Package ghidra.app.util.bin.format.macho.dyld

Class DyldCacheHeader

java.lang.Object
ghidra.app.util.bin.format.macho.dyld.DyldCacheHeader
All Implemented Interfaces:
StructConverter
public class DyldCacheHeader extends Object implements StructConverter
Represents a dyld_cache_header structure.
See Also:

  • Constructor Details

  • Method Details

    • parseFromFile

      public void parseFromFile(boolean parseLocalSymbols, MessageLog log, TaskMonitor monitor) throws CancelledException
      Parses the structures referenced by this DyldCacheHeader from a file.
      Parameters:
      parseLocalSymbols - True if local symbols should be parsed; otherwise, false
      log - The log
      monitor - A cancellable task monitor
      Throws:
      CancelledException - if the user cancelled the operation

    • parseFromMemory

      public void parseFromMemory(Program program, AddressSpace space, MessageLog log, TaskMonitor monitor) throws CancelledException
      Parses the structures referenced by this DyldCacheHeader from memory.
      Parameters:
      program - The Program whose memory to parse
      space - The Program's AddressSpace
      log - The log
      monitor - A cancellable task monitor
      Throws:
      CancelledException - if the user cancelled the operation

    • markup

      public void markup(Program program, boolean markupLocalSymbols, AddressSpace space, TaskMonitor monitor, MessageLog log) throws CancelledException
      Marks up this DyldCacheHeader with data structures and comments.
      Parameters:
      program - The Program to mark up
      markupLocalSymbols - True if the local symbols should be marked up; otherwise, false
      space - The Program's AddressSpace
      monitor - A cancellable task monitor
      log - The log
      Throws:
      CancelledException - if the user cancelled the operation

    • getBaseAddress

      public long getBaseAddress()
      Gets the base address of the DYLD cache. This is where the cache should be loaded in memory.
      Returns:
      The base address of the DYLD cache

    • getMagic

      public byte[] getMagic()
      Gets the magic bytes, which contain version information.
      Returns:
      The magic bytes

    • getUUID

      public String getUUID()
      Gets the UUID in String form
      Returns:
      The UUID in String form, or null if a UUID is not defined

    • getEntryPoint

      public Long getEntryPoint()
      Gets the DYLD entry point address (if known)
      Returns:
      The DYLD entry point address, or null if it is not known

    • getMappingInfos

      public List<DyldCacheMappingInfo> getMappingInfos()
      Gets the List of DyldCacheMappingInfos. Requires header to have been parsed.
      Returns:
      The List of DyldCacheMappingInfos

    • getImagesOffset

      public int getImagesOffset()
      Gets the file offset to first DyldCacheImageInfo.
      Returns:
      The file offset to first DyldCacheImageInfo

    • getImagesCount

      public int getImagesCount()
      Gets the number of DyldCacheImageInfos.
      Returns:
      The number of DyldCacheImageInfos

    • getMappedImages

      public List<DyldCacheImage> getMappedImages()
      Generates a List of DyldCacheImages that are mapped in by this DyldCacheHeader. Requires header to have been parsed.

      NOTE: A DYLD subcache header may declare an image, but that image may get loaded at an address defined by the memory map of a different subcache header. This method will only return the images that are mapped by "this" header's memory map.

      Returns:
      A List of DyldCacheImages mapped by this DyldCacheHeader

    • getSubcacheEntries

      public List<DyldSubcacheEntry> getSubcacheEntries()
      Gets the List of DyldSubcacheEntrys. Requires header to have been parsed.
      Returns:
      The List of DyldSubcacheEntrys

    • getSymbolFileUUID

      public String getSymbolFileUUID()
      Gets the symbol file UUID in String form
      Returns:
      The symbol file UUID in String form, or null if a symbol file UUID is not defined or is all zeros

    • getCacheMappingAndSlideInfos

      public List<DyldCacheMappingAndSlideInfo> getCacheMappingAndSlideInfos()
      Gets the List of DyldCacheMappingAndSlideInfos. Requires header to have been parsed.
      Returns:
      The List of DyldCacheMappingAndSlideInfos

    • getLocalSymbolsInfo

      public DyldCacheLocalSymbolsInfo getLocalSymbolsInfo()
      Gets the DyldCacheLocalSymbolsInfo.
      Returns:
      The DyldCacheLocalSymbolsInfo. Could be be null if it didn't parse.

    • getSlideInfos

      public List<DyldCacheSlideInfoCommon> getSlideInfos()
      Gets the List of DyldCacheSlideInfoCommons.
      Returns:
      the List of DyldCacheSlideInfoCommons.

    • getBranchPoolAddresses

      public List<Long> getBranchPoolAddresses()
      Gets the List of branch pool address. Requires header to have been parsed.
      Returns:
      The List of branch pool address

    • getArchitecture

      public DyldArchitecture getArchitecture()
      Gets architecture information.
      Returns:
      architecture information

    • toDataType

      public DataType toDataType() throws DuplicateNameException, IOException
      Description copied from interface: StructConverter
      Returns a structure datatype representing the contents of the implementor of this interface.

      For example, given: 

       class A {
     int foo;
     double bar;
 }

      The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

      Specified by:
      toDataType in interface StructConverter
      Returns:
      returns a structure datatype representing the implementor of this interface
      Throws:
      DuplicateNameException - when a datatype of the same name already exists
      IOException - if an IO-related error occurs
      See Also:

    • parseLocalSymbolsInfo

      public void parseLocalSymbolsInfo(boolean shouldParse, MessageLog log, TaskMonitor monitor) throws CancelledException
      Throws:
      CancelledException

    • setFileBlock

      public void setFileBlock(MemoryBlock block)
      Sets the MemoryBlock associated with this header's FILE block.
      Parameters:
      block - The MemoryBlock associated with this header's FILE block

    • hasSlideInfo

      public boolean hasSlideInfo()
      Checks to see if any slide info exists
      Returns:
      True if any slide info exists; otherwise, false

    • unslidLoadAddress

      public long unslidLoadAddress()
      Get the original unslid load address. This is found in the first mapping infos.
      Returns:
      the original unslid load address

    • isSubcache

      public boolean isSubcache()
      Checks to see whether or not this is a subcache
      Returns:
      True if this is a subcache; otherwise, false if it's a base cache

    • hasAccelerateInfo

      public boolean hasAccelerateInfo()
      Checks to see whether or not the old accelerate info fields are being used
      Returns:
      True if the old accelerate info fields are being used; otherwise, false if the new dyldInCache fields are being used