v8", + 14: "arm_v6m", + 15: "arm_v7m", + 16: "arm_v7em", }, 13: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - 0: "cpu_subtype_mc88000_all", - 1: "cpu_subtype_mc88100", - 2: "cpu_subtype_mc88110", + 0xff_ff_ff_ff: "multiple", + 0: "mc88000_all", + 1: "mc88100", + 2: "mc88110", }, 14: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - 0: "cpu_subtype_sparc_all", + 0xff_ff_ff_ff: "multiple", + 0: "sparc_all", }, 15: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - 0: "cpu_subtype_i860_all", - 1: "cpu_subtype_i860_a860", + 0xff_ff_ff_ff: "multiple", + 0: "i860_all", + 1: "i860_a860", }, 18: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - 0: "cpu_subtype_powerpc_all", - 1: "cpu_subtype_powerpc_601", - 2: "cpu_subtype_powerpc_602", - 3: "cpu_subtype_powerpc_603", - 4: "cpu_subtype_powerpc_603e", - 5: "cpu_subtype_powerpc_603ev", - 6: "cpu_subtype_powerpc_604", - 7: "cpu_subtype_powerpc_604e", - 8: "cpu_subtype_powerpc_620", - 9: "cpu_subtype_powerpc_750", - 10: "cpu_subtype_powerpc_7400", - 11: "cpu_subtype_powerpc_7450", - 100: "cpu_subtype_powerpc_970", + 0xff_ff_ff_ff: "multiple", + 0: "powerpc_all", + 1: "powerpc_601", + 2: "powerpc_602", + 3: "powerpc_603", + 4: "powerpc_603e", + 5: "powerpc_603ev", + 6: "powerpc_604", + 7: "powerpc_604e", + 8: "powerpc_620", + 9: "powerpc_750", + 10: "powerpc_7400", + 11: "powerpc_7450", + 100: "powerpc_970", }, 0x1000012: { - 0xff_ff_ff_ff: "cpu_subtype_multiple", - 0: "cpu_subtype_arm64_all", - 1: "cpu_subtype_arm64_v8", - 2: "cpu_subtype_arm64_e", + 0xff_ff_ff_ff: "multiple", + 0: "arm64_all", + 1: "arm64_v8", + 2: "arm64_e", }, } +var fileTypes = scalar.UToSymStr{ + 0x1: "object", + 0x2: "execute", + 0x3: "fvmlib", + 0x4: "core", + 0x5: "preload", + 0x6: "dylib", + 0x7: "dylinker", + 0x8: "bundle", + 0x9: "dylib_stub", + 0xa: "dsym", + 0xb: "kext_bundle", +} + //nolint:revive const ( LC_REQ_DYLD = 0x80000000 @@ -251,20 +269,6 @@ const ( LC_BUILD_VERSION = 0x32 ) -var fileTypes = scalar.UToSymStr{ - 0x1: "object", - 0x2: "execute", - 0x3: "fvmlib", - 0x4: "core", - 0x5: "preload", - 0x6: "dylib", - 0x7: "dylinker", - 0x8: "bundle", - 0x9: "dylib_stub", - 0xa: "dsym", - 0xb: "kext_bundle", -} - var loadCommands = scalar.UToSymStr{ LC_REQ_DYLD: "req_dyld", LC_SEGMENT: "segment", @@ -386,11 +390,11 @@ func ofileDecode(d *decode.D) { d.SeekRel(-4 * 8) d.FieldStruct("header", func(d *decode.D) { d.FieldValueS("arch_bits", int64(archBits)) - magic := d.FieldU32("magic", scalar.Hex, magicSymMapper) + magic := d.FieldU32("magic", magicSymMapper, scalar.Hex) d.FieldValueU("bits", uint64(archBits)) d.FieldValueStr("endian", endianNames[magic]) - cpuType = d.FieldU32("cputype", cpuTypes) - d.FieldU32("cpusubtype", cpuSubTypes[cpuType]) + cpuType = d.FieldU32("cputype", cpuTypes, scalar.Hex) + d.FieldU32("cpusubtype", cpuSubTypes[cpuType], scalar.Hex) d.FieldU32("filetype", fileTypes) ncmds = d.FieldU32("ncdms") d.FieldU32("sizeofncdms") @@ -633,22 +637,20 @@ func fatParse(d *decode.D) { var narchs uint64 var ofileOffsets []uint64 d.FieldStruct("fat_header", func(d *decode.D) { - d.FieldRawLen("magic", 4*8) + d.FieldU32("magic", scalar.Hex) narchs = d.FieldU32("narchs") narchsIdx := 0 - d.FieldStructArrayLoop("archs", "arch", func() bool { + d.FieldStructArrayLoop("archs", "fat_arch", func() bool { return narchsIdx < int(narchs) }, func(d *decode.D) { // parse FatArch - d.FieldStruct("fat_arch", func(d *decode.D) { - // beware cputype and cpusubtype changes from ofile header to fat header - cpuType := d.FieldU32("cputype", cpuTypes) - d.FieldU32("cpusubtype", cpuSubTypes[cpuType]) - ofileOffsets = append(ofileOffsets, d.FieldU32("offset")) - d.FieldU32("size") - d.FieldU32("align") - }) + // beware cputype and cpusubtype changes from ofile header to fat header + cpuType := d.FieldU32("cputype", cpuTypes, scalar.Hex) + d.FieldU32("cpusubtype", cpuSubTypes[cpuType], scalar.Hex) + ofileOffsets = append(ofileOffsets, d.FieldU32("offset")) + d.FieldU32("size") + d.FieldU32("align") narchsIdx++ }) }) @@ -662,10 +664,6 @@ func fatParse(d *decode.D) { }) } -func intelSubTypeHelper(f, m uint64) uint64 { - return f + (m << 4) -} - func parseMachHeaderFlags(d *decode.D) { d.FieldRawLen("reserved", 6) d.FieldBool("app_extension_safe") diff --git a/format/macho/testdata/darwin_aarch64/a_dynamic.fqtest b/format/macho/testdata/darwin_aarch64/a_dynamic.fqtest index 50358e7a..ee9cde02 100644 --- a/format/macho/testdata/darwin_aarch64/a_dynamic.fqtest +++ b/format/macho/testdata/darwin_aarch64/a_dynamic.fqtest @@ -5,8 +5,8 @@ $ fq -d macho dv a_dynamic 0x0000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x0-0x3.7 (4) | | | bits: 64 0x4-NA (0) | | | endian: "little_endian" 0x4-NA (0) -0x0000| 0c 00 00 01 | .... | cputype: "cpu_type_arm64" (16777228) 0x4-0x7.7 (4) -0x0000| 00 00 00 00 | .... | cpusubtype: 0 0x8-0xb.7 (4) +0x0000| 0c 00 00 01 | .... | cputype: "arm64" (0x100000c) 0x4-0x7.7 (4) +0x0000| 00 00 00 00 | .... | cpusubtype: 0x0 0x8-0xb.7 (4) 0x0000| 02 00 00 00| ....| filetype: "execute" (2) 0xc-0xf.7 (4) 0x0010|12 00 00 00 |.... | ncdms: 18 0x10-0x13.7 (4) 0x0010| 90 05 00 00 | .... | sizeofncdms: 1424 0x14-0x17.7 (4) diff --git a/format/macho/testdata/darwin_aarch64/a_static.fqtest b/format/macho/testdata/darwin_aarch64/a_static.fqtest index 4f84d950..e7bbd7d2 100644 --- a/format/macho/testdata/darwin_aarch64/a_static.fqtest +++ b/format/macho/testdata/darwin_aarch64/a_static.fqtest @@ -5,8 +5,8 @@ $ fq -d macho dv a_static 0x0000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x0-0x3.7 (4) | | | bits: 64 0x4-NA (0) | | | endian: "little_endian" 0x4-NA (0) -0x0000| 0c 00 00 01 | .... | cputype: "cpu_type_arm64" (16777228) 0x4-0x7.7 (4) -0x0000| 00 00 00 00 | .... | cpusubtype: 0 0x8-0xb.7 (4) +0x0000| 0c 00 00 01 | .... | cputype: "arm64" (0x100000c) 0x4-0x7.7 (4) +0x0000| 00 00 00 00 | .... | cpusubtype: 0x0 0x8-0xb.7 (4) 0x0000| 02 00 00 00| ....| filetype: "execute" (2) 0xc-0xf.7 (4) 0x0010|11 00 00 00 |.... | ncdms: 17 0x10-0x13.7 (4) 0x0010| 68 05 00 00 | h... | sizeofncdms: 1384 0x14-0x17.7 (4) diff --git a/format/macho/testdata/darwin_aarch64/a_stripped.fqtest b/format/macho/testdata/darwin_aarch64/a_stripped.fqtest index 1d25585c..44d41c71 100644 --- a/format/macho/testdata/darwin_aarch64/a_stripped.fqtest +++ b/format/macho/testdata/darwin_aarch64/a_stripped.fqtest @@ -5,8 +5,8 @@ $ fq -d macho dv a_stripped 0x0000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x0-0x3.7 (4) | | | bits: 64 0x4-NA (0) | | | endian: "little_endian" 0x4-NA (0) -0x0000| 0c 00 00 01 | .... | cputype: "cpu_type_arm64" (16777228) 0x4-0x7.7 (4) -0x0000| 00 00 00 00 | .... | cpusubtype: 0 0x8-0xb.7 (4) +0x0000| 0c 00 00 01 | .... | cputype: "arm64" (0x100000c) 0x4-0x7.7 (4) +0x0000| 00 00 00 00 | .... | cpusubtype: 0x0 0x8-0xb.7 (4) 0x0000| 02 00 00 00| ....| filetype: "execute" (2) 0xc-0xf.7 (4) 0x0010|12 00 00 00 |.... | ncdms: 18 0x10-0x13.7 (4) 0x0010| 90 05 00 00 | .... | sizeofncdms: 1424 0x14-0x17.7 (4) diff --git a/format/macho/testdata/darwin_aarch64/libbbb.so.fqtest b/format/macho/testdata/darwin_aarch64/libbbb.so.fqtest index d00ba46f..e6e8acf4 100644 --- a/format/macho/testdata/darwin_aarch64/libbbb.so.fqtest +++ b/format/macho/testdata/darwin_aarch64/libbbb.so.fqtest @@ -5,8 +5,8 @@ $ fq -d macho dv libbbb.so 0x0000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x0-0x3.7 (4) | | | bits: 64 0x4-NA (0) | | | endian: "little_endian" 0x4-NA (0) -0x0000| 0c 00 00 01 | .... | cputype: "cpu_type_arm64" (16777228) 0x4-0x7.7 (4) -0x0000| 00 00 00 00 | .... | cpusubtype: 0 0x8-0xb.7 (4) +0x0000| 0c 00 00 01 | .... | cputype: "arm64" (0x100000c) 0x4-0x7.7 (4) +0x0000| 00 00 00 00 | .... | cpusubtype: 0x0 0x8-0xb.7 (4) 0x0000| 06 00 00 00| ....| filetype: "dylib" (6) 0xc-0xf.7 (4) 0x0010|0f 00 00 00 |.... | ncdms: 15 0x10-0x13.7 (4) 0x0010| 10 05 00 00 | .... | sizeofncdms: 1296 0x14-0x17.7 (4) diff --git a/format/macho/testdata/darwin_amd64/a_dynamic.fqtest b/format/macho/testdata/darwin_amd64/a_dynamic.fqtest index 59aa43ba..8705f097 100644 --- a/format/macho/testdata/darwin_amd64/a_dynamic.fqtest +++ b/format/macho/testdata/darwin_amd64/a_dynamic.fqtest @@ -5,8 +5,8 @@ $ fq -d macho dv a_dynamic 0x0000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x0-0x3.7 (4) | | | bits: 64 0x4-NA (0) | | | endian: "little_endian" 0x4-NA (0) -0x0000| 07 00 00 01 | .... | cputype: "cpu_type_x86_64" (16777223) 0x4-0x7.7 (4) -0x0000| 03 00 00 00 | .... | cpusubtype: 3 0x8-0xb.7 (4) +0x0000| 07 00 00 01 | .... | cputype: "x86_64" (0x1000007) 0x4-0x7.7 (4) +0x0000| 03 00 00 00 | .... | cpusubtype: 0x3 0x8-0xb.7 (4) 0x0000| 02 00 00 00| ....| filetype: "execute" (2) 0xc-0xf.7 (4) 0x0010|10 00 00 00 |.... | ncdms: 16 0x10-0x13.7 (4) 0x0010| 28 05 00 00 | (... | sizeofncdms: 1320 0x14-0x17.7 (4) diff --git a/format/macho/testdata/darwin_amd64/a_static.fqtest b/format/macho/testdata/darwin_amd64/a_static.fqtest index 59bd5c9c..bbc50976 100644 --- a/format/macho/testdata/darwin_amd64/a_static.fqtest +++ b/format/macho/testdata/darwin_amd64/a_static.fqtest @@ -5,8 +5,8 @@ $ fq -d macho dv a_static 0x0000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x0-0x3.7 (4) | | | bits: 64 0x4-NA (0) | | | endian: "little_endian" 0x4-NA (0) -0x0000| 07 00 00 01 | .... | cputype: "cpu_type_x86_64" (16777223) 0x4-0x7.7 (4) -0x0000| 03 00 00 00 | .... | cpusubtype: 3 0x8-0xb.7 (4) +0x0000| 07 00 00 01 | .... | cputype: "x86_64" (0x1000007) 0x4-0x7.7 (4) +0x0000| 03 00 00 00 | .... | cpusubtype: 0x3 0x8-0xb.7 (4) 0x0000| 02 00 00 00| ....| filetype: "execute" (2) 0xc-0xf.7 (4) 0x0010|0f 00 00 00 |.... | ncdms: 15 0x10-0x13.7 (4) 0x0010| 00 05 00 00 | .... | sizeofncdms: 1280 0x14-0x17.7 (4) diff --git a/format/macho/testdata/darwin_amd64/a_stripped.fqtest b/format/macho/testdata/darwin_amd64/a_stripped.fqtest index 3a2eceec..fe6a3c16 100644 --- a/format/macho/testdata/darwin_amd64/a_stripped.fqtest +++ b/format/macho/testdata/darwin_amd64/a_stripped.fqtest @@ -5,8 +5,8 @@ $ fq -d macho dv a_stripped 0x0000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x0-0x3.7 (4) | | | bits: 64 0x4-NA (0) | | | endian: "little_endian" 0x4-NA (0) -0x0000| 07 00 00 01 | .... | cputype: "cpu_type_x86_64" (16777223) 0x4-0x7.7 (4) -0x0000| 03 00 00 00 | .... | cpusubtype: 3 0x8-0xb.7 (4) +0x0000| 07 00 00 01 | .... | cputype: "x86_64" (0x1000007) 0x4-0x7.7 (4) +0x0000| 03 00 00 00 | .... | cpusubtype: 0x3 0x8-0xb.7 (4) 0x0000| 02 00 00 00| ....| filetype: "execute" (2) 0xc-0xf.7 (4) 0x0010|10 00 00 00 |.... | ncdms: 16 0x10-0x13.7 (4) 0x0010| 28 05 00 00 | (... | sizeofncdms: 1320 0x14-0x17.7 (4) diff --git a/format/macho/testdata/darwin_amd64/libbbb.so.fqtest b/format/macho/testdata/darwin_amd64/libbbb.so.fqtest index 73c65c8f..7d1072dd 100644 --- a/format/macho/testdata/darwin_amd64/libbbb.so.fqtest +++ b/format/macho/testdata/darwin_amd64/libbbb.so.fqtest @@ -5,8 +5,8 @@ $ fq -d macho dv libbbb.so 0x0000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x0-0x3.7 (4) | | | bits: 64 0x4-NA (0) | | | endian: "little_endian" 0x4-NA (0) -0x0000| 07 00 00 01 | .... | cputype: "cpu_type_x86_64" (16777223) 0x4-0x7.7 (4) -0x0000| 03 00 00 00 | .... | cpusubtype: 3 0x8-0xb.7 (4) +0x0000| 07 00 00 01 | .... | cputype: "x86_64" (0x1000007) 0x4-0x7.7 (4) +0x0000| 03 00 00 00 | .... | cpusubtype: 0x3 0x8-0xb.7 (4) 0x0000| 06 00 00 00| ....| filetype: "dylib" (6) 0xc-0xf.7 (4) 0x0010|0d 00 00 00 |.... | ncdms: 13 0x10-0x13.7 (4) 0x0010| a8 04 00 00 | .... | sizeofncdms: 1192 0x14-0x17.7 (4) diff --git a/format/macho/testdata/darwin_fat/a_dynamic.fqtest b/format/macho/testdata/darwin_fat/a_dynamic.fqtest index 64f6e36b..fdcc7aaa 100644 --- a/format/macho/testdata/darwin_fat/a_dynamic.fqtest +++ b/format/macho/testdata/darwin_fat/a_dynamic.fqtest @@ -1,23 +1,21 @@ $ fq -d macho dv a_dynamic |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.{}: a_dynamic (macho) 0x0-0x1c375.7 (115574) | | | fat_header{}: 0x0-0x2f.7 (48) -0x00000|ca fe ba be |.... | magic: raw bits 0x0-0x3.7 (4) +0x00000|ca fe ba be |.... | magic: 0xcafebabe 0x0-0x3.7 (4) 0x00000| 00 00 00 02 | .... | narchs: 2 0x4-0x7.7 (4) | | | archs[0:2]: 0x8-0x2f.7 (40) - | | | [0]{}: arch 0x8-0x1b.7 (20) - | | | fat_arch{}: 0x8-0x1b.7 (20) -0x00000| 01 00 00 07 | .... | cputype: "cpu_type_x86_64" (16777223) 0x8-0xb.7 (4) -0x00000| 00 00 00 03| ....| cpusubtype: 3 0xc-0xf.7 (4) -0x00010|00 00 40 00 |..@. | offset: 16384 0x10-0x13.7 (4) -0x00010| 00 00 81 40 | ...@ | size: 33088 0x14-0x17.7 (4) -0x00010| 00 00 00 0e | .... | align: 14 0x18-0x1b.7 (4) - | | | [1]{}: arch 0x1c-0x2f.7 (20) - | | | fat_arch{}: 0x1c-0x2f.7 (20) -0x00010| 01 00 00 0c| ....| cputype: "cpu_type_arm64" (16777228) 0x1c-0x1f.7 (4) -0x00020|00 00 00 00 |.... | cpusubtype: 0 0x20-0x23.7 (4) -0x00020| 00 01 00 00 | .... | offset: 65536 0x24-0x27.7 (4) -0x00020| 00 00 c3 76 | ...v | size: 50038 0x28-0x2b.7 (4) -0x00020| 00 00 00 0e| ....| align: 14 0x2c-0x2f.7 (4) + | | | [0]{}: fat_arch 0x8-0x1b.7 (20) +0x00000| 01 00 00 07 | .... | cputype: "x86_64" (0x1000007) 0x8-0xb.7 (4) +0x00000| 00 00 00 03| ....| cpusubtype: 0x3 0xc-0xf.7 (4) +0x00010|00 00 40 00 |..@. | offset: 16384 0x10-0x13.7 (4) +0x00010| 00 00 81 40 | ...@ | size: 33088 0x14-0x17.7 (4) +0x00010| 00 00 00 0e | .... | align: 14 0x18-0x1b.7 (4) + | | | [1]{}: fat_arch 0x1c-0x2f.7 (20) +0x00010| 01 00 00 0c| ....| cputype: "arm64" (0x100000c) 0x1c-0x1f.7 (4) +0x00020|00 00 00 00 |.... | cpusubtype: 0x0 0x20-0x23.7 (4) +0x00020| 00 01 00 00 | .... | offset: 65536 0x24-0x27.7 (4) +0x00020| 00 00 c3 76 | ...v | size: 50038 0x28-0x2b.7 (4) +0x00020| 00 00 00 0e| ....| align: 14 0x2c-0x2f.7 (4) 0x00030|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| unknown0: raw bits 0x30-0x3fff.7 (16336) * |until 0x3fff.7 (16336) | | | | | files[0:2]: 0x4000-0x105af.7 (50608) @@ -27,8 +25,8 @@ $ fq -d macho dv a_dynamic 0x04000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x4000-0x4003.7 (4) | | | bits: 64 0x4004-NA (0) | | | endian: "little_endian" 0x4004-NA (0) -0x04000| 07 00 00 01 | .... | cputype: "cpu_type_x86_64" (16777223) 0x4004-0x4007.7 (4) -0x04000| 03 00 00 00 | .... | cpusubtype: 3 0x4008-0x400b.7 (4) +0x04000| 07 00 00 01 | .... | cputype: "x86_64" (0x1000007) 0x4004-0x4007.7 (4) +0x04000| 03 00 00 00 | .... | cpusubtype: 0x3 0x4008-0x400b.7 (4) 0x04000| 02 00 00 00| ....| filetype: "execute" (2) 0x400c-0x400f.7 (4) 0x04010|10 00 00 00 |.... | ncdms: 16 0x4010-0x4013.7 (4) 0x04010| 28 05 00 00 | (... | sizeofncdms: 1320 0x4014-0x4017.7 (4) @@ -457,8 +455,8 @@ $ fq -d macho dv a_dynamic 0x10000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x10000-0x10003.7 (4) | | | bits: 64 0x10004-NA (0) | | | endian: "little_endian" 0x10004-NA (0) -0x10000| 0c 00 00 01 | .... | cputype: "cpu_type_arm64" (16777228) 0x10004-0x10007.7 (4) -0x10000| 00 00 00 00 | .... | cpusubtype: 0 0x10008-0x1000b.7 (4) +0x10000| 0c 00 00 01 | .... | cputype: "arm64" (0x100000c) 0x10004-0x10007.7 (4) +0x10000| 00 00 00 00 | .... | cpusubtype: 0x0 0x10008-0x1000b.7 (4) 0x10000| 02 00 00 00| ....| filetype: "execute" (2) 0x1000c-0x1000f.7 (4) 0x10010|12 00 00 00 |.... | ncdms: 18 0x10010-0x10013.7 (4) 0x10010| 90 05 00 00 | .... | sizeofncdms: 1424 0x10014-0x10017.7 (4) diff --git a/format/macho/testdata/darwin_fat/a_static.fqtest b/format/macho/testdata/darwin_fat/a_static.fqtest index d9cccb8b..3a681e42 100644 --- a/format/macho/testdata/darwin_fat/a_static.fqtest +++ b/format/macho/testdata/darwin_fat/a_static.fqtest @@ -1,23 +1,21 @@ $ fq -d macho dv a_static |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.{}: a_static (macho) 0x0-0x1c374.7 (115573) | | | fat_header{}: 0x0-0x2f.7 (48) -0x00000|ca fe ba be |.... | magic: raw bits 0x0-0x3.7 (4) +0x00000|ca fe ba be |.... | magic: 0xcafebabe 0x0-0x3.7 (4) 0x00000| 00 00 00 02 | .... | narchs: 2 0x4-0x7.7 (4) | | | archs[0:2]: 0x8-0x2f.7 (40) - | | | [0]{}: arch 0x8-0x1b.7 (20) - | | | fat_arch{}: 0x8-0x1b.7 (20) -0x00000| 01 00 00 07 | .... | cputype: "cpu_type_x86_64" (16777223) 0x8-0xb.7 (4) -0x00000| 00 00 00 03| ....| cpusubtype: 3 0xc-0xf.7 (4) -0x00010|00 00 40 00 |..@. | offset: 16384 0x10-0x13.7 (4) -0x00010| 00 00 81 38 | ...8 | size: 33080 0x14-0x17.7 (4) -0x00010| 00 00 00 0e | .... | align: 14 0x18-0x1b.7 (4) - | | | [1]{}: arch 0x1c-0x2f.7 (20) - | | | fat_arch{}: 0x1c-0x2f.7 (20) -0x00010| 01 00 00 0c| ....| cputype: "cpu_type_arm64" (16777228) 0x1c-0x1f.7 (4) -0x00020|00 00 00 00 |.... | cpusubtype: 0 0x20-0x23.7 (4) -0x00020| 00 01 00 00 | .... | offset: 65536 0x24-0x27.7 (4) -0x00020| 00 00 c3 75 | ...u | size: 50037 0x28-0x2b.7 (4) -0x00020| 00 00 00 0e| ....| align: 14 0x2c-0x2f.7 (4) + | | | [0]{}: fat_arch 0x8-0x1b.7 (20) +0x00000| 01 00 00 07 | .... | cputype: "x86_64" (0x1000007) 0x8-0xb.7 (4) +0x00000| 00 00 00 03| ....| cpusubtype: 0x3 0xc-0xf.7 (4) +0x00010|00 00 40 00 |..@. | offset: 16384 0x10-0x13.7 (4) +0x00010| 00 00 81 38 | ...8 | size: 33080 0x14-0x17.7 (4) +0x00010| 00 00 00 0e | .... | align: 14 0x18-0x1b.7 (4) + | | | [1]{}: fat_arch 0x1c-0x2f.7 (20) +0x00010| 01 00 00 0c| ....| cputype: "arm64" (0x100000c) 0x1c-0x1f.7 (4) +0x00020|00 00 00 00 |.... | cpusubtype: 0x0 0x20-0x23.7 (4) +0x00020| 00 01 00 00 | .... | offset: 65536 0x24-0x27.7 (4) +0x00020| 00 00 c3 75 | ...u | size: 50037 0x28-0x2b.7 (4) +0x00020| 00 00 00 0e| ....| align: 14 0x2c-0x2f.7 (4) 0x00030|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| unknown0: raw bits 0x30-0x3fff.7 (16336) * |until 0x3fff.7 (16336) | | | | | files[0:2]: 0x4000-0x10587.7 (50568) @@ -27,8 +25,8 @@ $ fq -d macho dv a_static 0x04000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x4000-0x4003.7 (4) | | | bits: 64 0x4004-NA (0) | | | endian: "little_endian" 0x4004-NA (0) -0x04000| 07 00 00 01 | .... | cputype: "cpu_type_x86_64" (16777223) 0x4004-0x4007.7 (4) -0x04000| 03 00 00 00 | .... | cpusubtype: 3 0x4008-0x400b.7 (4) +0x04000| 07 00 00 01 | .... | cputype: "x86_64" (0x1000007) 0x4004-0x4007.7 (4) +0x04000| 03 00 00 00 | .... | cpusubtype: 0x3 0x4008-0x400b.7 (4) 0x04000| 02 00 00 00| ....| filetype: "execute" (2) 0x400c-0x400f.7 (4) 0x04010|0f 00 00 00 |.... | ncdms: 15 0x4010-0x4013.7 (4) 0x04010| 00 05 00 00 | .... | sizeofncdms: 1280 0x4014-0x4017.7 (4) @@ -447,8 +445,8 @@ $ fq -d macho dv a_static 0x10000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x10000-0x10003.7 (4) | | | bits: 64 0x10004-NA (0) | | | endian: "little_endian" 0x10004-NA (0) -0x10000| 0c 00 00 01 | .... | cputype: "cpu_type_arm64" (16777228) 0x10004-0x10007.7 (4) -0x10000| 00 00 00 00 | .... | cpusubtype: 0 0x10008-0x1000b.7 (4) +0x10000| 0c 00 00 01 | .... | cputype: "arm64" (0x100000c) 0x10004-0x10007.7 (4) +0x10000| 00 00 00 00 | .... | cpusubtype: 0x0 0x10008-0x1000b.7 (4) 0x10000| 02 00 00 00| ....| filetype: "execute" (2) 0x1000c-0x1000f.7 (4) 0x10010|11 00 00 00 |.... | ncdms: 17 0x10010-0x10013.7 (4) 0x10010| 68 05 00 00 | h... | sizeofncdms: 1384 0x10014-0x10017.7 (4) diff --git a/format/macho/testdata/darwin_fat/a_stripped.fqtest b/format/macho/testdata/darwin_fat/a_stripped.fqtest index 9755418c..3b1b4496 100644 --- a/format/macho/testdata/darwin_fat/a_stripped.fqtest +++ b/format/macho/testdata/darwin_fat/a_stripped.fqtest @@ -1,23 +1,21 @@ $ fq -d macho dv a_stripped |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.{}: a_stripped (macho) 0x0-0x1c357.7 (115544) | | | fat_header{}: 0x0-0x2f.7 (48) -0x00000|ca fe ba be |.... | magic: raw bits 0x0-0x3.7 (4) +0x00000|ca fe ba be |.... | magic: 0xcafebabe 0x0-0x3.7 (4) 0x00000| 00 00 00 02 | .... | narchs: 2 0x4-0x7.7 (4) | | | archs[0:2]: 0x8-0x2f.7 (40) - | | | [0]{}: arch 0x8-0x1b.7 (20) - | | | fat_arch{}: 0x8-0x1b.7 (20) -0x00000| 01 00 00 07 | .... | cputype: "cpu_type_x86_64" (16777223) 0x8-0xb.7 (4) -0x00000| 00 00 00 03| ....| cpusubtype: 3 0xc-0xf.7 (4) -0x00010|00 00 40 00 |..@. | offset: 16384 0x10-0x13.7 (4) -0x00010| 00 00 81 38 | ...8 | size: 33080 0x14-0x17.7 (4) -0x00010| 00 00 00 0e | .... | align: 14 0x18-0x1b.7 (4) - | | | [1]{}: arch 0x1c-0x2f.7 (20) - | | | fat_arch{}: 0x1c-0x2f.7 (20) -0x00010| 01 00 00 0c| ....| cputype: "cpu_type_arm64" (16777228) 0x1c-0x1f.7 (4) -0x00020|00 00 00 00 |.... | cpusubtype: 0 0x20-0x23.7 (4) -0x00020| 00 01 00 00 | .... | offset: 65536 0x24-0x27.7 (4) -0x00020| 00 00 c3 58 | ...X | size: 50008 0x28-0x2b.7 (4) -0x00020| 00 00 00 0e| ....| align: 14 0x2c-0x2f.7 (4) + | | | [0]{}: fat_arch 0x8-0x1b.7 (20) +0x00000| 01 00 00 07 | .... | cputype: "x86_64" (0x1000007) 0x8-0xb.7 (4) +0x00000| 00 00 00 03| ....| cpusubtype: 0x3 0xc-0xf.7 (4) +0x00010|00 00 40 00 |..@. | offset: 16384 0x10-0x13.7 (4) +0x00010| 00 00 81 38 | ...8 | size: 33080 0x14-0x17.7 (4) +0x00010| 00 00 00 0e | .... | align: 14 0x18-0x1b.7 (4) + | | | [1]{}: fat_arch 0x1c-0x2f.7 (20) +0x00010| 01 00 00 0c| ....| cputype: "arm64" (0x100000c) 0x1c-0x1f.7 (4) +0x00020|00 00 00 00 |.... | cpusubtype: 0x0 0x20-0x23.7 (4) +0x00020| 00 01 00 00 | .... | offset: 65536 0x24-0x27.7 (4) +0x00020| 00 00 c3 58 | ...X | size: 50008 0x28-0x2b.7 (4) +0x00020| 00 00 00 0e| ....| align: 14 0x2c-0x2f.7 (4) 0x00030|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| unknown0: raw bits 0x30-0x3fff.7 (16336) * |until 0x3fff.7 (16336) | | | | | files[0:2]: 0x4000-0x105af.7 (50608) @@ -27,8 +25,8 @@ $ fq -d macho dv a_stripped 0x04000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x4000-0x4003.7 (4) | | | bits: 64 0x4004-NA (0) | | | endian: "little_endian" 0x4004-NA (0) -0x04000| 07 00 00 01 | .... | cputype: "cpu_type_x86_64" (16777223) 0x4004-0x4007.7 (4) -0x04000| 03 00 00 00 | .... | cpusubtype: 3 0x4008-0x400b.7 (4) +0x04000| 07 00 00 01 | .... | cputype: "x86_64" (0x1000007) 0x4004-0x4007.7 (4) +0x04000| 03 00 00 00 | .... | cpusubtype: 0x3 0x4008-0x400b.7 (4) 0x04000| 02 00 00 00| ....| filetype: "execute" (2) 0x400c-0x400f.7 (4) 0x04010|10 00 00 00 |.... | ncdms: 16 0x4010-0x4013.7 (4) 0x04010| 28 05 00 00 | (... | sizeofncdms: 1320 0x4014-0x4017.7 (4) @@ -457,8 +455,8 @@ $ fq -d macho dv a_stripped 0x10000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x10000-0x10003.7 (4) | | | bits: 64 0x10004-NA (0) | | | endian: "little_endian" 0x10004-NA (0) -0x10000| 0c 00 00 01 | .... | cputype: "cpu_type_arm64" (16777228) 0x10004-0x10007.7 (4) -0x10000| 00 00 00 00 | .... | cpusubtype: 0 0x10008-0x1000b.7 (4) +0x10000| 0c 00 00 01 | .... | cputype: "arm64" (0x100000c) 0x10004-0x10007.7 (4) +0x10000| 00 00 00 00 | .... | cpusubtype: 0x0 0x10008-0x1000b.7 (4) 0x10000| 02 00 00 00| ....| filetype: "execute" (2) 0x1000c-0x1000f.7 (4) 0x10010|12 00 00 00 |.... | ncdms: 18 0x10010-0x10013.7 (4) 0x10010| 90 05 00 00 | .... | sizeofncdms: 1424 0x10014-0x10017.7 (4) diff --git a/format/macho/testdata/darwin_fat/libbbb.so.fqtest b/format/macho/testdata/darwin_fat/libbbb.so.fqtest index d6fa6a49..b6e3c351 100644 --- a/format/macho/testdata/darwin_fat/libbbb.so.fqtest +++ b/format/macho/testdata/darwin_fat/libbbb.so.fqtest @@ -1,23 +1,21 @@ $ fq -d macho dv libbbb.so |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.{}: libbbb.so (macho) 0x0-0x1c2f5.7 (115446) | | | fat_header{}: 0x0-0x2f.7 (48) -0x00000|ca fe ba be |.... | magic: raw bits 0x0-0x3.7 (4) +0x00000|ca fe ba be |.... | magic: 0xcafebabe 0x0-0x3.7 (4) 0x00000| 00 00 00 02 | .... | narchs: 2 0x4-0x7.7 (4) | | | archs[0:2]: 0x8-0x2f.7 (40) - | | | [0]{}: arch 0x8-0x1b.7 (20) - | | | fat_arch{}: 0x8-0x1b.7 (20) -0x00000| 01 00 00 07 | .... | cputype: "cpu_type_x86_64" (16777223) 0x8-0xb.7 (4) -0x00000| 00 00 00 03| ....| cpusubtype: 3 0xc-0xf.7 (4) -0x00010|00 00 40 00 |..@. | offset: 16384 0x10-0x13.7 (4) -0x00010| 00 00 80 b8 | .... | size: 32952 0x14-0x17.7 (4) -0x00010| 00 00 00 0e | .... | align: 14 0x18-0x1b.7 (4) - | | | [1]{}: arch 0x1c-0x2f.7 (20) - | | | fat_arch{}: 0x1c-0x2f.7 (20) -0x00010| 01 00 00 0c| ....| cputype: "cpu_type_arm64" (16777228) 0x1c-0x1f.7 (4) -0x00020|00 00 00 00 |.... | cpusubtype: 0 0x20-0x23.7 (4) -0x00020| 00 01 00 00 | .... | offset: 65536 0x24-0x27.7 (4) -0x00020| 00 00 c2 f6 | .... | size: 49910 0x28-0x2b.7 (4) -0x00020| 00 00 00 0e| ....| align: 14 0x2c-0x2f.7 (4) + | | | [0]{}: fat_arch 0x8-0x1b.7 (20) +0x00000| 01 00 00 07 | .... | cputype: "x86_64" (0x1000007) 0x8-0xb.7 (4) +0x00000| 00 00 00 03| ....| cpusubtype: 0x3 0xc-0xf.7 (4) +0x00010|00 00 40 00 |..@. | offset: 16384 0x10-0x13.7 (4) +0x00010| 00 00 80 b8 | .... | size: 32952 0x14-0x17.7 (4) +0x00010| 00 00 00 0e | .... | align: 14 0x18-0x1b.7 (4) + | | | [1]{}: fat_arch 0x1c-0x2f.7 (20) +0x00010| 01 00 00 0c| ....| cputype: "arm64" (0x100000c) 0x1c-0x1f.7 (4) +0x00020|00 00 00 00 |.... | cpusubtype: 0x0 0x20-0x23.7 (4) +0x00020| 00 01 00 00 | .... | offset: 65536 0x24-0x27.7 (4) +0x00020| 00 00 c2 f6 | .... | size: 49910 0x28-0x2b.7 (4) +0x00020| 00 00 00 0e| ....| align: 14 0x2c-0x2f.7 (4) 0x00030|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| unknown0: raw bits 0x30-0x3fff.7 (16336) * |until 0x3fff.7 (16336) | | | | | files[0:2]: 0x4000-0x1052f.7 (50480) @@ -27,8 +25,8 @@ $ fq -d macho dv libbbb.so 0x04000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x4000-0x4003.7 (4) | | | bits: 64 0x4004-NA (0) | | | endian: "little_endian" 0x4004-NA (0) -0x04000| 07 00 00 01 | .... | cputype: "cpu_type_x86_64" (16777223) 0x4004-0x4007.7 (4) -0x04000| 03 00 00 00 | .... | cpusubtype: 3 0x4008-0x400b.7 (4) +0x04000| 07 00 00 01 | .... | cputype: "x86_64" (0x1000007) 0x4004-0x4007.7 (4) +0x04000| 03 00 00 00 | .... | cpusubtype: 0x3 0x4008-0x400b.7 (4) 0x04000| 06 00 00 00| ....| filetype: "dylib" (6) 0x400c-0x400f.7 (4) 0x04010|0d 00 00 00 |.... | ncdms: 13 0x4010-0x4013.7 (4) 0x04010| a8 04 00 00 | .... | sizeofncdms: 1192 0x4014-0x4017.7 (4) @@ -429,8 +427,8 @@ $ fq -d macho dv libbbb.so 0x10000|cf fa ed fe |.... | magic: 0xfeedfacf (64-bit little endian) 0x10000-0x10003.7 (4) | | | bits: 64 0x10004-NA (0) | | | endian: "little_endian" 0x10004-NA (0) -0x10000| 0c 00 00 01 | .... | cputype: "cpu_type_arm64" (16777228) 0x10004-0x10007.7 (4) -0x10000| 00 00 00 00 | .... | cpusubtype: 0 0x10008-0x1000b.7 (4) +0x10000| 0c 00 00 01 | .... | cputype: "arm64" (0x100000c) 0x10004-0x10007.7 (4) +0x10000| 00 00 00 00 | .... | cpusubtype: 0x0 0x10008-0x1000b.7 (4) 0x10000| 06 00 00 00| ....| filetype: "dylib" (6) 0x1000c-0x1000f.7 (4) 0x10010|0f 00 00 00 |.... | ncdms: 15 0x10010-0x10013.7 (4) 0x10010| 10 05 00 00 | .... | sizeofncdms: 1296 0x10014-0x10017.7 (4)