Mach-O

Structure of the Mach-O Header

The Mach-O header typically contains the following fields:

1. magic (4 bytes):

   • Magic number identifying the file type (e.g., MH_MAGIC (0xfeedface) for 32-bit, MH_MAGIC_64 (0xfeedfacf) for 64-bit).

2. cputype (4 bytes):

   • Specifies the CPU type (e.g., CPU_TYPE_X86 for x86, CPU_TYPE_ARM for ARM).

3. cpusubtype (4 bytes):

   • Specifies the CPU subtype for more granular processor identification.

4. filetype (4 bytes):

   • Specifies the type of file (e.g., MH_EXECUTE for executables, MH_DYLIB for shared libraries).

5. ncmds (4 bytes):

   • The number of load commands that follow the header.

6. sizeofcmds (4 bytes):

   • The total size of the load commands.

7. flags (4 bytes):

   • Flags providing additional information about the file.

8. (Optional for 64-bit) reserved (4 bytes):

   • Reserved field used in 64-bit Mach-O headers.

Load Commands

Following the Mach-O header are load commands, which describe the layout of the binary. Important load commands include:

1. LC_SEGMENT or LC_SEGMENT_64:

   • Describes a segment of the binary and its memory mapping.

2. LC_SYMTAB:

   • Specifies the location of the symbol table.

3. LC_DYSYMTAB:

   • Provides dynamic linking information.

4. LC_LOAD_DYLIB:

   • Specifies a dynamically loaded library.

Finding Where the Code Begins

To determine where the code starts, follow these steps:

1. Check the Entry Point (LC_MAIN or LC_UNIXTHREAD):

   • The LC_MAIN load command (if present) specifies the program's entry point in virtual memory.

   • If LC_MAIN is not present, LC_UNIXTHREAD provides the initial CPU state, including the instruction pointer.

2. Locate the Text Segment:

   • The __TEXT segment (described by LC_SEGMENT or LC_SEGMENT_64) contains the executable code.

   • Check the segment's file offset (fileoff) and virtual memory address (vmaddr) to locate the code.

3. Map Entry Point to File Offset:

   • Use the entry point address from LC_MAIN or LC_UNIXTHREAD and compare it with the vmaddr of the __TEXT segment to calculate the file offset:

     file_offset = entry_point - vmaddr + fileoff

4. Verify with Disassembly:

   • Use tools like otool or llvm-objdump to disassemble the binary and verify the entry point.

Commands to Analyze Mach-O Headers

• otool -hv <file>: Displays the Mach-O header.

• otool -l <file>: Displays the load commands, including segments and their offsets.

• otool -tV <file>: Disassembles the text (code) section.

• llvm-objdump -h <file>: Displays headers and section information.

• llvm-objdump -d <file>: Disassembles the executable, allowing you to examine the code.

Example

These tools can help you locate the exact location of the code and understand the structure of the Mach-O executable.