dyld

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 7, 2023 License: MIT Imports: 47 Imported by: 0

Documentation

Index

Constants

View Source
const (
	FirstDyldCacheImageNum     = 0x00000001
	LastDyldCacheImageNum      = 0x00000FFF
	FirstOtherOSImageNum       = 0x00001001
	LastOtherOSImageNum        = 0x00001FFF
	FirstLaunchClosureImageNum = 0x00002000
	MissingWeakLinkedImage     = 0x0FFFFFFF
)
View Source
const (
	KindRebase targetKind = iota
	KindSharedCache
	KindImage
	KindAbsolute
)
View Source
const (
	IsProduction              optFlags = (1 << 0) // never set in development cache
	NoMissingWeakSuperclasses optFlags = (1 << 1) // set in development cache and customer
	LargeSharedCache          optFlags = (1 << 2) // Shared cache was built with the new Large format
)
View Source
const (
	LoaderMagic            = 0x6c347964 // "l4yd"
	PrebuiltLoaderSetMagic = 0x73703464 // "sp4d"
	NoUnzipperedTwin       = 0xFFFF
)
View Source
const (
	SeekStart   = 0 // seek relative to the origin of the file
	SeekCurrent = 1 // seek relative to the current offset
	SeekEnd     = 2 // seek relative to the end
)

Seek whence values.

View Source
const (
	TypeConformance = iota
	MetadataConformance
	ForeignTypeConformance
)
View Source
const (
	LOCAL symKind = iota
	PUBLIC
	EXPORT
	SYMTAB
	BIND
)
View Source
const (
	MacOSCacheFolder     = "System/Library/dyld/"
	IPhoneCacheFolder    = "System/Library/Caches/com.apple.dyld/"
	DriverKitCacheFolder = "System/DriverKit/System/Library/dyld/"

	CacheRegex                           = `System/Library/(dyld|Caches/com\.apple\.dyld)/dyld_shared_cache_`
	DriverKitCacheRegex                  = `System/DriverKit/System/Library/dyld/dyld_shared_cache_`
	CacheRegexEnding                     = `(\..*)?$`
	CacheUberRegex                       = `(System/DriverKit/)?System/Library/(dyld|Caches/com\.apple\.dyld)/dyld_shared_cache_(arm64e|x86_64)(\..*)?$`
	DYLD_SHARED_CACHE_DYNAMIC_DATA_MAGIC = "dyld_data    v0"
)
View Source
const (
	DylibsExpectedOnDisk   formatVersion = 0x100
	IsSimulator            formatVersion = 0x200
	LocallyBuiltCache      formatVersion = 0x400
	BuiltFromChainedFixups formatVersion = 0x800
)
View Source
const (
	CacheTypeDevelopment cacheType = 0
	CacheTypeProduction  cacheType = 1
	CacheTypeUniversal   cacheType = 2
)
View Source
const (
	DYLD_CACHE_SLIDE_PAGE_ATTRS          = 0xC000 // high bits of uint16_t are flags
	DYLD_CACHE_SLIDE_PAGE_ATTR_EXTRA     = 0x8000 // index is into extras array (not starts array)
	DYLD_CACHE_SLIDE_PAGE_ATTR_NO_REBASE = 0x4000 // page has no rebasing
	DYLD_CACHE_SLIDE_PAGE_ATTR_END       = 0x8000 // last chain entry for page
)
View Source
const (
	DYLD_CACHE_SLIDE4_PAGE_NO_REBASE = 0xFFFF // page has no rebasing
	DYLD_CACHE_SLIDE4_PAGE_INDEX     = 0x7FFF // mask of page_starts[] values
	DYLD_CACHE_SLIDE4_PAGE_USE_EXTRA = 0x8000 // index is into extras array (not a chain start offset)
	DYLD_CACHE_SLIDE4_PAGE_EXTRA_END = 0x8000 // last chain entry for page
)
View Source
const DYLD_CACHE_SLIDE_V3_PAGE_ATTR_NO_REBASE = 0xFFFF // page has no rebasing
View Source
const MapSentinelHash = ^uint64(0)
View Source
const ReadOnlyDataPermissions = 2

Variables

View Source
var EOF = errors.New("EOF")
View Source
var ErrNoExportTrieInCache = errors.New("dyld shared cache does NOT contain export trie info")

ErrNoExportTrieInCache is the error for a shared cache that has no LocalSymbolsOffset

View Source
var ErrNoExportTrieInMachO = errors.New("dylib does NOT contain export trie info")

ErrNoExportTrieInMachO is the error for a shared cache that has no LocalSymbolsOffset

View Source
var ErrNoLocals = errors.New("dyld shared cache does NOT contain local symbols info")

ErrNoLocals is the error for a shared cache that has no LocalSymbolsOffset

View Source
var ErrNoPrebuiltLoadersInCache = errors.New("dyld shared cache does NOT contain prebuilt loader info")
View Source
var ErrPrebuiltLoaderSetNotSupported = fmt.Errorf("dyld_shared_cache has no launch prebuilt loader set info")
View Source
var ErrSymbolNotInExportTrie = errors.New("dylib does NOT contain symbolin export trie info")
View Source
var ErrSymbolNotInImage = errors.New("dylib does NOT contain symbol")

Functions

func Extract

func Extract(ipsw, destPath string, arches []string, driverkit bool) ([]string, error)

Extract extracts dyld_shared_cache from IPSW

func ExtractFromDMG

func ExtractFromDMG(i *info.Info, dmgPath, destPath string, arches []string, driverkit bool) ([]string, error)

func ExtractFromRemoteCryptex

func ExtractFromRemoteCryptex(zr *zip.Reader, destPath string, arches []string, driverkit bool) error

func GetDscPathsInMount

func GetDscPathsInMount(mountPoint string, driverKit bool) ([]string, error)

func KeyName

func KeyName(keyVal uint64) string

KeyName returns the chained pointer's key name

func ScrapeWebKitTRAC

func ScrapeWebKitTRAC(version string) (string, string, error)

func Split

func Split(dyldSharedCachePath, destinationPath, xcodePath string, xcodeCache bool) error

Split extracts all the dyld_shared_cache libraries

Types

type BindPattern

type BindPattern struct {
	Target resolvedSymbolTarget
	Detail bindPatternType
}

func (BindPattern) String

func (b BindPattern) String() string

type BindTarget

type BindTarget struct {
	Loader        *Loader
	RuntimeOffset uint64
}

type BindTargetRef

type BindTargetRef uint64

func (BindTargetRef) AbsoluteValue

func (b BindTargetRef) AbsoluteValue() uint64

func (BindTargetRef) IsAbsolute

func (b BindTargetRef) IsAbsolute() bool

func (BindTargetRef) Kind

func (b BindTargetRef) Kind() uint8

func (BindTargetRef) LoaderRef

func (b BindTargetRef) LoaderRef() LoaderRef

func (BindTargetRef) Offset

func (b BindTargetRef) Offset() uint64

func (BindTargetRef) String

func (b BindTargetRef) String(f *File) string

type CImage

type CImage struct {
	ID                    uint32
	Name                  string
	Hash                  uint32
	UUID                  types.UUID
	Flags                 cFlags
	Dependents            []linkedImage
	CacheSegments         []cacheSegmentType
	DiskSegments          []diskSegmentType
	InitOrder             []uint32
	DofOffsets            []uint32
	InitializerOffsets    []uint32
	TerminatorOffsets     []uint32
	InitializerSections   []initializerSectionRangeType
	MappingInfo           mappingInfoType
	CodeSignatureLocation codeSignatureLocationType
	CDHash                cdhash
	Rebases               []rebasePatternType
	Binds                 []BindPattern
	TextFixups            []TextFixupPattern
	ChainedFixupsTargets  []resolvedSymbolTarget
	ChainedStartsOffset   uint64
	ObjcFixups            ObjcFixups
	FarPlayLocation       farPlayLocType
	FileInfo              fileInfoType
	ImageOverride         uint32
}

func (CImage) GetID

func (i CImage) GetID() uint32

func (CImage) PageSize

func (i CImage) PageSize() uint32

func (CImage) String

func (i CImage) String(d *File, verbose bool) string

type CacheAcceleratorDof

type CacheAcceleratorDof struct {
	SectionAddress uint64 // unslid address of start of region
	SectionSize    uint32
	ImageIndex     uint32
}

type CacheAcceleratorInfo

type CacheAcceleratorInfo struct {
	Version            uint32 // currently 1
	ImageExtrasCount   uint32 // does not include aliases
	ImagesExtrasOffset uint32 // offset into this chunk of first dyld_cache_image_info_extra
	BottomUpListOffset uint32 // offset into this chunk to start of 16-bit array of sorted image indexes
	DylibTrieOffset    uint32 // offset into this chunk to start of trie containing all dylib paths
	DylibTrieSize      uint32 // size of trie containing all dylib paths
	InitializersOffset uint32 // offset into this chunk to start of initializers list
	InitializersCount  uint32 // size of initializers list
	DofSectionsOffset  uint32 // offset into this chunk to start of DOF sections list
	DofSectionsCount   uint32 // size of initializers list
	ReExportListOffset uint32 // offset into this chunk to start of 16-bit array of re-exports
	ReExportCount      uint32 // size of re-exports
	DepListOffset      uint32 // offset into this chunk to start of 16-bit array of dependencies (0x8000 bit set if upward)
	DepListCount       uint32 // size of dependencies
	RangeTableOffset   uint32 // offset into this chunk to start of ss
	RangeTableCount    uint32 // size of dependencies
	DyldSectionAddr    uint64 // address of libdyld's __dyld section in unslid cache
}

type CacheAcceleratorInitializer

type CacheAcceleratorInitializer struct {
	FunctionOffset uint32 // address offset from start of cache mapping
	ImageIndex     uint32
}

type CacheDynamicDataHeader

type CacheDynamicDataHeader struct {
	Magic   [16]uint8 // e.g. "dyld_data    v0"
	FsID    uint64    // The fsid_t of the shared cache being used by a process
	FsObjID uint64    // The fs_obj_id_t of the shared cache being used by a process
}

This struct is a small piece of dynamic data that can be included in the shared region, and contains configuration data about the shared cache in use by the process. It is located

type CacheExportFlag

type CacheExportFlag int

func (CacheExportFlag) Absolute

func (f CacheExportFlag) Absolute() bool

func (CacheExportFlag) ReExport

func (f CacheExportFlag) ReExport() bool

func (CacheExportFlag) Regular

func (f CacheExportFlag) Regular() bool

func (CacheExportFlag) String

func (f CacheExportFlag) String() string

func (CacheExportFlag) StubAndResolver

func (f CacheExportFlag) StubAndResolver() bool

func (CacheExportFlag) ThreadLocal

func (f CacheExportFlag) ThreadLocal() bool

func (CacheExportFlag) WeakDefinition

func (f CacheExportFlag) WeakDefinition() bool

type CacheExportedSymbol

type CacheExportedSymbol struct {
	IsHeaderOffset     bool
	IsAbsolute         bool
	HasResolverOffset  bool
	IsThreadLocal      bool
	IsWeakDef          bool
	Flags              CacheExportFlag
	FoundInDylib       string
	Value              uint64
	Address            uint64
	ResolverFuncOffset uint32
	Name               string
}

func (CacheExportedSymbol) String

func (es CacheExportedSymbol) String() string

type CacheHeader

type CacheHeader struct {
	Magic                                       magic          // e.g. "dyld_v0    i386"
	MappingOffset                               uint32         // file offset to first dyld_cache_mapping_info
	MappingCount                                uint32         // number of dyld_cache_mapping_info entries
	ImagesOffsetOld                             uint32         // UNUSED: moved to imagesOffset to prevent older dsc_extarctors from crashing
	ImagesCountOld                              uint32         // UNUSED: moved to imagesCount to prevent older dsc_extarctors from crashing
	DyldBaseAddress                             uint64         // base address of dyld when cache was built
	CodeSignatureOffset                         uint64         // file offset of code signature blob
	CodeSignatureSize                           uint64         // size of code signature blob (zero means to end of file)
	SlideInfoOffsetUnused                       uint64         // unused.  Used to be file offset of kernel slid info
	SlideInfoSizeUnused                         uint64         // unused.  Used to be size of kernel slid info
	LocalSymbolsOffset                          uint64         // file offset of where local symbols are stored
	LocalSymbolsSize                            uint64         // size of local symbols information
	UUID                                        types.UUID     // unique value for each shared cache file
	CacheType                                   cacheType      // 0 for development, 1 for production
	BranchPoolsOffset                           uint32         // file offset to table of uint64_t pool addresses
	BranchPoolsCount                            uint32         // number of uint64_t entries
	AccelerateInfoAddrUnusedOrDyldAddr          uint64         // unused. (unslid) address of optimization info NOTE: when cacheType=2 (unslid) address of mach_header of dyld in cache
	AccelerateInfoSizeUnusedOrDyldStartFuncAddr uint64         // unused. size of optimization info             NOTE: when cacheType=2 (unslid) address of entry point (_dyld_start) of dyld in cache
	ImagesTextOffset                            uint64         // file offset to first dyld_cache_image_text_info
	ImagesTextCount                             uint64         // number of dyld_cache_image_text_info entries
	PatchInfoAddr                               uint64         // (unslid) address of dyld_cache_patch_info
	PatchInfoSize                               uint64         // Size of all of the patch information pointed to via the dyld_cache_patch_info
	OtherImageGroupAddrUnused                   uint64         // unused
	OtherImageGroupSizeUnused                   uint64         // unused
	ProgClosuresAddr                            uint64         // (unslid) address of list of program launch closures
	ProgClosuresSize                            uint64         // size of list of program launch closures
	ProgClosuresTrieAddr                        uint64         // (unslid) address of trie of indexes into program launch closures
	ProgClosuresTrieSize                        uint64         // size of trie of indexes into program launch closures
	Platform                                    types.Platform // platform number (macOS=1, etc)
	FormatVersion                               formatVersion  /* : 8,  // dyld3::closure::kFormatVersion
	   dylibsExpectedOnDisk   : 1,  // dyld should expect the dylib exists on disk and to compare inode/mtime to see if cache is valid
	   simulator              : 1,  // for simulator of specified platform
	   locallyBuiltCache      : 1,  // 0 for B&I built cache, 1 for locally built cache
	   builtFromChainedFixups : 1,  // some dylib in cache was built using chained fixups, so patch tables must be used for overrides
	   padding                : 20; // TBD */
	SharedRegionStart      uint64   // base load address of cache if not slid
	SharedRegionSize       uint64   // overall size of region cache can be mapped into
	MaxSlide               maxSlide // runtime slide of cache can be between zero and this value
	DylibsImageArrayAddr   uint64   // (unslid) address of ImageArray for dylibs in this cache
	DylibsImageArraySize   uint64   // size of ImageArray for dylibs in this cache
	DylibsTrieAddr         uint64   // (unslid) address of trie of indexes of all cached dylibs
	DylibsTrieSize         uint64   // size of trie of cached dylib paths
	OtherImageArrayAddr    uint64   // (unslid) address of ImageArray for dylibs and bundles with dlopen closures
	OtherImageArraySize    uint64   // size of ImageArray for dylibs and bundles with dlopen closures
	OtherTrieAddr          uint64   // (unslid) address of trie of indexes of all dylibs and bundles with dlopen closures
	OtherTrieSize          uint64   // size of trie of dylibs and bundles with dlopen closures
	MappingWithSlideOffset uint32   // file offset to first dyld_cache_mapping_and_slide_info
	MappingWithSlideCount  uint32   // number of dyld_cache_mapping_and_slide_info entries
	/* NEW dyld4 fields */
	DylibsPblStateArrayAddrUnused uint64         // unused
	DylibsPblSetAddr              uint64         // (unslid) address of PrebuiltLoaderSet of all cached dylibs
	ProgramsPblSetPoolAddr        uint64         // (unslid) address of pool of PrebuiltLoaderSet for each program
	ProgramsPblSetPoolSize        uint64         // size of pool of PrebuiltLoaderSet for each program
	ProgramTrieAddr               uint64         // (unslid) address of trie mapping program path to PrebuiltLoaderSet
	ProgramTrieSize               uint32         //
	OsVersion                     types.Version  // OS Version of dylibs in this cache for the main platform
	AltPlatform                   types.Platform // e.g. iOSMac on macOS
	AltOsVersion                  types.Version  // e.g. 14.0 for iOSMac
	SwiftOptsOffset               uint64         // VM offset from cache_header* to Swift optimizations header
	SwiftOptsSize                 uint64         // size of Swift optimizations header
	SubCacheArrayOffset           uint32         // file offset to first dyld_subcache_entry
	SubCacheArrayCount            uint32         // number of subCache entries
	SymbolFileUUID                types.UUID     // unique value for the shared cache file containing unmapped local symbols
	RosettaReadOnlyAddr           uint64         // (unslid) address of the start of where Rosetta can add read-only/executable data
	RosettaReadOnlySize           uint64         // maximum size of the Rosetta read-only/executable region
	RosettaReadWriteAddr          uint64         // (unslid) address of the start of where Rosetta can add read-write data
	RosettaReadWriteSize          uint64         // maximum size of the Rosetta read-write region
	ImagesOffset                  uint32         // file offset to first dyld_cache_image_info
	ImagesCount                   uint32         // number of dyld_cache_image_info entries
	CacheSubType                  uint32         // 0 for development, 1 for production, when cacheType is multi-cache(2)

	ObjcOptsOffset     uint64 // VM offset from cache_header* to ObjC optimizations header
	ObjcOptsSize       uint64 // size of ObjC optimizations header
	CacheAtlasOffset   uint64 // VM offset from cache_header* to embedded cache atlas for process introspection
	CacheAtlasSize     uint64 // size of embedded cache atlas
	DynamicDataOffset  uint64 // VM offset from cache_header* to the location of dyld_cache_dynamic_data_header
	DynamicDataMaxSize uint64 // maximum size of space reserved from dynamic data
	// contains filtered or unexported fields
}

CacheHeader is the header for a dyld_shared_cache file (struct dyld_cache_header)

func ReadHeader

func ReadHeader(name string) (*CacheHeader, error)

ReadHeader opens a given cache and returns the dyld_cache_header

func (CacheHeader) Print

func (dch CacheHeader) Print()

func (CacheHeader) String

func (dch CacheHeader) String() string

type CacheImage

type CacheImage struct {
	Name     string
	Index    uint32
	Info     CacheImageInfo
	Mappings *cacheMappingsWithSlideInfo
	CacheLocalSymbolsEntry64
	CacheImageInfoExtra
	CacheImageTextInfo
	Initializer    uint64
	DOFSectionAddr uint64
	DOFSectionSize uint32

	SlideInfo        slideInfo
	RangeEntries     []rangeEntry
	PatchableExports []Patch
	PatchableGOTs    []Patch
	LocalSymbols     []*CacheLocalSymbol64
	PublicSymbols    []*Symbol
	ObjC             objcInfo

	Analysis analysis

	CacheReader
	// contains filtered or unexported fields
}

CacheImage represents a dyld dylib image.

func (*CacheImage) Analyze

func (i *CacheImage) Analyze() error

Analyze analyzes an image by parsing it's symbols, stubs and GOT

func (*CacheImage) Free

func (i *CacheImage) Free()

Free frees the underlying data so the GC can reclaim it.

func (*CacheImage) GetExport

func (i *CacheImage) GetExport(symbol string) (*trie.TrieExport, error)

GetExport returns the trie export symbol matching the given name

func (*CacheImage) GetLocalSymbol

func (i *CacheImage) GetLocalSymbol(name string) (*CacheLocalSymbol64, error)

GetLocalSymbol returns the local symbol matching the given name

func (*CacheImage) GetLocalSymbolsAsMachoSymbols

func (i *CacheImage) GetLocalSymbolsAsMachoSymbols() []macho.Symbol

GetLocalSymbolsAsMachoSymbols converts all the dylibs private symbols into MachO symtab public symbols

func (*CacheImage) GetMacho

func (i *CacheImage) GetMacho() (*macho.File, error)

GetMacho parses dyld image as a MachO (slow)

func (*CacheImage) GetOffset

func (i *CacheImage) GetOffset(address uint64) (uint64, error)

GetOffset returns the offset for a given virtual address

func (*CacheImage) GetPartialMacho

func (i *CacheImage) GetPartialMacho() (*macho.File, error)

GetPartialMacho parses dyld image as a partial MachO (fast)

func (*CacheImage) GetPublicSymbol

func (i *CacheImage) GetPublicSymbol(name string) (*Symbol, error)

returns the public symbol matching the given name

func (*CacheImage) GetSlideInfo

func (i *CacheImage) GetSlideInfo() (map[uint64]uint64, error)

GetSlideInfo returns a slide info map for the image

func (*CacheImage) GetSymbol

func (i *CacheImage) GetSymbol(name string) (*Symbol, error)

GetSymbol retuns a Symbol private or public matching a given name

func (*CacheImage) GetVMAddress

func (i *CacheImage) GetVMAddress(offset uint64) (uint64, error)

GetVMAddress returns the virtual address for a given offset

func (*CacheImage) ParseGOT

func (i *CacheImage) ParseGOT() error

ParseGOT parse global offset table in MachO

func (*CacheImage) ParseHelpers

func (i *CacheImage) ParseHelpers() error

ParseHelpers parse symbol stub helpers in MachO

func (*CacheImage) ParseLocalSymbols

func (i *CacheImage) ParseLocalSymbols(dump bool) error

ParseLocalSymbols parses and caches, with the option to dump, all the local/private symbols for an image

func (*CacheImage) ParseObjC

func (i *CacheImage) ParseObjC() error

ParseObjC parse ObjC runtime for MachO image

func (*CacheImage) ParsePublicSymbols

func (i *CacheImage) ParsePublicSymbols(dump bool) error

ParsePublicSymbols parses and caches, with the option to dump, all the exports, symtab and dyld_info symbols in the image/dylib

func (*CacheImage) ParseSlideInfo

func (i *CacheImage) ParseSlideInfo() error

ParseSlideInfo parse the shared_cache slide info corresponding to the MachO

func (*CacheImage) ParseStarts

func (i *CacheImage) ParseStarts()

ParseStarts parse function starts in MachO

func (*CacheImage) ParseStubs

func (i *CacheImage) ParseStubs() error

ParseStubs parse symbol stubs in MachO

func (*CacheImage) Read

func (i *CacheImage) Read(p []byte) (n int, err error)

func (*CacheImage) ReadAt

func (i *CacheImage) ReadAt(p []byte, off int64) (n int, err error)

func (*CacheImage) ReadAtAddr

func (i *CacheImage) ReadAtAddr(buf []byte, addr uint64) (int, error)

ReadAtAddr reads data at a given virtual address

func (*CacheImage) Seek

func (i *CacheImage) Seek(offset int64, whence int) (int64, error)

func (*CacheImage) SeekToAddr

func (i *CacheImage) SeekToAddr(addr uint64) error

type CacheImageClientsV2

type CacheImageClientsV2 struct {
	ClientDylibIndex       uint32
	PatchExportsStartIndex uint32 // Points to dyld_cache_patchable_export_v2[]
	PatchExportsCount      uint32
}

type CacheImageExportV2

type CacheImageExportV2 struct {
	DylibOffsetOfImpl uint32 // Offset from the dylib we used to find a dyld_cache_image_patches_v2
	ExportNameOffset  uint32
}

func (CacheImageExportV2) GetExportNameOffset

func (e CacheImageExportV2) GetExportNameOffset() uint32

func (CacheImageExportV2) GetPatchKind

func (e CacheImageExportV2) GetPatchKind() PatchKind

type CacheImageGotClientsV3

type CacheImageGotClientsV3 struct {
	PatchExportsStartIndex uint32 // Points to dyld_cache_patchable_export_v3[]
	PatchExportsCount      uint32
}

type CacheImageInfo

type CacheImageInfo struct {
	Address        uint64
	ModTime        uint64
	Inode          uint64
	PathFileOffset uint32
	Pad            uint32
}

func (CacheImageInfo) String

func (c CacheImageInfo) String() string

type CacheImageInfoExtra

type CacheImageInfoExtra struct {
	ExportsTrieAddr           uint64 // address of trie in unslid cache
	WeakBindingsAddr          uint64
	ExportsTrieSize           uint32
	WeakBindingsSize          uint32
	DependentsStartArrayIndex uint32
	ReExportsStartArrayIndex  uint32
}

type CacheImagePatchesV1

type CacheImagePatchesV1 struct {
	PatchExportsStartIndex uint32
	PatchExportsCount      uint32
}

type CacheImagePatchesV2

type CacheImagePatchesV2 struct {
	ClientsStartIndex uint32
	ClientsCount      uint32
	ExportsStartIndex uint32 // Points to dyld_cache_image_export_v2[]
	ExportsCount      uint32
}

type CacheImageTextInfo

type CacheImageTextInfo struct {
	UUID            types.UUID
	LoadAddress     uint64 // unslid address of start of __TEXT
	TextSegmentSize uint32
	PathOffset      uint32 // offset from start of cache file
}

type CacheLocalSymbol

type CacheLocalSymbol struct {
	types.Nlist32
	Name string
}

type CacheLocalSymbol64

type CacheLocalSymbol64 struct {
	types.Nlist64
	Name         string
	FoundInDylib string
	Macho        *macho.File
}

func (CacheLocalSymbol64) String

func (s CacheLocalSymbol64) String(color bool) string

type CacheLocalSymbolsEntry

type CacheLocalSymbolsEntry struct {
	DylibOffset     uint32 // offset in cache file of start of dylib
	NlistStartIndex uint32 // start index of locals for this dylib
	NlistCount      uint32 // number of local symbols for this dylib
}

type CacheLocalSymbolsEntry64

type CacheLocalSymbolsEntry64 struct {
	DylibOffset     uint64 // offset in cache file of start of dylib
	NlistStartIndex uint32 // start index of locals for this dylib
	NlistCount      uint32 // number of local symbols for this dylib
}

type CacheLocalSymbolsInfo

type CacheLocalSymbolsInfo struct {
	NlistOffset   uint32 // offset into this chunk of nlist entries
	NlistCount    uint32 // count of nlist entries
	StringsOffset uint32 // offset into this chunk of string pool
	StringsSize   uint32 // byte count of string pool
	EntriesOffset uint32 // offset into this chunk of array of dyld_cache_local_symbols_entry
	EntriesCount  uint32 // number of elements in dyld_cache_local_symbols_entry array
}

type CacheMapping

type CacheMapping struct {
	Name string
	CacheMappingInfo
}

func (*CacheMapping) String

func (m *CacheMapping) String() string

type CacheMappingAndSlideInfo

type CacheMappingAndSlideInfo struct {
	Address         uint64             `json:"address,omitempty"`
	Size            uint64             `json:"size,omitempty"`
	FileOffset      uint64             `json:"file_offset,omitempty"`
	SlideInfoOffset uint64             `json:"slide_info_offset,omitempty"`
	SlideInfoSize   uint64             `json:"slide_info_size,omitempty"`
	Flags           CacheMappingFlag   `json:"flags,omitempty"`
	MaxProt         types.VmProtection `json:"max_prot,omitempty"`
	InitProt        types.VmProtection `json:"init_prot,omitempty"`
}

type CacheMappingFlag

type CacheMappingFlag uint64
const (
	DYLD_CACHE_MAPPING_NONE        CacheMappingFlag = 0
	DYLD_CACHE_MAPPING_AUTH_DATA   CacheMappingFlag = 1 << 0
	DYLD_CACHE_MAPPING_DIRTY_DATA  CacheMappingFlag = 1 << 1
	DYLD_CACHE_MAPPING_CONST_DATA  CacheMappingFlag = 1 << 2
	DYLD_CACHE_MAPPING_TEXT_STUBS  CacheMappingFlag = 1 << 3
	DYLD_CACHE_DYNAMIC_CONFIG_DATA CacheMappingFlag = 1 << 4
)

func (CacheMappingFlag) IsAuthData

func (f CacheMappingFlag) IsAuthData() bool

func (CacheMappingFlag) IsConfigData

func (f CacheMappingFlag) IsConfigData() bool

func (CacheMappingFlag) IsConstData

func (f CacheMappingFlag) IsConstData() bool

func (CacheMappingFlag) IsDirtyData

func (f CacheMappingFlag) IsDirtyData() bool

func (CacheMappingFlag) IsNone

func (f CacheMappingFlag) IsNone() bool

func (CacheMappingFlag) IsTextStubs

func (f CacheMappingFlag) IsTextStubs() bool

type CacheMappingInfo

type CacheMappingInfo struct {
	Address    uint64
	Size       uint64
	FileOffset uint64
	MaxProt    types.VmProtection
	InitProt   types.VmProtection
}

type CacheMappingWithSlideInfo

type CacheMappingWithSlideInfo struct {
	Name string `json:"name,omitempty"`
	CacheMappingAndSlideInfo
	SlideInfo slideInfo
	Pages     []map[uint64]uint64
}

func (CacheMappingWithSlideInfo) String

func (mapping CacheMappingWithSlideInfo) String() string

type CachePatch

type CachePatch struct {
	DylibIndex    uint32
	DylibVMOffset uint32
	PatchTo       BindTargetRef
}

type CachePatchInfoV1

type CachePatchInfoV1 struct {
	PatchTableArrayAddr     uint64 // (unslid) address of array for dyld_cache_image_patches for each image
	PatchTableArrayCount    uint64 // count of patch table entries
	PatchExportArrayAddr    uint64 // (unslid) address of array for patch exports for each image
	PatchExportArrayCount   uint64 // count of patch exports entries
	PatchLocationArrayAddr  uint64 // (unslid) address of array for patch locations for each patch
	PatchLocationArrayCount uint64 // count of patch location entries
	PatchExportNamesAddr    uint64 // blob of strings of export names for patches
	PatchExportNamesSize    uint64 // size of string blob of export names for patches
}

type CachePatchInfoV2

type CachePatchInfoV2 struct {
	TableVersion            uint32 // == 2
	LocationVersion         uint32 // == 0 for now
	TableArrayAddr          uint64 // (unslid) address of array for dyld_cache_image_patches_v2 for each image
	TableArrayCount         uint64 // count of patch table entries
	ImageExportsArrayAddr   uint64 // (unslid) address of array for dyld_cache_image_export_v2 for each image
	ImageExportsArrayCount  uint64 // count of patch table entries
	ClientsArrayAddr        uint64 // (unslid) address of array for dyld_cache_image_clients_v2 for each image
	ClientsArrayCount       uint64 // count of patch clients entries
	ClientExportsArrayAddr  uint64 // (unslid) address of array for patch exports for each client image
	ClientExportsArrayCount uint64 // count of patch exports entries
	LocationArrayAddr       uint64 // (unslid) address of array for patch locations for each patch
	LocationArrayCount      uint64 // count of patch location entries
	ExportNamesAddr         uint64 // blob of strings of export names for patches
	ExportNamesSize         uint64 // size of string blob of export names for patches
}

type CachePatchInfoV3

type CachePatchInfoV3 struct {
	CachePatchInfoV2                  // v2 fields with TableVersion == 3
	GotClientsArrayAddr        uint64 // (unslid) address of array for dyld_cache_image_got_clients_v3 for each image
	GotClientsArrayCount       uint64 // count of got clients entries.  Should always match the patchTableArrayCount
	GotClientExportsArrayAddr  uint64 // (unslid) address of array for patch exports for each GOT image
	GotClientExportsArrayCount uint64 // count of patch exports entries
	GotLocationArrayAddr       uint64 // (unslid) address of array for patch locations for each GOT patch
	GotLocationArrayCount      uint64 // count of patch location entries
}

type CachePatchInfoV4

type CachePatchInfoV4 CachePatchInfoV3

type CachePatchableExportV1

type CachePatchableExportV1 struct {
	CacheOffsetOfImpl        uint32
	PatchLocationsStartIndex uint32
	PatchLocationsCount      uint32
	ExportNameOffset         uint32
}

type CachePatchableExportV2

type CachePatchableExportV2 struct {
	ImageExportIndex         uint32 // Points to dyld_cache_image_export_v2
	PatchLocationsStartIndex uint32 // Points to dyld_cache_patchable_location_v2[]
	PatchLocationsCount      uint32
}

type CachePatchableExportV3

type CachePatchableExportV3 struct {
	ImageExportIndex         uint32 // Points to dyld_cache_image_export_v2
	PatchLocationsStartIndex uint32 // Points to dyld_cache_patchable_location_v3[]
	PatchLocationsCount      uint32
}

type CachePatchableLocationV1

type CachePatchableLocationV1 struct {
	CacheOffset uint32
	// _           uint32 // padding TODO: FIXME do I need this padding or not
	Location uint64
}

func (CachePatchableLocationV1) Addend

func (p CachePatchableLocationV1) Addend() uint64

func (CachePatchableLocationV1) Address

func (p CachePatchableLocationV1) Address(cacheBase uint64) uint64

func (CachePatchableLocationV1) Authenticated

func (p CachePatchableLocationV1) Authenticated() bool

func (CachePatchableLocationV1) Discriminator

func (p CachePatchableLocationV1) Discriminator() uint64

func (CachePatchableLocationV1) High7

func (p CachePatchableLocationV1) High7() uint64

func (CachePatchableLocationV1) Key

func (CachePatchableLocationV1) String

func (p CachePatchableLocationV1) String(cacheBase uint64) string

func (CachePatchableLocationV1) UsesAddressDiversity

func (p CachePatchableLocationV1) UsesAddressDiversity() bool

type CachePatchableLocationV2

type CachePatchableLocationV2 struct {
	DylibOffsetOfUse uint32 // Offset from the dylib we used to get a dyld_cache_image_clients_v2
	Location         patchableLocationV2
}

func (CachePatchableLocationV2) String

func (p CachePatchableLocationV2) String(preferredLoadAddress uint64) string

type CachePatchableLocationV3

type CachePatchableLocationV3 struct {
	CacheOffsetOfUse uint64 // Offset from the cache header
	Location         patchableLocationV2
	// contains filtered or unexported fields
}

func (CachePatchableLocationV3) String

func (p CachePatchableLocationV3) String(o2a func(uint64) uint64) string

type CachePatchableLocationV4

type CachePatchableLocationV4 struct {
	DylibOffsetOfUse uint32 // Offset from the dylib we used to get a dyld_cache_image_clients_v2
	Location         patchableLocationV4
}

func (CachePatchableLocationV4) String

func (p CachePatchableLocationV4) String(preferredLoadAddress uint64) string

type CachePatchableLocationV4Got

type CachePatchableLocationV4Got struct {
	CacheOffsetOfUse uint64 // Offset from the cache header
	Location         patchableLocationV4
	// contains filtered or unexported fields
}

func (CachePatchableLocationV4Got) String

func (p CachePatchableLocationV4Got) String(o2a func(uint64) uint64) string

type CacheRangeEntry

type CacheRangeEntry struct {
	StartAddress uint64 // unslid address of start of region
	Size         uint32
	ImageIndex   uint32
}

type CacheReader

type CacheReader struct {
	// contains filtered or unexported fields
}

CacheReader implements Read, Seek, and ReadAt on a section of an underlying ReaderAt.

func NewCacheReader

func NewCacheReader(off int64, n int64, u types.UUID) CacheReader

NewCacheReader returns a CacheReader that reads from r starting at offset off and stops with EOF after n bytes. It also stubs out the MachoReader required SeekToAddr and ReadAtAddr

type CacheSlideInfo

type CacheSlideInfo struct {
	Version       uint32 // currently 1
	TocOffset     uint32
	TocCount      uint32
	EntriesOffset uint32
	EntriesCount  uint32
	EntriesSize   uint32 // currently 128

}

CacheSlideInfo is the dyld_cache_image_info struct The rebasing info is to allow the kernel to lazily rebase DATA pages of the dyld shared cache. Rebasing is adding the slide to interior pointers.

func (CacheSlideInfo) GetPageSize

func (i CacheSlideInfo) GetPageSize() uint32

func (CacheSlideInfo) GetVersion

func (i CacheSlideInfo) GetVersion() uint32

func (CacheSlideInfo) SlidePointer

func (i CacheSlideInfo) SlidePointer(ptr uint64) uint64

type CacheSlideInfo2

type CacheSlideInfo2 struct {
	Version          uint32 // currently 2
	PageSize         uint32 // currently 4096 (may also be 16384)
	PageStartsOffset uint32
	PageStartsCount  uint32
	PageExtrasOffset uint32
	PageExtrasCount  uint32
	DeltaMask        uint64 // which (contiguous) set of bits contains the delta to the next rebase location
	ValueAdd         uint64
}

func (CacheSlideInfo2) GetPageSize

func (i CacheSlideInfo2) GetPageSize() uint32

func (CacheSlideInfo2) GetVersion

func (i CacheSlideInfo2) GetVersion() uint32

func (CacheSlideInfo2) SlidePointer

func (i CacheSlideInfo2) SlidePointer(ptr uint64) uint64

type CacheSlideInfo3

type CacheSlideInfo3 struct {
	Version         uint32 `json:"slide_version,omitempty"` // currently 3
	PageSize        uint32 `json:"page_size,omitempty"`     // currently 4096 (may also be 16384)
	PageStartsCount uint32 `json:"page_starts_count,omitempty"`

	AuthValueAdd uint64 `json:"auth_value_add,omitempty"`
	// contains filtered or unexported fields
}

func (CacheSlideInfo3) GetPageSize

func (i CacheSlideInfo3) GetPageSize() uint32

func (CacheSlideInfo3) GetVersion

func (i CacheSlideInfo3) GetVersion() uint32

func (CacheSlideInfo3) SlidePointer

func (i CacheSlideInfo3) SlidePointer(ptr uint64) uint64

type CacheSlideInfo4

type CacheSlideInfo4 struct {
	Version          uint32 // currently 4
	PageSize         uint32 // currently 4096 (may also be 16384)
	PageStartsOffset uint32
	PageStartsCount  uint32
	PageExtrasOffset uint32
	PageExtrasCount  uint32
	DeltaMask        uint64 // which (contiguous) set of bits contains the delta to the next rebase location (0xC0000000)
	ValueAdd         uint64 // base address of cache

}

func (CacheSlideInfo4) GetPageSize

func (i CacheSlideInfo4) GetPageSize() uint32

func (CacheSlideInfo4) GetVersion

func (i CacheSlideInfo4) GetVersion() uint32

func (CacheSlideInfo4) SlidePointer

func (i CacheSlideInfo4) SlidePointer(ptr uint64) uint64

type CacheSlideInfoEntry

type CacheSlideInfoEntry struct {
	// contains filtered or unexported fields
}

type CacheSlidePointer3

type CacheSlidePointer3 uint64

CacheSlidePointer3 struct

{
    uint64_t  raw;
    struct {
        uint64_t    pointerValue        : 51,
                    offsetToNextPointer : 11,
                    unused              :  2;
    }         plain;
    struct {
        uint64_t    offsetFromSharedCacheBase : 32,
                    diversityData             : 16,
                    hasAddressDiversity       :  1,
                    key                       :  2,
                    offsetToNextPointer       : 11,
                    unused                    :  1,
                    authenticated             :  1; // = 1;
    }         auth;
};

func (CacheSlidePointer3) Authenticated

func (p CacheSlidePointer3) Authenticated() bool

Authenticated returns if the chained pointer is authenticated

func (CacheSlidePointer3) DiversityData

func (p CacheSlidePointer3) DiversityData() uint64

DiversityData returns the chained pointer's diversity data

func (CacheSlidePointer3) HasAddressDiversity

func (p CacheSlidePointer3) HasAddressDiversity() bool

HasAddressDiversity returns if the chained pointer has address diversity

func (CacheSlidePointer3) Key

func (p CacheSlidePointer3) Key() uint64

Key returns the chained pointer's key

func (CacheSlidePointer3) MarshalJSON

func (p CacheSlidePointer3) MarshalJSON() ([]byte, error)

func (CacheSlidePointer3) OffsetFromSharedCacheBase

func (p CacheSlidePointer3) OffsetFromSharedCacheBase() uint64

OffsetFromSharedCacheBase returns the chained pointer's offset from the base

func (CacheSlidePointer3) OffsetToNextPointer

func (p CacheSlidePointer3) OffsetToNextPointer() uint64

OffsetToNextPointer returns the offset to the next chained pointer

func (CacheSlidePointer3) Raw

func (p CacheSlidePointer3) Raw() uint64

Raw returns the chained pointer's raw uint64 value

func (CacheSlidePointer3) SignExtend51

func (p CacheSlidePointer3) SignExtend51() uint64

SignExtend51 returns a regular pointer which needs to fit in 51-bits of value. C++ RTTI uses the top bit, so we'll allow the whole top-byte and the signed-extended bottom 43-bits to be fit in to 51-bits.

func (CacheSlidePointer3) String

func (p CacheSlidePointer3) String() string

func (CacheSlidePointer3) Value

func (p CacheSlidePointer3) Value() uint64

Value returns the chained pointer's value

type ClassHeaderV16T

type ClassHeaderV16T uint64

func (ClassHeaderV16T) DylibObjCIndex

func (h ClassHeaderV16T) DylibObjCIndex() uint16

func (ClassHeaderV16T) IsDuplicate

func (h ClassHeaderV16T) IsDuplicate() bool

func (ClassHeaderV16T) ObjectCacheOffset

func (h ClassHeaderV16T) ObjectCacheOffset() uint64

ObjectCacheOffset returns offset from the shared cache base

type CodeSignatureInFile

type CodeSignatureInFile struct {
	FileOffset uint32
	Size       uint32
}

type DependentKind

type DependentKind uint8
const (
	KindNormal   DependentKind = 0
	KindWeakLink DependentKind = 1
	KindReexport DependentKind = 2
	KindUpward   DependentKind = 3
)

func (DependentKind) String

func (k DependentKind) String() string

type DyldDisass

type DyldDisass struct {
	// contains filtered or unexported fields
}

func NewDyldDisass

func NewDyldDisass(f *File, cfg *disass.Config) *DyldDisass

func (DyldDisass) AsJSON

func (d DyldDisass) AsJSON() bool

func (DyldDisass) Color

func (d DyldDisass) Color() bool

func (DyldDisass) Contains

func (d DyldDisass) Contains(address uint64) (bool, uint64)

Contains returns true if Triage immediates contains a given address and will return the instruction address

func (DyldDisass) Data

func (d DyldDisass) Data() []byte

func (DyldDisass) Demangle

func (d DyldDisass) Demangle() bool

func (DyldDisass) Dylibs

func (d DyldDisass) Dylibs() []*CacheImage

func (DyldDisass) FindSymbol

func (d DyldDisass) FindSymbol(addr uint64) (string, bool)

FindSymbol returns symbol from the addr2symbol map for a given virtual address

func (DyldDisass) GetCString

func (d DyldDisass) GetCString(addr uint64) (string, error)

func (DyldDisass) HasLoc

func (d DyldDisass) HasLoc(location uint64) (bool, uint64)

func (DyldDisass) IsBranchLocation

func (d DyldDisass) IsBranchLocation(addr uint64) (bool, uint64)

IsBranchLocation returns if given address is branch to a location instruction

func (DyldDisass) IsData

func (d DyldDisass) IsData(addr uint64) (bool, *disass.AddrDetails)

IsData returns if given address is a data variable address referenced in the disassembled function

func (DyldDisass) IsFunctionStart

func (d DyldDisass) IsFunctionStart(addr uint64) (bool, string)

IsFunctionStart checks if address is at a function start and returns symbol name

func (DyldDisass) IsLocation

func (d DyldDisass) IsLocation(imm uint64) bool

IsLocation returns if given address is a local branch location within the disassembled function

func (DyldDisass) IsPointer

func (d DyldDisass) IsPointer(imm uint64) (bool, *disass.AddrDetails)

IsPointer returns if given address is a pointer to another address

func (DyldDisass) Middle

func (d DyldDisass) Middle() uint64

func (DyldDisass) Quite

func (d DyldDisass) Quite() bool

func (DyldDisass) ReadAddr

func (d DyldDisass) ReadAddr(addr uint64) (uint64, error)

func (DyldDisass) StartAddr

func (d DyldDisass) StartAddr() uint64

func (*DyldDisass) Triage

func (d *DyldDisass) Triage() error

Triage walks a function and analyzes all immediates

type DyldSharedCacheReader

type DyldSharedCacheReader struct {
	// contains filtered or unexported fields
}

func NewDyldSharedCacheReader

func NewDyldSharedCacheReader(f *File, off int64) *DyldSharedCacheReader

TODO: 🚧 finish this and replace all the other readers with it

func (*DyldSharedCacheReader) Read

func (cr *DyldSharedCacheReader) Read(p []byte) (n int, err error)

func (*DyldSharedCacheReader) ReadAt

func (cr *DyldSharedCacheReader) ReadAt(p []byte, off int64) (n int, err error)

func (*DyldSharedCacheReader) ReadAtAddr

func (cr *DyldSharedCacheReader) ReadAtAddr(buf []byte, addr uint64) (int, error)

ReadAtAddr reads data at a given virtual address

func (*DyldSharedCacheReader) Seek

func (cr *DyldSharedCacheReader) Seek(offset int64, whence int) (n int64, err error)

func (*DyldSharedCacheReader) SeekToAddr

func (cr *DyldSharedCacheReader) SeekToAddr(addr uint64) error

func (*DyldSharedCacheReader) Size

func (cr *DyldSharedCacheReader) Size() int64

Size returns the size of the section in bytes.

type DylibPatch

type DylibPatch struct {
	OverrideOffsetOfImpl int64
	Kind                 dpkind
}

type File

type File struct {
	UUID    mtypes.UUID
	Headers map[mtypes.UUID]CacheHeader

	ByteOrder binary.ByteOrder

	Mappings              map[mtypes.UUID]cacheMappings
	MappingsWithSlideInfo map[mtypes.UUID]cacheMappingsWithSlideInfo

	Images cacheImages

	SlideInfo        slideInfo
	PatchInfoVersion uint32
	LocalSymInfo     localSymbolInfo
	AcceleratorInfo  CacheAcceleratorInfo
	ImageArray       map[uint32]*CImage
	Closures         []*LaunchClosure

	BranchPools    []uint64
	CodeSignatures map[mtypes.UUID]codesignature

	AddressToSymbol map[uint64]string

	IsDyld4 bool

	SubCacheInfo []SubcacheEntry
	// contains filtered or unexported fields
}

A File represents an open dyld file.

func NewFile

func NewFile(r io.ReaderAt) (*File, error)

NewFile creates a new File for accessing a dyld binary in an underlying reader. The dyld binary is expected to start at position 0 in the ReaderAt.

func Open

func Open(name string) (*File, error)

Open opens the named file using os.Open and prepares it for use as a dyld binary.

func (*File) CFStringsForImage

func (f *File) CFStringsForImage(imageNames ...string) error

CFStringsForImage returns all of the Objective-C cfstrings for a given image

func (*File) CategoriesForImage

func (f *File) CategoriesForImage(imageNames ...string) error

CategoriesForImage returns all of the Objective-C categories for a given image

func (*File) ClassesForImage

func (f *File) ClassesForImage(imageNames ...string) error

ClassesForImage returns all of the Objective-C classes for a given image

func (*File) Close

func (f *File) Close() error

Close closes the File. If the File was created using NewFile directly instead of Open, Close has no effect.

func (*File) DumpSlideInfo

func (f *File) DumpSlideInfo(uuid mtypes.UUID, mapping *CacheMappingWithSlideInfo) error

DumpSlideInfo dumps dyld slide info for a given mapping

func (*File) DumpStubIslands

func (f *File) DumpStubIslands() error

func (*File) FindExportedSymbol

func (f *File) FindExportedSymbol(symbolName string) (*trie.TrieExport, error)

func (*File) FindLocalSymForAddress

func (f *File) FindLocalSymForAddress(addr uint64) *CacheLocalSymbol64

FindLocalSymForAddress returns the local symbol at a given address

func (*File) FindLocalSymbol

func (f *File) FindLocalSymbol(name string) *CacheLocalSymbol64

FindLocalSymbol returns the local symbol that matches name

func (*File) FindPublicSymForAddress

func (f *File) FindPublicSymForAddress(addr uint64) (*Symbol, error)

FindPublicSymForAddress returns the public symbol at a given address

func (*File) FindPublicSymbol

func (f *File) FindPublicSymbol(name string) (*Symbol, error)

FindPublicSymbol returns the public symbol for a given name

func (*File) ForEachLaunchLoaderSet

func (f *File) ForEachLaunchLoaderSet(handler func(execPath string, pset *PrebuiltLoaderSet)) error

func (*File) ForEachLaunchLoaderSetPath

func (f *File) ForEachLaunchLoaderSetPath(handler func(execPath string)) error

func (*File) GetAllObjCClasses

func (f *File) GetAllObjCClasses(print bool) (map[uint64]objHashMap, error)

GetAllClasses dumps the classes from the optimized string hash

func (*File) GetAllObjCProtocols

func (f *File) GetAllObjCProtocols(print bool) (map[uint64]objHashMap, error)

GetAllProtocols dumps the protols from the optimized string hash

func (*File) GetAllObjCSelectors

func (f *File) GetAllObjCSelectors(print bool) (map[uint64]objHashMap, error)

GetAllSelectors is a dumb brute force way to get all the ObjC selector/class etc address by just dumping all the strings in the __OBJC_RO segment returns: map[sym]addr

func (*File) GetAllObjCStubs

func (f *File) GetAllObjCStubs() error

func (*File) GetAllObjcMethods

func (f *File) GetAllObjcMethods() error

GetAllObjcMethods parses all the ObjC method lists in the cache dylibs

func (*File) GetAllSwiftForeignTypes

func (f *File) GetAllSwiftForeignTypes(print, demangle bool) error

func (*File) GetAllSwiftMetadatas

func (f *File) GetAllSwiftMetadatas(print, demangle bool) error

func (*File) GetAllSwiftTypes

func (f *File) GetAllSwiftTypes(print, demangle bool) error

func (*File) GetCString

func (f *File) GetCString(strVMAdr uint64) (string, error)

GetCString returns a c-string at a given virtual address

func (*File) GetCStringAtOffsetForUUID

func (f *File) GetCStringAtOffsetForUUID(uuid types.UUID, offset uint64) (string, error)

GetCStringAtOffsetForUUID returns a c-string at a given offset

func (*File) GetCacheOffset

func (f *File) GetCacheOffset(vmoffset uint64) (types.UUID, uint64, error)

func (*File) GetCacheOffsetFromAddress

func (f *File) GetCacheOffsetFromAddress(addr uint64) (types.UUID, uint64, error)

func (*File) GetCacheVMAddress

func (f *File) GetCacheVMAddress(offset uint64) (types.UUID, uint64, error)

func (*File) GetClassAddresses

func (f *File) GetClassAddresses(class string) ([]uint64, error)

GetClassAddress returns a class addresses

func (*File) GetDlopenOtherImageArray

func (f *File) GetDlopenOtherImageArray() error

GetDlopenOtherImageArray returns the other images array

func (*File) GetDlopenOtherImageIndex

func (f *File) GetDlopenOtherImageIndex(path string) (uint64, error)

GetDlopenOtherImageIndex returns the dlopen other image index for a given path

func (*File) GetDlopenOtherImages

func (f *File) GetDlopenOtherImages() ([]trie.Node, error)

GetDlopenOtherImages returns the dlopen other images trie data

func (*File) GetDylibIndex

func (f *File) GetDylibIndex(path string) (uint64, error)

GetDylibIndex returns the index of a given dylib

func (*File) GetDylibPrebuiltLoader

func (f *File) GetDylibPrebuiltLoader(executablePath string) (*PrebuiltLoader, error)

GetLaunchLoader returns the PrebuiltLoader for the given executable in-cache dylib path.

func (*File) GetDylibsImageArray

func (f *File) GetDylibsImageArray() error

GetDylibsImageArray returns the dylibs image array

func (*File) GetDylibsImageArrayIDs

func (f *File) GetDylibsImageArrayIDs() ([]trie.Node, error)

func (*File) GetExportTrieSymbols

func (f *File) GetExportTrieSymbols(i *CacheImage) ([]trie.TrieExport, error)

func (*File) GetExportedSymbols

func (f *File) GetExportedSymbols(ctx context.Context, symbolName string) (<-chan *Symbol, error)

func (*File) GetImageContainingTextAddr

func (f *File) GetImageContainingTextAddr(addr uint64) (*CacheImage, error)

GetImageContainingTextAddr returns a dylib whose __TEXT segment contains a given virtual address NOTE: this can be faster than GetImageContainingVMAddr as it avoids parsing the MachO

func (*File) GetImageContainingVMAddr

func (f *File) GetImageContainingVMAddr(address uint64) (*CacheImage, error)

GetImageContainingVMAddr returns a dylib whose segment contains a given virtual address

func (*File) GetLaunchLoaderSet

func (f *File) GetLaunchLoaderSet(executablePath string) (*PrebuiltLoaderSet, error)

GetLaunchLoaderSet returns the PrebuiltLoaderSet for the given executable app path.

func (*File) GetMappingForOffsetForUUID

func (f *File) GetMappingForOffsetForUUID(uuid types.UUID, offset uint64) (*CacheMapping, error)

GetMappingForOffsetForUUID returns the mapping containing a given file offset for a given cache UUID

func (*File) GetMappingForVMAddress

func (f *File) GetMappingForVMAddress(address uint64) (types.UUID, *CacheMappingWithSlideInfo, error)

GetMappingForVMAddress returns the mapping containing a given virtual address

func (*File) GetNextSubCacheInfo

func (f *File) GetNextSubCacheInfo(uuid mtypes.UUID) *SubcacheEntry

GetNextSubCacheInfo returns the subcache info after the given UUID.

func (*File) GetObjCClass

func (f *File) GetObjCClass(vmaddr uint64) (*objc.Class, error)

GetObjCClass parses an ObjC class at a given virtual memory address

func (*File) GetObjCClassProtocolsAddrs

func (f *File) GetObjCClassProtocolsAddrs(vmaddr uint64) ([]uint64, error)

func (*File) GetObjCStubsForImage

func (f *File) GetObjCStubsForImage(imageNames ...string) error

func (*File) GetOffset

func (f *File) GetOffset(address uint64) (types.UUID, uint64, error)

GetOffset returns the offset for a given virtual address and the cache's UUID that contains it

func (*File) GetOffsetForUUID

func (f *File) GetOffsetForUUID(uuid types.UUID, address uint64) (uint64, error)

GetOffsetForUUID returns the offset for a given virtual address for a given cache UUID

func (*File) GetOptimizations

func (f *File) GetOptimizations() (Optimization, error)

func (*File) GetProgClosureAddress

func (f *File) GetProgClosureAddress(executablePath string) (uint64, error)

GetProgClosureAddress returns the closure pointer for a given path

func (*File) GetProgClosureImageArray

func (f *File) GetProgClosureImageArray() error

GetDylibsImageArray returns the dylibs image array

func (*File) GetProgClosuresOffsets

func (f *File) GetProgClosuresOffsets() ([]trie.Node, error)

GetProgClosuresOffsets returns the closure trie data NOTE: this doesn't auto add the ProgClosuresAddr (and probably should)

func (*File) GetProtocolAddresses

func (f *File) GetProtocolAddresses(protocol string) ([]uint64, error)

GetProtocolAddress returns a protocol addresses

func (*File) GetRebaseInfoForPages

func (f *File) GetRebaseInfoForPages(uuid mtypes.UUID, mapping *CacheMappingWithSlideInfo, start, end uint64) ([]Rebase, error)

GetRebaseInfoForPages returns an offset to rebase address map for a given page index range

func (*File) GetSelectorAddresses

func (f *File) GetSelectorAddresses(selector string) ([]uint64, error)

GetSelectorAddress returns a selector addresses

func (*File) GetSlideInfo

func (f *File) GetSlideInfo(uuid mtypes.UUID, mapping *CacheMappingWithSlideInfo) error

GetSlideInfo returns just the slideinfo header info

func (*File) GetStubIslands

func (f *File) GetStubIslands() (map[uint64]string, error)

func (*File) GetSubCacheExtensionFromUUID

func (f *File) GetSubCacheExtensionFromUUID(uuid types.UUID) (string, error)

func (*File) GetSubCacheInfo

func (f *File) GetSubCacheInfo(uuid mtypes.UUID) *SubcacheEntry

GetSubCacheInfo returns the subcache info for the given UUID.

func (*File) GetSymbol

func (f *File) GetSymbol(name string) (*Symbol, error)

func (*File) GetSymbolAddress

func (f *File) GetSymbolAddress(name string) (uint64, *CacheImage, error)

func (*File) GetVMAddress

func (f *File) GetVMAddress(offset uint64) (map[types.UUID]uint64, error)

GetVMAddress returns a map of uuids to virtual address for a given offset

func (*File) GetVMAddressForUUID

func (f *File) GetVMAddressForUUID(uuid types.UUID, offset uint64) (uint64, error)

GetVMAddressForUUID returns the virtual address for a given offset for a given cache UUID

func (*File) HasImagePath

func (f *File) HasImagePath(path string) (int, error)

HasImagePath returns the index of a given image path

func (*File) Image

func (f *File) Image(name string) (*CacheImage, error)

Image returns the Image with the given name, or nil if no such image exists.

func (*File) ImpCachesForImage

func (f *File) ImpCachesForImage(imageNames ...string) error

ImpCachesForImage dumps all of the Objective-C imp caches for a given image

func (*File) Is64bit

func (f *File) Is64bit() bool

Is64bit returns if dyld is 64bit or not

func (*File) IsAddressInCache

func (f *File) IsAddressInCache(uuid types.UUID, address uint64) bool

IsAddressInCache returns if the virtual address is in the cache's mappings

func (*File) IsArm64

func (f *File) IsArm64() bool

IsArm64 returns if dyld is arm64 or not (meaning I can disassemble it)

func (*File) MethodsForImage

func (f *File) MethodsForImage(imageNames ...string) error

MethodsForImage returns all of the Objective-C methods for a given image

func (*File) OpenOrCreateA2SCache

func (f *File) OpenOrCreateA2SCache(cacheFile string) error

OpenOrCreateA2SCache returns an address to symbol map if the cache file exists otherwise it will create a NEW one

func (*File) ParseAllObjc

func (f *File) ParseAllObjc() error

ParseAllObjc parses all the ObjC data in the cache and loads it into the symbol table

func (*File) ParseImageArrays

func (f *File) ParseImageArrays() error

func (*File) ParseLocalSyms

func (f *File) ParseLocalSyms(dump bool) error

ParseLocalSyms parses dyld's private symbols

func (*File) ParseObjcForImage

func (f *File) ParseObjcForImage(imageNames ...string) error

func (*File) ParsePatchInfo

func (f *File) ParsePatchInfo() error

ParsePatchInfo parses dyld patch info

func (*File) ParsePublicSymbols

func (f *File) ParsePublicSymbols(dump bool) error

ParsePublicSymbols prints out all the exported symbols

func (*File) ParseStubIslands

func (f *File) ParseStubIslands() error

func (*File) ProtocolsForImage

func (f *File) ProtocolsForImage(imageNames ...string) error

ProtocolsForImage returns all of the Objective-C protocols for a given image

func (*File) ReadBytesForUUID

func (f *File) ReadBytesForUUID(uuid types.UUID, offset int64, size uint64) ([]byte, error)

ReadBytesForUUID returns bytes at a given offset for a given cache UUID

func (*File) ReadPointerAtAddress

func (f *File) ReadPointerAtAddress(address uint64) (uint64, error)

ReadPointerAtAddress returns pointer at a given virtual address

func (*File) ReadPointerForUUID

func (f *File) ReadPointerForUUID(uuid types.UUID, offset uint64) (uint64, error)

ReadPointerForUUID returns pointer at a given offset for a given cache UUID

func (*File) SaveAddrToSymMap

func (f *File) SaveAddrToSymMap(dest string) error

SaveAddrToSymMap saves the dyld address-to-symbol map to disk

func (*File) SelectorsForImage

func (f *File) SelectorsForImage(imageNames ...string) error

SelectorsForImage returns all of the Objective-C selectors for a given image

func (*File) Size

func (f *File) Size() int64

Size returns the size of the cache file(s)

func (*File) String

func (f *File) String(verbose bool) string

func (*File) SupportsDylibPrebuiltLoader

func (f *File) SupportsDylibPrebuiltLoader() bool

func (*File) SupportsPrebuiltLoaderSet

func (f *File) SupportsPrebuiltLoaderSet() bool

type FormatError

type FormatError struct {
	// contains filtered or unexported fields
}

FormatError is returned by some operations if the data does not have the correct format for an object file.

func (*FormatError) Error

func (e *FormatError) Error() string

type ImageArray

type ImageArray struct {
	Offsets []uint32
	// contains filtered or unexported fields
}

func (ImageArray) String

func (i ImageArray) String() string

type LaunchClosure

type LaunchClosure struct {
	Flags           lcFlags
	Images          []*CImage
	DyldUUID        types.UUID
	LibSystemNum    uint32
	LibDyldEntry    resolvedSymbolTarget
	TopImage        uint32
	MainEntry       resolvedSymbolTarget
	StartEntry      resolvedSymbolTarget
	ProgVars        uint32
	Warnings        []warningType
	DyldCacheFixups []PatchEntry
	MissingFiles    []string
	EnvVars         []string
}

type Loader

type Loader struct {
	Magic uint32 // "l4yd"
	Info  uint16
	// isPrebuilt         :  1,  // PrebuiltLoader vs JustInTimeLoader
	// dylibInDyldCache   :  1,
	// hasObjC            :  1,
	// mayHavePlusLoad    :  1,
	// hasReadOnlyData    :  1,  // __DATA_CONST.  Don't use directly.  Use hasConstantSegmentsToProtect()
	// neverUnload        :  1,  // part of launch or has non-unloadable data (e.g. objc, tlv)
	// leaveMapped        :  1,  // RTLD_NODELETE
	// hasReadOnlyObjC    :  1,  // Has __DATA_CONST,__objc_selrefs section
	// pre2022Binary      :  1,
	// padding            :  6;
	Ref LoaderRef
}

func (Loader) DylibInDyldCache

func (l Loader) DylibInDyldCache() bool

func (Loader) HasObjC

func (l Loader) HasObjC() bool

func (Loader) HasReadOnlyData

func (l Loader) HasReadOnlyData() bool

func (Loader) HasReadOnlyObjC

func (l Loader) HasReadOnlyObjC() bool

func (Loader) IsPrebuilt

func (l Loader) IsPrebuilt() bool

func (Loader) LeaveMapped

func (l Loader) LeaveMapped() bool

func (Loader) MayHavePlusLoad

func (l Loader) MayHavePlusLoad() bool

func (Loader) NeverUnload

func (l Loader) NeverUnload() bool

func (Loader) Pre2022Binary

func (l Loader) Pre2022Binary() bool

func (Loader) String

func (l Loader) String() string

type LoaderRef

type LoaderRef uint16

func (LoaderRef) Index

func (l LoaderRef) Index() uint16

Index index into PrebuiltLoaderSet

func (LoaderRef) IsApp

func (l LoaderRef) IsApp() bool

IsApp app vs dyld cache PrebuiltLoaderSet

func (LoaderRef) IsMissingWeakImage

func (l LoaderRef) IsMissingWeakImage() bool

func (LoaderRef) String

func (l LoaderRef) String() string

type NextNode

type NextNode uint32

func (NextNode) HasAnyDuplicates

func (nn NextNode) HasAnyDuplicates() bool

func (NextNode) HasMoreDuplicates

func (nn NextNode) HasMoreDuplicates() bool

func (NextNode) IsDuplicateEntry

func (nn NextNode) IsDuplicateEntry() bool

func (NextNode) IsDuplicateHead

func (nn NextNode) IsDuplicateHead() bool

func (NextNode) IsDuplicateTail

func (nn NextNode) IsDuplicateTail() bool

func (NextNode) NextIndex

func (nn NextNode) NextIndex() uint32

type ObjCBinaryInfo

type ObjCBinaryInfo struct {
	// Offset to the __objc_imageinfo section
	ImageInfoRuntimeOffset uint64

	// Offsets to sections containing objc pointers
	SelRefsRuntimeOffset      uint64
	ClassListRuntimeOffset    uint64
	CategoryListRuntimeOffset uint64
	ProtocolListRuntimeOffset uint64

	// Counts of the above sections.
	SelRefsCount      uint32
	ClassListCount    uint32
	CategoryCount     uint32
	ProtocolListCount uint32

	// Do we have stable Swift fixups to apply to at least one class?
	HasClassStableSwiftFixups bool

	// Do we have any pointer-based method lists to set as uniqued?
	HasClassMethodListsToSetUniqued    bool
	HasCategoryMethodListsToSetUniqued bool
	HasProtocolMethodListsToSetUniqued bool

	// Do we have any method lists in which to set selector references.
	// Note we only support visiting selector refernces in pointer based method lists
	// Relative method lists should have been verified to always point to __objc_selrefs
	HasClassMethodListsToUnique    bool
	HasCategoryMethodListsToUnique bool
	HasProtocolMethodListsToUnique bool

	// Offset to an array of uint8_t's.  One for each protocol.
	// Note this can be 0 (ie, have no fixups), even if we have protocols.  That would be the case
	// if this binary contains no canonical protocol definitions, ie, all canonical defs are in other binaries
	// or the shared cache.
	ProtocolFixupsOffset uint32
	// Offset to an array of BindTargetRef's.  One for each selector reference to fix up
	// Note we only fix up selector refs in the __objc_selrefs section, and in pointer-based method lists
	SelectorReferencesFixupsOffset uint32
	SelectorReferencesFixupsCount  uint32
	// contains filtered or unexported fields
}

ObjCBinaryInfo stores information about the layout of the objc sections in a binary, as well as other properties relating to the objc information in there.

func (ObjCBinaryInfo) String

func (o ObjCBinaryInfo) String() string

type ObjCClassOpt

type ObjCClassOpt struct {
	Tab        []byte          /* tab[mask+1] (always power-of-2). Rounded up to roundedTabSize */
	Checkbytes []byte          /* check byte for each string. Rounded up to roundedCheckBytesSize */
	Offsets    []BindTargetRef /* offsets from &capacity to cstrings */
	Classes    []BindTargetRef /* offsets from &capacity to cstrings */
	Duplicates []BindTargetRef /* offsets from &capacity to cstrings */
	// contains filtered or unexported fields
}

type ObjCOptimizationHeader

type ObjCOptimizationHeader struct {
	Version                                 uint32
	Flags                                   optFlags
	HeaderInfoRoCacheOffset                 uint64
	HeaderInfoRwCacheOffset                 uint64
	SelectorHashTableCacheOffset            uint64
	ClassHashTableCacheOffset               uint64
	ProtocolHashTableCacheOffset            uint64
	RelativeMethodSelectorBaseAddressOffset uint64
}

ObjCOptimizationHeader is the NEW LargeSharedCache objc optimization header

func (*ObjCOptimizationHeader) ClassHashTableOffset

func (o *ObjCOptimizationHeader) ClassHashTableOffset(base uint64) uint64

func (*ObjCOptimizationHeader) GetFlags

func (o *ObjCOptimizationHeader) GetFlags() optFlags

func (*ObjCOptimizationHeader) GetHeaderInfoRoCacheOffset

func (o *ObjCOptimizationHeader) GetHeaderInfoRoCacheOffset() uint64

func (*ObjCOptimizationHeader) GetVersion

func (o *ObjCOptimizationHeader) GetVersion() uint32

func (*ObjCOptimizationHeader) ProtocolHashTableOffset

func (o *ObjCOptimizationHeader) ProtocolHashTableOffset(base uint64) uint64

func (*ObjCOptimizationHeader) RelativeMethodListsBaseAddress

func (o *ObjCOptimizationHeader) RelativeMethodListsBaseAddress(base uint64) uint64

func (*ObjCOptimizationHeader) SelectorHashTableOffset

func (o *ObjCOptimizationHeader) SelectorHashTableOffset(base uint64) uint64

type ObjCSelectorOpt

type ObjCSelectorOpt struct {
	Tab        []byte          /* tab[mask+1] (always power-of-2). Rounded up to roundedTabSize */
	Checkbytes []byte          /* check byte for each string. Rounded up to roundedCheckBytesSize */
	Offsets    []BindTargetRef /* offsets from &capacity to cstrings */
	// contains filtered or unexported fields
}

type ObjcClassheaderT

type ObjcClassheaderT struct {
	ClsOffset int32
	HiOffset  int32
}

type ObjcFixups

type ObjcFixups struct {
	ProtocolISAFixups      []protocolISAFixup
	SelRefFixups           []SelectorReferenceFixup
	StableSwiftFixupCount  uint32
	MethodListFixupCount   uint32
	ClassStableSwiftFixups []classStableSwiftFixup
	MethodListFixups       []methodListFixup
	// contains filtered or unexported fields
}

type ObjcOptT

type ObjcOptT struct {
	Version                                      uint32
	Flags                                        optFlags
	SelectorOptOffset                            int32
	HeaderOptRoOffset                            int32
	UnusedClassOptOffset                         int32
	UnusedProtocolOptOffset                      int32
	HeaderoptRwOffset                            int32
	UnusedProtocolOpt2Offset                     int32
	LargeSharedCachesClassOffset                 int32
	LargeSharedCachesProtocolOffset              int32
	RelativeMethodSelectorBaseAddressCacheOffset int64
}

ObjcOptT is a objc_opt_t structure

func (*ObjcOptT) ClassHashTableOffset

func (o *ObjcOptT) ClassHashTableOffset(base uint64) uint64

func (ObjcOptT) GetClassOffset

func (o ObjcOptT) GetClassOffset() int32

func (*ObjcOptT) GetFlags

func (o *ObjcOptT) GetFlags() optFlags

func (*ObjcOptT) GetVersion

func (o *ObjcOptT) GetVersion() uint32

func (*ObjcOptT) ProtocolHashTableOffset

func (o *ObjcOptT) ProtocolHashTableOffset(base uint64) uint64

func (*ObjcOptT) RelativeMethodListsBaseAddress

func (o *ObjcOptT) RelativeMethodListsBaseAddress(base uint64) uint64

func (*ObjcOptT) SelectorHashTableOffset

func (o *ObjcOptT) SelectorHashTableOffset(base uint64) uint64

type ObjectData

type ObjectData uint64

func (ObjectData) DuplicateCount

func (o ObjectData) DuplicateCount() uint16

func (ObjectData) DuplicateIndex

func (o ObjectData) DuplicateIndex() uint64

func (ObjectData) DylibObjCIndex

func (o ObjectData) DylibObjCIndex() uint16

func (ObjectData) IsDuplicate

func (o ObjectData) IsDuplicate() bool

func (ObjectData) ObjectCacheOffset

func (o ObjectData) ObjectCacheOffset() uint64

func (ObjectData) String

func (o ObjectData) String() string

type Optimization

type Optimization interface {
	GetVersion() uint32
	GetFlags() optFlags
	// HeaderInfoRO() uint64
	// HeaderInfoRW() uint64
	SelectorHashTableOffset(uint64) uint64
	ClassHashTableOffset(uint64) uint64
	ProtocolHashTableOffset(uint64) uint64
	RelativeMethodListsBaseAddress(uint64) uint64
}

type Patch

type Patch interface {
	GetName() string
	GetKind() string
	GetImplOffset() uint64
	GetClientIndex() uint32
	GetPatchLocations() any
	GetGotLocations() any
}

type PatchEntry

type PatchEntry struct {
	OverriddenDylibInCache uint32
	ExportCacheOffset      uint32
	Replacement            resolvedSymbolTarget
}

type PatchKind

type PatchKind uint8

Patches can be different kinds. This lives in the high nibble of the exportNameOffset, so we restrict these to 4-bits

const (
	// Just a normal patch. Isn't one of ther other kinds
	Regular PatchKind = 0x0
	// One of { void* isa, uintptr_t }, from CF
	CfObj2 PatchKind = 0x1
	// objc patching was added before this enum exists, in just the high bit
	// of the 4-bit nubble.  This matches that bit layout
	ObjcClass PatchKind = 0x8
)

func (PatchKind) String

func (k PatchKind) String() string

type PatchableExport

type PatchableExport struct {
	Name             string
	Kind             string
	OffsetOfImpl     uint32
	ClientIndex      uint32
	PatchLocations   []CachePatchableLocationV1
	PatchLocationsV2 []CachePatchableLocationV2
	PatchLocationsV4 []CachePatchableLocationV4
}

func (PatchableExport) GetClientIndex

func (pe PatchableExport) GetClientIndex() uint32

func (PatchableExport) GetGotLocations

func (pe PatchableExport) GetGotLocations() any

func (PatchableExport) GetImplOffset

func (pe PatchableExport) GetImplOffset() uint64

func (PatchableExport) GetKind

func (pe PatchableExport) GetKind() string

func (PatchableExport) GetName

func (pe PatchableExport) GetName() string

func (PatchableExport) GetPatchLocations

func (pe PatchableExport) GetPatchLocations() any

type PatchableGotExport

type PatchableGotExport struct {
	Name           string
	Kind           string
	OffsetOfImpl   uint32
	ImageIndex     uint32
	GotLocationsV3 []CachePatchableLocationV3
	GotLocationsV4 []CachePatchableLocationV4Got
}

func (PatchableGotExport) GetClientIndex

func (pg PatchableGotExport) GetClientIndex() uint32

func (PatchableGotExport) GetGotLocations

func (pg PatchableGotExport) GetGotLocations() any

func (PatchableGotExport) GetImplOffset

func (pg PatchableGotExport) GetImplOffset() uint64

func (PatchableGotExport) GetKind

func (pg PatchableGotExport) GetKind() string

func (PatchableGotExport) GetName

func (pg PatchableGotExport) GetName() string

func (PatchableGotExport) GetPatchLocations

func (pg PatchableGotExport) GetPatchLocations() any

type PrebuiltLoader

type PrebuiltLoader struct {
	Path                        string
	AltPath                     string
	Twin                        string
	Dependents                  []dependent
	FileValidation              *fileValidation
	Regions                     []Region
	BindTargets                 []BindTargetRef
	DylibPatches                []DylibPatch
	OverrideBindTargets         []BindTargetRef
	ObjcFixupInfo               *ObjCBinaryInfo
	ObjcCanonicalProtocolFixups []bool
	ObjcSelectorFixups          []BindTargetRef
	// contains filtered or unexported fields
}

func (PrebuiltLoader) GetFileOffset

func (pl PrebuiltLoader) GetFileOffset(vmoffset uint64) uint64

func (PrebuiltLoader) GetInfo

func (pl PrebuiltLoader) GetInfo() string

func (PrebuiltLoader) HasInitializers

func (pl PrebuiltLoader) HasInitializers() bool

func (PrebuiltLoader) IsCatalystOverride

func (pl PrebuiltLoader) IsCatalystOverride() bool

func (PrebuiltLoader) IsOverridable

func (pl PrebuiltLoader) IsOverridable() bool

func (PrebuiltLoader) RegionsCount

func (pl PrebuiltLoader) RegionsCount() uint16

func (PrebuiltLoader) String

func (pl PrebuiltLoader) String(f *File) string

func (PrebuiltLoader) SupportsCatalyst

func (pl PrebuiltLoader) SupportsCatalyst() bool

type PrebuiltLoaderSet

type PrebuiltLoaderSet struct {
	Loaders                       []PrebuiltLoader
	Patches                       []CachePatch
	DyldCacheUUID                 types.UUID
	MustBeMissingPaths            []string
	SelectorTable                 *ObjCSelectorOpt
	ClassTable                    *ObjCClassOpt
	ProtocolTable                 *ObjCClassOpt
	SwiftTypeProtocolTable        SwiftTypeConformanceEntries
	SwiftMetadataProtocolTable    SwiftMetadataConformanceEntries
	SwiftForeignTypeProtocolTable SwiftForeignTypeConformanceEntries
	// contains filtered or unexported fields
}

func (PrebuiltLoaderSet) HasOptimizedObjC

func (pls PrebuiltLoaderSet) HasOptimizedObjC() bool

func (PrebuiltLoaderSet) HasOptimizedSwift

func (pls PrebuiltLoaderSet) HasOptimizedSwift() bool

func (PrebuiltLoaderSet) String

func (pls PrebuiltLoaderSet) String(f *File) string

type RSKind

type RSKind uint32
const (
	RSKindRebase RSKind = iota
	RSKindBindToImage
	RSKindBindAbsolute
)

func (RSKind) String

func (k RSKind) String() string

type Rebase

type Rebase struct {
	CacheFileOffset uint64 `json:"cache_file_offset,omitempty"`
	CacheVMAddress  uint64 `json:"cache_vm_address,omitempty"`
	Target          uint64 `json:"target,omitempty"`
	Pointer         any    `json:"pointer,omitempty"`
	Symbol          string `json:"symbol,omitempty"`
}

type Region

type Region struct {
	Info uint64
	// vmOffset     : 59,
	// perms        :  3,
	// isZeroFill   :  1,
	// readOnlyData :  1;
	FileOffset uint32
	FileSize   uint32 // mach-o files are limited to 4GB, but zero fill data can be very large
}

Region stored in PrebuiltLoaders and generated on the fly by JustInTimeLoaders, passed to mapSegments()

func (Region) IsZeroFill

func (r Region) IsZeroFill() bool

func (Region) Perms

func (r Region) Perms() types.VmProtection

func (Region) ReadOnlyData

func (r Region) ReadOnlyData() bool

func (Region) String

func (r Region) String() string

func (Region) VMOffset

func (r Region) VMOffset() uint64

type ResolvedSymbol

type ResolvedSymbol struct {
	TargetLoader        *Loader
	TargetSymbolName    string
	TargetRuntimeOffset uint64
	Kind                RSKind
	IsCode              bool
	IsWeakDef           bool
	IsMissingFlatLazy   bool
}

type SelectorReferenceFixup

type SelectorReferenceFixup uint32

func (SelectorReferenceFixup) String

func (s SelectorReferenceFixup) String() string

type StringHash

type StringHash struct {
	Type       strHashType
	FileOffset int64

	Tab              []byte       /* tab[mask+1] (always power-of-2) */
	CheckBytes       []byte       /* check byte for each string */
	Offsets          []int32      /* offsets from &capacity to cstrings */
	ObjectOffsets    []ObjectData /* offsets from &capacity to cstrings */
	DuplicateCount   uint32
	DuplicateOffsets []ObjectData
	// contains filtered or unexported fields
}

StringHash struct

func (*StringHash) Capacity

func (s *StringHash) Capacity() uint32

Capacity returns the Capacity

func (*StringHash) Mask

func (s *StringHash) Mask() uint32

Mask returns the Mask

func (*StringHash) Occupied

func (s *StringHash) Occupied() uint32

Occupied returns the Occupied

func (*StringHash) Read

func (s *StringHash) Read(r io.ReadSeeker) error

func (*StringHash) Salt

func (s *StringHash) Salt() uint64

Salt returns the Salt

func (*StringHash) Scramble

func (s *StringHash) Scramble() [256]uint32

Scramble returns the Scramble

func (*StringHash) Shift

func (s *StringHash) Shift() uint32

Shift returns the Shift

func (StringHash) String

func (s StringHash) String() string

type SubcacheEntry

type SubcacheEntry struct {
	UUID          types.UUID
	CacheVMOffset uint64
	Extention     string
}

type SwiftConformanceMultiMap

type SwiftConformanceMultiMap struct {
	NextHashBufferGrowth uint64
	HashBufferUseCount   uint64
}

type SwiftForeignTypeConformanceNodeEntryT

type SwiftForeignTypeConformanceNodeEntryT struct {
	Key   SwiftForeignTypeProtocolConformanceDiskLocationKey
	Value SwiftForeignTypeProtocolConformanceDiskLocation
	Next  NextNode
	// contains filtered or unexported fields
}

type SwiftForeignTypeProtocolConformance

type SwiftForeignTypeProtocolConformance struct {
	Key      SwiftForeignTypeProtocolConformanceLocationKey
	Location SwiftProtocolConformanceLocation
}

func (SwiftForeignTypeProtocolConformance) String

type SwiftForeignTypeProtocolConformanceDiskLocation

type SwiftForeignTypeProtocolConformanceDiskLocation struct {
	ProtocolConformance BindTargetRef
}

type SwiftForeignTypeProtocolConformanceDiskLocationKey

type SwiftForeignTypeProtocolConformanceDiskLocationKey struct {
	OriginalPointer             uint64
	ForeignDescriptor           BindTargetRef
	ForeignDescriptorNameLength uint64
	Protocol                    BindTargetRef
}

type SwiftForeignTypeProtocolConformanceLocationKey

type SwiftForeignTypeProtocolConformanceLocationKey struct {
	RawForeignDescriptor rawForeignDescriptor
	ProtocolCacheOffset  uint64
}

func (SwiftForeignTypeProtocolConformanceLocationKey) String

type SwiftHashTable

type SwiftHashTable struct {
	CacheOffset uint64
	UUID        types.UUID
	Type        swiftHashTableType
	Demangle    bool

	Tab        []byte  /* tab[mask+1] (always power-of-2). Rounded up to roundedTabSize */
	CheckBytes []byte  /* check byte for each string */
	Offsets    []int32 /* offsets from &capacity to cstrings */
	// contains filtered or unexported fields
}

func (*SwiftHashTable) Read

func (s *SwiftHashTable) Read(r *io.SectionReader) error

type SwiftMetadataConformanceNodeEntryT

type SwiftMetadataConformanceNodeEntryT struct {
	Key   SwiftMetadataProtocolConformanceDiskLocationKey
	Value SwiftMetadataProtocolConformanceDiskLocation
	Next  NextNode
	// contains filtered or unexported fields
}

type SwiftMetadataProtocolConformance

type SwiftMetadataProtocolConformance SwiftProtocolConformance

type SwiftMetadataProtocolConformanceDiskLocation

type SwiftMetadataProtocolConformanceDiskLocation struct {
	ProtocolConformance BindTargetRef
}

type SwiftMetadataProtocolConformanceDiskLocationKey

type SwiftMetadataProtocolConformanceDiskLocationKey struct {
	MetadataDescriptor BindTargetRef
	Protocol           BindTargetRef
}

type SwiftOptimizationHeader

type SwiftOptimizationHeader struct {
	Version                                    uint32
	Padding                                    uint32
	TypeConformanceHashTableCacheOffset        uint64
	MetadataConformanceHashTableCacheOffset    uint64
	ForeignTypeConformanceHashTableCacheOffset uint64
}

type SwiftProtocolConformance

type SwiftProtocolConformance struct {
	Key      SwiftProtocolConformanceLocationKey
	Location SwiftProtocolConformanceLocation
}

func (SwiftProtocolConformance) String

func (p SwiftProtocolConformance) String() string

type SwiftProtocolConformanceLocation

type SwiftProtocolConformanceLocation uint64

func (SwiftProtocolConformanceLocation) DylibObjCIndex

func (l SwiftProtocolConformanceLocation) DylibObjCIndex() uint64

Index in to the HeaderInfoRW dylibs for the dylib containing this conformance

func (SwiftProtocolConformanceLocation) NextIsDuplicate

func (l SwiftProtocolConformanceLocation) NextIsDuplicate() bool

func (SwiftProtocolConformanceLocation) ProtocolConformanceCacheOffset

func (l SwiftProtocolConformanceLocation) ProtocolConformanceCacheOffset() uint64

Offset from the shared cache base to the conformance object

func (SwiftProtocolConformanceLocation) Raw

func (SwiftProtocolConformanceLocation) String

type SwiftProtocolConformanceLocationKey

type SwiftProtocolConformanceLocationKey struct {
	TypeDescriptorCacheOffset uint64
	ProtocolCacheOffset       uint64
}

func (SwiftProtocolConformanceLocationKey) String

type SwiftTypeConformanceEntries

type SwiftTypeConformanceEntries []SwiftTypeProtocolNodeEntryT

func (SwiftTypeConformanceEntries) ForEachEntry

type SwiftTypeProtocolConformanceDiskLocation

type SwiftTypeProtocolConformanceDiskLocation struct {
	ProtocolConformance BindTargetRef
}

type SwiftTypeProtocolConformanceDiskLocationKey

type SwiftTypeProtocolConformanceDiskLocationKey struct {
	TypeDescriptor BindTargetRef
	Protocol       BindTargetRef
}

type SwiftTypeProtocolNodeEntryT

type SwiftTypeProtocolNodeEntryT struct {
	Key   SwiftTypeProtocolConformanceDiskLocationKey
	Value SwiftTypeProtocolConformanceDiskLocation
	Next  NextNode
	// contains filtered or unexported fields
}

type Symbol

type Symbol struct {
	Name    string  `json:"name,omitempty"`
	Image   string  `json:"image,omitempty"`
	Type    string  `json:"type,omitempty"`
	Address uint64  `json:"address,omitempty"`
	Regex   string  `json:"regex,omitempty"`
	Kind    symKind `json:"-"`
}

func (Symbol) String

func (s Symbol) String(color bool) string

type TextFixupPattern

type TextFixupPattern struct {
	Target        resolvedSymbolTarget
	StartVmOffset uint32
	RepeatCount   uint16
	SkipCount     uint16
}

func (TextFixupPattern) String

func (t TextFixupPattern) String() string

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL