Package ghidra.app.util.bin.format.macho

Class MachHeader

java.lang.Object
ghidra.app.util.bin.format.macho.MachHeader
All Implemented Interfaces:
StructConverter
public class MachHeader extends Object implements StructConverter
Represents a mach_header structure.
See Also:

  • Constructor Details

    • MachHeader

      public MachHeader(ByteProvider provider) throws IOException, MachException
      Creates a new MachHeader. Assumes the MachHeader starts at index 0 in the ByteProvider.
      Parameters:
      provider - the ByteProvider
      Throws:
      IOException - if an I/O error occurs while reading from the ByteProvider
      MachException - if an invalid MachHeader is detected

    • MachHeader

      public MachHeader(ByteProvider provider, long machHeaderStartIndexInProvider) throws IOException, MachException
      Creates a new MachHeader. Assumes the MachHeader starts at index machHeaderStartIndexInProvider in the ByteProvider.
      Parameters:
      provider - the ByteProvider
      machHeaderStartIndexInProvider - the index into the ByteProvider where the MachHeader begins
      Throws:
      IOException - if an I/O error occurs while reading from the ByteProvider
      MachException - if an invalid MachHeader is detected

    • MachHeader

      public MachHeader(ByteProvider provider, long machHeaderStartIndexInProvider, boolean isRemainingMachoRelativeToStartIndex) throws IOException, MachException
      Creatse a new MachHeader. Assumes the MachHeader starts at index machHeaderStartIndexInProvider in the ByteProvider.
      Parameters:
      provider - the ByteProvider
      machHeaderStartIndexInProvider - the index into the ByteProvider where the MachHeader begins.
      isRemainingMachoRelativeToStartIndex - true if the rest of the macho uses relative indexin (this is common in UBI and kernel cache files); otherwise, false if the rest of the file uses absolute indexing from 0 (this is common in DYLD cache files)
      Throws:
      IOException - if an I/O error occurs while reading from the ByteProvider
      MachException - if an invalid MachHeader is detected

  • Method Details

    • isMachHeader

      public static boolean isMachHeader(ByteProvider provider)
      Returns true if the specified ByteProvider starts with a Mach header magic signature.
      Parameters:
      provider - ByteProvider to check
      Returns:
      boolean true if byte provider starts with a MachHeader

    • parse

      public MachHeader parse() throws IOException, MachException
      Parses this MachHeader's load commands
      Returns:
      This MachHeader, for convenience
      Throws:
      IOException - If there was an IO-related error
      MachException - if the load command is invalid

    • parse

      public MachHeader parse(DyldCacheUtils.SplitDyldCache splitDyldCache) throws IOException, MachException
      Parses this MachHeader's load commands
      Parameters:
      splitDyldCache - The DyldCacheUtils.SplitDyldCache that this header resides in. Could be null if a split DYLD cache is not being used.
      Returns:
      This MachHeader, for convenience
      Throws:
      IOException - If there was an IO-related error
      MachException - if the load command is invalid

    • parseSegments

      public List<SegmentCommand> parseSegments() throws IOException
      Parses only this MachHeader's segments
      Returns:
      A List of this MachHeader's segments
      Throws:
      IOException - If there was an IO-related error

    • parseAndCheck

      public boolean parseAndCheck(int loadCommandType) throws IOException
      Parses only this MachHeader's LoadCommands to check to see if one of the given type exists
      Parameters:
      loadCommandType - The type of LoadCommand to check for
      Returns:
      True if this MachHeader contains the given LoadCommand type
      Throws:
      IOException - If there was an IO-related error
      See Also:

    • getMagic

      public int getMagic()

    • getCpuType

      public int getCpuType()

    • getImageBase

      public long getImageBase()

    • getCpuSubType

      public int getCpuSubType()

    • getFileType

      public int getFileType()

    • getNumberOfCommands

      public int getNumberOfCommands()

    • getSizeOfCommands

      public int getSizeOfCommands()

    • getFlags

      public int getFlags()

    • getReserved

      public int getReserved() throws MachException
      Throws:
      MachException

    • toDataType

      public DataType toDataType() throws DuplicateNameException, IOException
      Description copied from interface: StructConverter
      Returns a structure datatype representing the contents of the implementor of this interface.

      For example, given: 

       class A {
     int foo;
     double bar;
 }

      The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

      Specified by:
      toDataType in interface StructConverter
      Returns:
      returns a structure datatype representing the implementor of this interface
      Throws:
      DuplicateNameException - when a datatype of the same name already exists
      IOException - if an IO-related error occurs
      See Also:

    • getStartIndex

      public long getStartIndex()
      Returns the start index that should be used for calculating offsets. This will be 0 for things such as the dyld shared cache where offsets are based off the beginning of the file.
      Returns:
      the start index that should be used for calculating offsets

    • getStartIndexInProvider

      public long getStartIndexInProvider()
      Returns the offset of the MachHeader in the ByteProvider
      Returns:
      the offset of the MachHeader in the ByteProvider

    • is32bit

      public boolean is32bit()

    • getAddressSize

      public int getAddressSize()

    • getAllSegments

      public List<SegmentCommand> getAllSegments()

    • getSegment

      public SegmentCommand getSegment(String segmentName)

    • getSection

      public Section getSection(String segmentName, String sectionName)

    • getAllSections

      public List<Section> getAllSections()

    • getLoadCommands

      public List<LoadCommand> getLoadCommands()

    • getLoadCommands

      public <T> List<T> getLoadCommands(Class<T> classType)

    • getFirstLoadCommand

      public <T> T getFirstLoadCommand(Class<T> classType)

    • isLittleEndian

      public boolean isLittleEndian()

    • getSize

      public long getSize()
      Gets the size of this MachHeader in bytes
      Returns:
      The size of this MachHeader in bytes

    • getDescription

      public String getDescription()

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • create

      public static byte[] create(int magic, int cpuType, int cpuSubType, int fileType, int nCmds, int sizeOfCmds, int flags, int reserved) throws MachException
      Creates a new Mach Header byte array
      Parameters:
      magic - The magic
      cpuType - The cpu type
      cpuSubType - The cpu subtype
      fileType - The file type
      nCmds - The number of commands
      sizeOfCmds - The size of the commands
      flags - The flags
      reserved - A reserved value (ignored for 32-bit magic)
      Returns:
      The new header in byte array form
      Throws:
      MachException - if an invalid magic value was passed in (see MachConstants)