Package ghidra.app.util.bin.format.macho

Class MachHeader

    • Constructor Detail

      • MachHeader

        public MachHeader()
        DO NOT USE THIS CONSTRUCTOR, USE create*(GenericFactory ...) FACTORY METHODS INSTEAD.

    • Method Detail

      • isMachHeader

        public static boolean isMachHeader​(ByteProvider provider)
        Returns true if the specified ByteProvider starts with a Mach header magic signature.
        Parameters:
        provider - ByteProvider to check
        Returns:
        boolean true if byte provider starts with a MachHeader

      • createMachHeader

        public static MachHeader createMachHeader​(GenericFactory factory,
                                          ByteProvider provider)
                                   throws java.io.IOException,
                                          MachException
        Assumes the MachHeader starts at index 0 in the ByteProvider.
        Parameters:
        provider - the ByteProvider
        Throws:
        java.io.IOException - if an I/O error occurs while reading from the ByteProvider
        MachException - if an invalid MachHeader is detected

      • createMachHeader

        public static MachHeader createMachHeader​(GenericFactory factory,
                                          ByteProvider provider,
                                          long machHeaderStartIndexInProvider)
                                   throws java.io.IOException,
                                          MachException
        Assumes the MachHeader starts at index machHeaderStartIndexInProvider in the ByteProvider.
        Parameters:
        provider - the ByteProvider
        machHeaderStartIndexInProvider - the index into the ByteProvider where the MachHeader begins.
        Throws:
        java.io.IOException - if an I/O error occurs while reading from the ByteProvider
        MachException - if an invalid MachHeader is detected

      • createMachHeader

        public static MachHeader createMachHeader​(GenericFactory factory,
                                          ByteProvider provider,
                                          long machHeaderStartIndexInProvider,
                                          boolean isRemainingMachoRelativeToStartIndex)
                                   throws java.io.IOException,
                                          MachException
        Assumes the MachHeader starts at index machHeaderStartIndexInProvider in the ByteProvider.
        Parameters:
        provider - the ByteProvider
        machHeaderStartIndexInProvider - the index into the ByteProvider where the MachHeader begins.
        isRemainingMachoRelativeToStartIndex - TRUE if the rest of the macho uses relative indexing. This is common in UBI and kernel cache files. FALSE if the rest of the file uses absolute indexing from 0. This is common in DYLD cache files.
        Throws:
        java.io.IOException - if an I/O error occurs while reading from the ByteProvider
        MachException - if an invalid MachHeader is detected

      • getMagic

        public int getMagic()

      • getCpuType

        public int getCpuType()

      • getImageBase

        public long getImageBase()

      • getCpuSubType

        public int getCpuSubType()

      • getFileType

        public int getFileType()

      • getNumberOfCommands

        public int getNumberOfCommands()

      • getSizeOfCommands

        public int getSizeOfCommands()

      • getFlags

        public int getFlags()

      • toDataType

        public DataType toDataType()
                    throws DuplicateNameException,
                           java.io.IOException
        Description copied from interface: StructConverter
        Returns a structure datatype representing the contents of the implementor of this interface.

        For example, given: 

         class A {
     int foo;
     double bar;
 }

        The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

        Specified by:
        toDataType in interface StructConverter
        Returns:
        returns a structure datatype representing the implementor of this interface
        Throws:
        DuplicateNameException - when a datatype of the same name already exists
        java.io.IOException
        See Also:
        StructureDataType

      • getStartIndex

        public long getStartIndex()
        Returns the start index that should be used for calculating offsets. This will be 0 for things such as the dyld shared cache where offsets are based off the beginning of the file.

      • getStartIndexInProvider

        public long getStartIndexInProvider()
        Returns offset of MachHeader in the ByteProvider

      • is32bit

        public boolean is32bit()

      • getAddressSize

        public int getAddressSize()

      • getAllSegments

        public java.util.List<SegmentCommand> getAllSegments()

      • getSegment

        public SegmentCommand getSegment​(java.lang.String segmentName)

      • getSection

        public Section getSection​(java.lang.String segmentName,
                          java.lang.String sectionName)

      • getAllSections

        public java.util.List<Section> getAllSections()

      • getLoadCommands

        public java.util.List<LoadCommand> getLoadCommands()

      • getLoadCommands

        public <T> java.util.List<T> getLoadCommands​(java.lang.Class<T> classType)

      • getFirstLoadCommand

        public <T> T getFirstLoadCommand​(java.lang.Class<T> classType)

      • isLittleEndian

        public boolean isLittleEndian()

      • getDescription

        public java.lang.String getDescription()

      • toString

        public java.lang.String toString()
        Overrides:
        toString in class java.lang.Object