// The flags field of a section structure is separated into two parts a section // type and section attributes. The section types are mutually exclusive (it // can only have one type) but the section attributes are not (it may have more // than one attribute). /// 256 section types pubconst SECTION_TYPE: u32 = 0x0000_00ff; /// 24 section attributes pubconst SECTION_ATTRIBUTES: u32 = 0xffff_ff00;
// Constants for the type of a section /// regular section pubconst S_REGULAR: u32 = 0x0; /// zero fill on demand section pubconst S_ZEROFILL: u32 = 0x1; /// section with only literal C strings pubconst S_CSTRING_LITERALS: u32 = 0x2; /// section with only 4 byte literals pubconst S_4BYTE_LITERALS: u32 = 0x3; /// section with only 8 byte literals pubconst S_8BYTE_LITERALS: u32 = 0x4; /// section with only pointers to pubconst S_LITERAL_POINTERS: u32 = 0x5;
// literals // For the two types of symbol pointers sections and the symbol stubs section // they have indirect symbol table entries. For each of the entries in the // section the indirect symbol table entries, in corresponding order in the // indirect symbol table, start at the index stored in the reserved1 field // of the section structure. Since the indirect symbol table entries // correspond to the entries in the section the number of indirect symbol table // entries is inferred from the size of the section divided by the size of the // entries in the section. For symbol pointers sections the size of the entries // in the section is 4 bytes and for symbol stubs sections the byte size of the // stubs is stored in the reserved2 field of the section structure. /// section with only non-lazy symbol pointers pubconst S_NON_LAZY_SYMBOL_POINTERS: u32 = 0x6; /// section with only lazy symbol pointers pubconst S_LAZY_SYMBOL_POINTERS: u32 = 0x7; /// section with only symbol stubs, byte size of stub in the reserved2 field pubconst S_SYMBOL_STUBS: u32 = 0x8; /// section with only function pointers for initialization pubconst S_MOD_INIT_FUNC_POINTERS: u32 = 0x9; /// section with only function pointers for termination pubconst S_MOD_TERM_FUNC_POINTERS: u32 = 0xa; /// section contains symbols that are to be coalesced pubconst S_COALESCED: u32 = 0xb; /// zero fill on demand section that can be larger than 4 gigabytes) pubconst S_GB_ZEROFILL: u32 = 0xc; /// section with only pairs of function pointers for interposing pubconst S_INTERPOSING: u32 = 0xd; /// section with only 16 byte literals pubconst S_16BYTE_LITERALS: u32 = 0xe; /// section contains DTrace Object Format pubconst S_DTRACE_DOF: u32 = 0xf; /// section with only lazy symbol pointers to lazy loaded dylibs pubconst S_LAZY_DYLIB_SYMBOL_POINTERS: u32 = 0x10;
// Section types to support thread local variables /// template of initial values for TLVs pubconst S_THREAD_LOCAL_REGULAR: u32 = 0x11; /// template of initial values for TLVs pubconst S_THREAD_LOCAL_ZEROFILL: u32 = 0x12; /// TLV descriptors pubconst S_THREAD_LOCAL_VARIABLES: u32 = 0x13; /// pointers to TLV descriptors pubconst S_THREAD_LOCAL_VARIABLE_POINTERS: u32 = 0x14; /// functions to call to initialize TLV values pubconst S_THREAD_LOCAL_INIT_FUNCTION_POINTERS: u32 = 0x15;
// Constants for the section attributes part of the flags field of a section // structure. /// User setable attributes pubconst SECTION_ATTRIBUTES_USR: u32 = 0xff00_0000; /// section contains only true machine instructions pubconst S_ATTR_PURE_INSTRUCTIONS: u32 = 0x8000_0000; /// section contains coalesced symbols that are not to be in a ranlib table of contents pubconst S_ATTR_NO_TOC: u32 = 0x4000_0000; /// ok to strip static symbols in this section in files with the MH_DYLDLINK flag pubconst S_ATTR_STRIP_STATIC_SYMS: u32 = 0x2000_0000; /// no dead stripping pubconst S_ATTR_NO_DEAD_STRIP: u32 = 0x1000_0000; /// blocks are live if they reference live blocks pubconst S_ATTR_LIVE_SUPPORT: u32 = 0x0800_0000; /// Used with i386 code stubs written on by dyld pubconst S_ATTR_SELF_MODIFYING_CODE: u32 = 0x0400_0000;
// If a segment contains any sections marked with S_ATTR_DEBUG then all // sections in that segment must have this attribute. No section other than // a section marked with this attribute may reference the contents of this // section. A section with this attribute may contain no symbols and must have // a section type S_REGULAR. The static linker will not copy section contents // from sections with this attribute into its output file. These sections // generally contain DWARF debugging info. /// debug section pubconst S_ATTR_DEBUG: u32 = 0x0200_0000; /// system setable attributes pubconst SECTION_ATTRIBUTES_SYS: u32 = 0x00ff_ff00; /// section contains some machine instructions pubconst S_ATTR_SOME_INSTRUCTIONS: u32 = 0x0000_0400; /// section has external relocation entries pubconst S_ATTR_EXT_RELOC: u32 = 0x0000_0200; /// section has local relocation entries pubconst S_ATTR_LOC_RELOC: u32 = 0x0000_0100;
// The names of segments and sections in them are mostly meaningless to the // link-editor. But there are few things to support traditional UNIX // executables that require the link-editor and assembler to use some names // agreed upon by convention. // The initial protection of the "__TEXT" segment has write protection turned // off (not writeable). // The link-editor will allocate common symbols at the end of the "__common" // section in the "__DATA" segment. It will create the section and segment // if needed.
// The currently known segment names and the section names in those segments /// the pagezero segment which has no protections and catches NULL references for MH_EXECUTE files pubconst SEG_PAGEZERO: &str = "__PAGEZERO"; /// the tradition UNIX text segment pubconst SEG_TEXT: &str = "__TEXT"; /// the real text part of the text section no headers, and no padding pubconst SECT_TEXT: &str = "__text"; /// the fvmlib initialization section pubconst SECT_FVMLIB_INIT0: &str = "__fvmlib_init0"; /// the section following the fvmlib initialization section pubconst SECT_FVMLIB_INIT1: &str = "__fvmlib_init1"; /// the tradition UNIX data segment pubconst SEG_DATA: &str = "__DATA"; /// the real initialized data section no padding, no bss overlap pubconst SECT_DATA: &str = "__data"; /// the real uninitialized data sectionno padding pubconst SECT_BSS: &str = "__bss"; /// the section common symbols are allocated in by the link editor pubconst SECT_COMMON: &str = "__common"; /// objective-C runtime segment pubconst SEG_OBJC: &str = "__OBJC"; /// symbol table pubconst SECT_OBJC_SYMBOLS: &str = "__symbol_table"; /// module information pubconst SECT_OBJC_MODULES: &str = "__module_info"; /// string table pubconst SECT_OBJC_STRINGS: &str = "__selector_strs"; /// string table pubconst SECT_OBJC_REFS: &str = "__selector_refs"; /// the icon segment pubconst SEG_ICON: &str = "__ICON"; /// the icon headers pubconst SECT_ICON_HEADER: &str = "__header"; /// the icons in tiff format pubconst SECT_ICON_TIFF: &str = "__tiff"; /// the segment containing all structs created and maintained by the link editor. Created with -seglinkedit option to ld(1) for MH_EXECUTE and FVMLIB file types only pubconst SEG_LINKEDIT: &str = "__LINKEDIT"; /// the unix stack segment pubconst SEG_UNIXSTACK: &str = "__UNIXSTACK"; /// the segment for the self (dyld) modifing code stubs that has read, write and execute permissions pubconst SEG_IMPORT: &str = "__IMPORT";
/// Segment is readable. pubconst VM_PROT_READ: u32 = 0x1; /// Segment is writable. pubconst VM_PROT_WRITE: u32 = 0x2; /// Segment is executable. pubconst VM_PROT_EXECUTE: u32 = 0x4;
pubmod cputype {
/// An alias for u32 pubtype CpuType = u32; /// An alias for u32 pubtype CpuSubType = u32;
/// the mask for CPU feature flags pubconst CPU_SUBTYPE_MASK: u32 = 0xff00_0000; /// mask for architecture bits pubconst CPU_ARCH_MASK: CpuType = 0xff00_0000; /// the mask for 64 bit ABI pubconst CPU_ARCH_ABI64: CpuType = 0x0100_0000; /// the mask for ILP32 ABI on 64 bit hardware pubconst CPU_ARCH_ABI64_32: CpuType = 0x0200_0000;
/// Get the architecture name from cputype and cpusubtype /// /// When using this method to determine the architecture /// name of an instance of /// [`goblin::mach::header::Header`](/goblin/mach/header/struct.Header.html), /// use the provided method /// [`cputype()`](/goblin/mach/header/struct.Header.html#method.cputype) and /// [`cpusubtype()`](/goblin/mach/header/struct.Header.html#method.cpusubtype) /// instead of corresponding field `cputype` and `cpusubtype`. /// /// For example: /// /// ```rust /// use std::fs::read; /// use goblin::mach::constants::cputype::get_arch_name_from_types; /// use goblin::mach::Mach; /// /// read("path/to/macho").and_then(|buf| { /// if let Ok(Mach::Binary(a)) = Mach::parse(&buf) { /// println!("arch name: {}", get_arch_name_from_types(a.header.cputype(), a.header.cpusubtype()).unwrap()); /// } /// Ok(()) /// }); /// ``` pubfn get_arch_name_from_types(cputype: CpuType, cpusubtype: CpuSubType)
-> Option<&'static str> { match (cputype, cpusubtype) {
$(($cputype, $cpusubtype) => Some($name),)*
(_, _) => None
}
}
}
}
/// Get the cputype and cpusubtype from a name pubfn get_arch_from_flag(name: &str) -> Option<(CpuType, CpuSubType)> {
get_arch_from_flag_no_alias(name).or_else(|| { // we also handle some common aliases match name { // these are used by apple "pentium" => Some((CPU_TYPE_I386, CPU_SUBTYPE_PENT)), "pentpro" => Some((CPU_TYPE_I386, CPU_SUBTYPE_PENTPRO)), // these are used commonly for consistency "x86" => Some((CPU_TYPE_I386, CPU_SUBTYPE_I386_ALL)),
_ => None,
}
})
}
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.
