Module: MachO::Headers
- Defined in:
- lib/macho/headers.rb
Overview
Classes and constants for parsing the headers of Mach-O binaries.
Defined Under Namespace
Classes: FatArch, FatArch64, FatHeader, MachHeader, MachHeader64, PrelinkedKernelHeader
Constant Summary collapse
- FAT_MAGIC =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
big-endian fat magic
0xcafebabe
- FAT_CIGAM =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
Note:This is defined for completeness, but should never appear in ruby-macho code, since fat headers are always big-endian.
little-endian fat magic
0xbebafeca
- FAT_MAGIC_64 =
64-bit big-endian fat magic
0xcafebabf
- FAT_CIGAM_64 =
Note:
This is defined for completeness, but should never appear in ruby-macho code, since fat headers are always big-endian.
64-bit little-endian fat magic
0xbfbafeca
- MH_MAGIC =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
32-bit big-endian magic
0xfeedface
- MH_CIGAM =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
32-bit little-endian magic
0xcefaedfe
- MH_MAGIC_64 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
64-bit big-endian magic
0xfeedfacf
- MH_CIGAM_64 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
64-bit little-endian magic
0xcffaedfe
- COMPRESSED_MAGIC =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
compressed mach-o magic
0x636f6d70
- COMP_TYPE_LZSS =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
a compressed mach-o slice, using LZSS for compression
0x6c7a7373
- COMP_TYPE_FASTLIB =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
a compressed mach-o slice, using LZVN ("FastLib") for compression
0x6c7a766e
- MH_MAGICS =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
association of magic numbers to string representations
{ FAT_MAGIC => "FAT_MAGIC", FAT_MAGIC_64 => "FAT_MAGIC_64", MH_MAGIC => "MH_MAGIC", MH_CIGAM => "MH_CIGAM", MH_MAGIC_64 => "MH_MAGIC_64", MH_CIGAM_64 => "MH_CIGAM_64", }.freeze
- CPU_ARCH_ABI64 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
mask for CPUs with 64-bit architectures (when running a 64-bit ABI?)
0x01000000
- CPU_ARCH_ABI32 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
mask for CPUs with 64-bit architectures (when running a 32-bit ABI?)
0x02000000
- CPU_TYPE_ANY =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
any CPU (unused?)
-1
- CPU_TYPE_MC680X0 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
m68k compatible CPUs
0x06
- CPU_TYPE_I386 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
i386 and later compatible CPUs
0x07
- CPU_TYPE_X86_64 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
x86_64 (AMD64) compatible CPUs
(CPU_TYPE_I386 | CPU_ARCH_ABI64)
- CPU_TYPE_ARM =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
32-bit ARM compatible CPUs
0x0c
- CPU_TYPE_MC88000 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
m88k compatible CPUs
0xd
- CPU_TYPE_ARM64 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
64-bit ARM compatible CPUs
(CPU_TYPE_ARM | CPU_ARCH_ABI64)
- CPU_TYPE_ARM64_32 =
64-bit ARM compatible CPUs (running in 32-bit mode?)
(CPU_TYPE_ARM | CPU_ARCH_ABI32)
- CPU_TYPE_POWERPC =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
PowerPC compatible CPUs
0x12
- CPU_TYPE_POWERPC64 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
PowerPC64 compatible CPUs
(CPU_TYPE_POWERPC | CPU_ARCH_ABI64)
- CPU_TYPES =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
association of cpu types to symbol representations
{ CPU_TYPE_ANY => :any, CPU_TYPE_I386 => :i386, CPU_TYPE_X86_64 => :x86_64, CPU_TYPE_ARM => :arm, CPU_TYPE_ARM64 => :arm64, CPU_TYPE_ARM64_32 => :arm64_32, CPU_TYPE_POWERPC => :ppc, CPU_TYPE_POWERPC64 => :ppc64, }.freeze
- CPU_SUBTYPE_MASK =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
mask for CPU subtype capabilities
0xff000000
- CPU_SUBTYPE_LIB64 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
64-bit libraries (undocumented!)
0x80000000
- CPU_SUBTYPE_I386 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the lowest common sub-type for
CPU_TYPE_I386
3
- CPU_SUBTYPE_486 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the i486 sub-type for
CPU_TYPE_I386
4
- CPU_SUBTYPE_486SX =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the i486SX sub-type for
CPU_TYPE_I386
132
- CPU_SUBTYPE_586 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the i586 (P5, Pentium) sub-type for
CPU_TYPE_I386
5
- CPU_SUBTYPE_PENT =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
CPU_SUBTYPE_586
- CPU_SUBTYPE_PENTPRO =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the Pentium Pro (P6) sub-type for
CPU_TYPE_I386
22
- CPU_SUBTYPE_PENTII_M3 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the Pentium II (P6, M3?) sub-type for
CPU_TYPE_I386
54
- CPU_SUBTYPE_PENTII_M5 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the Pentium II (P6, M5?) sub-type for
CPU_TYPE_I386
86
- CPU_SUBTYPE_PENTIUM_4 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the Pentium 4 (Netburst) sub-type for
CPU_TYPE_I386
10
- CPU_SUBTYPE_MC680X0_ALL =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the lowest common sub-type for
CPU_TYPE_MC680X0
1
- CPU_SUBTYPE_MC68030 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
CPU_SUBTYPE_MC680X0_ALL
- CPU_SUBTYPE_MC68040 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 040 subtype for
CPU_TYPE_MC680X0
2
- CPU_SUBTYPE_MC68030_ONLY =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 030 subtype for
CPU_TYPE_MC680X0
3
- CPU_SUBTYPE_X86_64_ALL =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the lowest common sub-type for
CPU_TYPE_X86_64
CPU_SUBTYPE_I386
- CPU_SUBTYPE_X86_64_H =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the Haskell sub-type for
CPU_TYPE_X86_64
8
- CPU_SUBTYPE_ARM_ALL =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the lowest common sub-type for
CPU_TYPE_ARM
0
- CPU_SUBTYPE_ARM_V4T =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v4t sub-type for
CPU_TYPE_ARM
5
- CPU_SUBTYPE_ARM_V6 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v6 sub-type for
CPU_TYPE_ARM
6
- CPU_SUBTYPE_ARM_V5TEJ =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v5 sub-type for
CPU_TYPE_ARM
7
- CPU_SUBTYPE_ARM_XSCALE =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the xscale (v5 family) sub-type for
CPU_TYPE_ARM
8
- CPU_SUBTYPE_ARM_V7 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v7 sub-type for
CPU_TYPE_ARM
9
- CPU_SUBTYPE_ARM_V7F =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v7f (Cortex A9) sub-type for
CPU_TYPE_ARM
10
- CPU_SUBTYPE_ARM_V7S =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v7s ("Swift") sub-type for
CPU_TYPE_ARM
11
- CPU_SUBTYPE_ARM_V7K =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v7k ("Kirkwood40") sub-type for
CPU_TYPE_ARM
12
- CPU_SUBTYPE_ARM_V6M =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v6m sub-type for
CPU_TYPE_ARM
14
- CPU_SUBTYPE_ARM_V7M =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v7m sub-type for
CPU_TYPE_ARM
15
- CPU_SUBTYPE_ARM_V7EM =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v7em sub-type for
CPU_TYPE_ARM
16
- CPU_SUBTYPE_ARM_V8 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v8 sub-type for
CPU_TYPE_ARM
13
- CPU_SUBTYPE_ARM64_ALL =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the lowest common sub-type for
CPU_TYPE_ARM64
0
- CPU_SUBTYPE_ARM64_V8 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v8 sub-type for
CPU_TYPE_ARM64
1
- CPU_SUBTYPE_ARM64_32_V8 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the v8 sub-type for
CPU_TYPE_ARM64_32
1
- CPU_SUBTYPE_ARM64E =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the e (A12) sub-type for
CPU_TYPE_ARM64
2
- CPU_SUBTYPE_MC88000_ALL =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the lowest common sub-type for
CPU_TYPE_MC88000
0
- CPU_SUBTYPE_MMAX_JPC =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
CPU_SUBTYPE_MC88000_ALL
- CPU_SUBTYPE_MC88100 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 100 sub-type for
CPU_TYPE_MC88000
1
- CPU_SUBTYPE_MC88110 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 110 sub-type for
CPU_TYPE_MC88000
2
- CPU_SUBTYPE_POWERPC_ALL =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the lowest common sub-type for
CPU_TYPE_POWERPC
0
- CPU_SUBTYPE_POWERPC_601 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 601 sub-type for
CPU_TYPE_POWERPC
1
- CPU_SUBTYPE_POWERPC_602 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 602 sub-type for
CPU_TYPE_POWERPC
2
- CPU_SUBTYPE_POWERPC_603 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 603 sub-type for
CPU_TYPE_POWERPC
3
- CPU_SUBTYPE_POWERPC_603E =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 603e (G2) sub-type for
CPU_TYPE_POWERPC
4
- CPU_SUBTYPE_POWERPC_603EV =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 603ev sub-type for
CPU_TYPE_POWERPC
5
- CPU_SUBTYPE_POWERPC_604 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 604 sub-type for
CPU_TYPE_POWERPC
6
- CPU_SUBTYPE_POWERPC_604E =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 604e sub-type for
CPU_TYPE_POWERPC
7
- CPU_SUBTYPE_POWERPC_620 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 620 sub-type for
CPU_TYPE_POWERPC
8
- CPU_SUBTYPE_POWERPC_750 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 750 (G3) sub-type for
CPU_TYPE_POWERPC
9
- CPU_SUBTYPE_POWERPC_7400 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 7400 (G4) sub-type for
CPU_TYPE_POWERPC
10
- CPU_SUBTYPE_POWERPC_7450 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 7450 (G4 "Voyager") sub-type for
CPU_TYPE_POWERPC
11
- CPU_SUBTYPE_POWERPC_970 =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
the 970 (G5) sub-type for
CPU_TYPE_POWERPC
100
- CPU_SUBTYPE_POWERPC64_ALL =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
any CPU sub-type for CPU type
CPU_TYPE_POWERPC64
CPU_SUBTYPE_POWERPC_ALL
- CPU_SUBTYPES =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
association of CPU types/subtype pairs to symbol representations in (very) roughly descending order of commonness
{ CPU_TYPE_I386 => { CPU_SUBTYPE_I386 => :i386, CPU_SUBTYPE_486 => :i486, CPU_SUBTYPE_486SX => :i486SX, CPU_SUBTYPE_586 => :i586, # also "pentium" in arch(3) CPU_SUBTYPE_PENTPRO => :i686, # also "pentpro" in arch(3) CPU_SUBTYPE_PENTII_M3 => :pentIIm3, CPU_SUBTYPE_PENTII_M5 => :pentIIm5, CPU_SUBTYPE_PENTIUM_4 => :pentium4, }.freeze, CPU_TYPE_X86_64 => { CPU_SUBTYPE_X86_64_ALL => :x86_64, CPU_SUBTYPE_X86_64_H => :x86_64h, }.freeze, CPU_TYPE_ARM => { CPU_SUBTYPE_ARM_ALL => :arm, CPU_SUBTYPE_ARM_V4T => :armv4t, CPU_SUBTYPE_ARM_V6 => :armv6, CPU_SUBTYPE_ARM_V5TEJ => :armv5, CPU_SUBTYPE_ARM_XSCALE => :xscale, CPU_SUBTYPE_ARM_V7 => :armv7, CPU_SUBTYPE_ARM_V7F => :armv7f, CPU_SUBTYPE_ARM_V7S => :armv7s, CPU_SUBTYPE_ARM_V7K => :armv7k, CPU_SUBTYPE_ARM_V6M => :armv6m, CPU_SUBTYPE_ARM_V7M => :armv7m, CPU_SUBTYPE_ARM_V7EM => :armv7em, CPU_SUBTYPE_ARM_V8 => :armv8, }.freeze, CPU_TYPE_ARM64 => { CPU_SUBTYPE_ARM64_ALL => :arm64, CPU_SUBTYPE_ARM64_V8 => :arm64v8, CPU_SUBTYPE_ARM64E => :arm64e, }.freeze, CPU_TYPE_ARM64_32 => { CPU_SUBTYPE_ARM64_32_V8 => :arm64_32v8, }.freeze, CPU_TYPE_POWERPC => { CPU_SUBTYPE_POWERPC_ALL => :ppc, CPU_SUBTYPE_POWERPC_601 => :ppc601, CPU_SUBTYPE_POWERPC_603 => :ppc603, CPU_SUBTYPE_POWERPC_603E => :ppc603e, CPU_SUBTYPE_POWERPC_603EV => :ppc603ev, CPU_SUBTYPE_POWERPC_604 => :ppc604, CPU_SUBTYPE_POWERPC_604E => :ppc604e, CPU_SUBTYPE_POWERPC_750 => :ppc750, CPU_SUBTYPE_POWERPC_7400 => :ppc7400, CPU_SUBTYPE_POWERPC_7450 => :ppc7450, CPU_SUBTYPE_POWERPC_970 => :ppc970, }.freeze, CPU_TYPE_POWERPC64 => { CPU_SUBTYPE_POWERPC64_ALL => :ppc64, # apparently the only exception to the naming scheme CPU_SUBTYPE_POWERPC_970 => :ppc970_64, }.freeze, CPU_TYPE_MC680X0 => { CPU_SUBTYPE_MC680X0_ALL => :m68k, CPU_SUBTYPE_MC68030 => :mc68030, CPU_SUBTYPE_MC68040 => :mc68040, }, CPU_TYPE_MC88000 => { CPU_SUBTYPE_MC88000_ALL => :m88k, }, }.freeze
- MH_OBJECT =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
relocatable object file
0x1
- MH_EXECUTE =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
demand paged executable file
0x2
- MH_FVMLIB =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
fixed VM shared library file
0x3
- MH_CORE =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
core dump file
0x4
- MH_PRELOAD =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
preloaded executable file
0x5
- MH_DYLIB =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
dynamically bound shared library
0x6
- MH_DYLINKER =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
dynamic link editor
0x7
- MH_BUNDLE =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
dynamically bound bundle file
0x8
- MH_DYLIB_STUB =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
shared library stub for static linking only, no section contents
0x9
- MH_DSYM =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
companion file with only debug sections
0xa
- MH_KEXT_BUNDLE =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
x86_64 kexts
0xb
- MH_FILESET =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
a set of Mach-Os, running in the same userspace, sharing a linkedit. The kext collection files are an example of this object type
0xc
- MH_FILETYPES =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
association of filetypes to Symbol representations
{ MH_OBJECT => :object, MH_EXECUTE => :execute, MH_FVMLIB => :fvmlib, MH_CORE => :core, MH_PRELOAD => :preload, MH_DYLIB => :dylib, MH_DYLINKER => :dylinker, MH_BUNDLE => :bundle, MH_DYLIB_STUB => :dylib_stub, MH_DSYM => :dsym, MH_KEXT_BUNDLE => :kext_bundle, MH_FILESET => :fileset, }.freeze
- MH_FLAGS =
This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.
association of mach header flag symbols to values
{ :MH_NOUNDEFS => 0x1, :MH_INCRLINK => 0x2, :MH_DYLDLINK => 0x4, :MH_BINDATLOAD => 0x8, :MH_PREBOUND => 0x10, :MH_SPLIT_SEGS => 0x20, :MH_LAZY_INIT => 0x40, :MH_TWOLEVEL => 0x80, :MH_FORCE_FLAT => 0x100, :MH_NOMULTIDEFS => 0x200, :MH_NOPREFIXBINDING => 0x400, :MH_PREBINDABLE => 0x800, :MH_ALLMODSBOUND => 0x1000, :MH_SUBSECTIONS_VIA_SYMBOLS => 0x2000, :MH_CANONICAL => 0x4000, :MH_WEAK_DEFINES => 0x8000, :MH_BINDS_TO_WEAK => 0x10000, :MH_ALLOW_STACK_EXECUTION => 0x20000, :MH_ROOT_SAFE => 0x40000, :MH_SETUID_SAFE => 0x80000, :MH_NO_REEXPORTED_DYLIBS => 0x100000, :MH_PIE => 0x200000, :MH_DEAD_STRIPPABLE_DYLIB => 0x400000, :MH_HAS_TLV_DESCRIPTORS => 0x800000, :MH_NO_HEAP_EXECUTION => 0x1000000, :MH_APP_EXTENSION_SAFE => 0x02000000, :MH_NLIST_OUTOFSYNC_WITH_DYLDINFO => 0x04000000, :MH_SIM_SUPPORT => 0x08000000, :MH_DYLIB_IN_CACHE => 0x80000000, }.freeze