Module: MachO

Defined in:
lib/macho.rb,
lib/macho/open.rb,
lib/macho/view.rb,
lib/macho/tools.rb,
lib/macho/utils.rb,
lib/macho/headers.rb,
lib/macho/sections.rb,
lib/macho/fat_file.rb,
lib/macho/structure.rb,
lib/macho/macho_file.rb,
lib/macho/exceptions.rb,
lib/macho/load_commands.rb

Overview

The primary namespace for ruby-macho.

Defined Under Namespace

Modules: Tools, Utils Classes: CPUSubtypeError, CPUTypeError, DyldInfoCommand, DylibCommand, DylibIdMissingError, DylibUnknownError, DylinkerCommand, DysymtabCommand, EncryptionInfoCommand, EncryptionInfoCommand64, EntryPointCommand, FatArch, FatBinaryError, FatFile, FatHeader, FiletypeError, FvmfileCommand, FvmlibCommand, HeaderPadError, IdentCommand, JavaClassFileError, LCStrMalformedError, LinkeditDataCommand, LinkerOptionCommand, LoadCommand, LoadCommandCreationArityError, LoadCommandError, LoadCommandNotCreatableError, LoadCommandNotSerializableError, MachHeader, MachHeader64, MachOBinaryError, MachOError, MachOFile, MachOStructure, MachOView, MagicError, NotAMachOError, OffsetInsertionError, PrebindCksumCommand, PreboundDylibCommand, RoutinesCommand, RoutinesCommand64, RpathCommand, RpathExistsError, RpathUnknownError, Section, Section64, SegmentCommand, SegmentCommand64, SourceVersionCommand, SubClientCommand, SubFrameworkCommand, SubLibraryCommand, SubUmbrellaCommand, SymsegCommand, SymtabCommand, ThreadCommand, TruncatedFileError, TwolevelHintsCommand, UUIDCommand, UnimplementedError, VersionMinCommand

Constant Summary collapse

VERSION =

release version

"0.2.4".freeze
FAT_MAGIC =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

big-endian fat magic

0xcafebabe
FAT_CIGAM =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

little-endian fat magic this is defined, but should never appear in ruby-macho code because fat headers are always big-endian and therefore always unpacked as such.

0xbebafeca
MH_MAGIC =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

32-bit big-endian magic

0xfeedface
MH_CIGAM =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

32-bit little-endian magic

0xcefaedfe
MH_MAGIC_64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

64-bit big-endian magic

0xfeedfacf
MH_CIGAM_64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

64-bit little-endian magic

0xcffaedfe
MH_MAGICS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of magic numbers to string representations

{
  FAT_MAGIC => "FAT_MAGIC",
  MH_MAGIC => "MH_MAGIC",
  MH_CIGAM => "MH_CIGAM",
  MH_MAGIC_64 => "MH_MAGIC_64",
  MH_CIGAM_64 => "MH_CIGAM_64"
}
CPU_ARCH_ABI64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

mask for CPUs with 64-bit architectures (when running a 64-bit ABI?)

0x01000000
CPU_TYPE_ANY =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

any CPU (unused?)

-1
CPU_TYPE_MC680X0 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

m68k compatible CPUs

0x06
CPU_TYPE_I386 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

i386 and later compatible CPUs

0x07
CPU_TYPE_X86_64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

x86_64 (AMD64) compatible CPUs

(CPU_TYPE_I386 | CPU_ARCH_ABI64)
CPU_TYPE_ARM =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

32-bit ARM compatible CPUs

0x0c
CPU_TYPE_MC88000 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

m88k compatible CPUs

0xd
CPU_TYPE_ARM64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

64-bit ARM compatible CPUs

(CPU_TYPE_ARM | CPU_ARCH_ABI64)
CPU_TYPE_POWERPC =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

PowerPC compatible CPUs

0x12
CPU_TYPE_POWERPC64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

PowerPC64 compatible CPUs

(CPU_TYPE_POWERPC | CPU_ARCH_ABI64)
CPU_TYPES =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of cpu types to symbol representations

{
  CPU_TYPE_ANY => :any,
  CPU_TYPE_I386 => :i386,
  CPU_TYPE_X86_64 => :x86_64,
  CPU_TYPE_ARM => :arm,
  CPU_TYPE_ARM64 => :arm64,
  CPU_TYPE_POWERPC => :ppc,
  CPU_TYPE_POWERPC64 => :ppc64,
}
CPU_SUBTYPE_MASK =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

mask for CPU subtype capabilities

0xff000000
CPU_SUBTYPE_LIB64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

64-bit libraries (undocumented!)

0x80000000
CPU_SUBTYPE_I386 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_I386

3
CPU_SUBTYPE_486 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the i486 sub-type for CPU_TYPE_I386

4
CPU_SUBTYPE_486SX =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the i486SX sub-type for CPU_TYPE_I386

132
CPU_SUBTYPE_586 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the i586 (P5, Pentium) sub-type for CPU_TYPE_I386

5
CPU_SUBTYPE_PENT =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

See Also:

CPU_SUBTYPE_586
CPU_SUBTYPE_PENTPRO =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the Pentium Pro (P6) sub-type for CPU_TYPE_I386

22
CPU_SUBTYPE_PENTII_M3 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the Pentium II (P6, M3?) sub-type for CPU_TYPE_I386

54
CPU_SUBTYPE_PENTII_M5 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the Pentium II (P6, M5?) sub-type for CPU_TYPE_I386

86
CPU_SUBTYPE_PENTIUM_4 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the Pentium 4 (Netburst) sub-type for CPU_TYPE_I386

10
CPU_SUBTYPE_MC680X0_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_MC680X0

1
CPU_SUBTYPE_MC68030 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

CPU_SUBTYPE_MC680X0_ALL
CPU_SUBTYPE_MC68040 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 040 subtype for CPU_TYPE_MC680X0

2
CPU_SUBTYPE_MC68030_ONLY =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 030 subtype for CPU_TYPE_MC680X0

3
CPU_SUBTYPE_X86_64_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_X86_64

CPU_SUBTYPE_I386
CPU_SUBTYPE_X86_64_H =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the Haskell sub-type for CPU_TYPE_X86_64

8
CPU_SUBTYPE_ARM_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_ARM

0
CPU_SUBTYPE_ARM_V4T =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v4t sub-type for CPU_TYPE_ARM

5
CPU_SUBTYPE_ARM_V6 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v6 sub-type for CPU_TYPE_ARM

6
CPU_SUBTYPE_ARM_V5TEJ =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v5 sub-type for CPU_TYPE_ARM

7
CPU_SUBTYPE_ARM_XSCALE =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the xscale (v5 family) sub-type for CPU_TYPE_ARM

8
CPU_SUBTYPE_ARM_V7 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7 sub-type for CPU_TYPE_ARM

9
CPU_SUBTYPE_ARM_V7F =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7f (Cortex A9) sub-type for CPU_TYPE_ARM

10
CPU_SUBTYPE_ARM_V7S =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7s ("Swift") sub-type for CPU_TYPE_ARM

11
CPU_SUBTYPE_ARM_V7K =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7k ("Kirkwood40") sub-type for CPU_TYPE_ARM

12
CPU_SUBTYPE_ARM_V6M =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v6m sub-type for CPU_TYPE_ARM

14
CPU_SUBTYPE_ARM_V7M =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7m sub-type for CPU_TYPE_ARM

15
CPU_SUBTYPE_ARM_V7EM =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7em sub-type for CPU_TYPE_ARM

16
CPU_SUBTYPE_ARM_V8 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v8 sub-type for CPU_TYPE_ARM

13
CPU_SUBTYPE_ARM64_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_ARM64

0
CPU_SUBTYPE_ARM64_V8 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v8 sub-type for CPU_TYPE_ARM64

1
CPU_SUBTYPE_MC88000_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_MC88000

0
CPU_SUBTYPE_MMAX_JPC =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

CPU_SUBTYPE_MC88000_ALL
CPU_SUBTYPE_MC88100 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 100 sub-type for CPU_TYPE_MC88000

1
CPU_SUBTYPE_MC88110 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 110 sub-type for CPU_TYPE_MC88000

2
CPU_SUBTYPE_POWERPC_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_POWERPC

0
CPU_SUBTYPE_POWERPC_601 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 601 sub-type for CPU_TYPE_POWERPC

1
CPU_SUBTYPE_POWERPC_602 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 602 sub-type for CPU_TYPE_POWERPC

2
CPU_SUBTYPE_POWERPC_603 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 603 sub-type for CPU_TYPE_POWERPC

3
CPU_SUBTYPE_POWERPC_603E =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 603e (G2) sub-type for CPU_TYPE_POWERPC

4
CPU_SUBTYPE_POWERPC_603EV =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 603ev sub-type for CPU_TYPE_POWERPC

5
CPU_SUBTYPE_POWERPC_604 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 604 sub-type for CPU_TYPE_POWERPC

6
CPU_SUBTYPE_POWERPC_604E =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 604e sub-type for CPU_TYPE_POWERPC

7
CPU_SUBTYPE_POWERPC_620 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 620 sub-type for CPU_TYPE_POWERPC

8
CPU_SUBTYPE_POWERPC_750 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 750 (G3) sub-type for CPU_TYPE_POWERPC

9
CPU_SUBTYPE_POWERPC_7400 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 7400 (G4) sub-type for CPU_TYPE_POWERPC

10
CPU_SUBTYPE_POWERPC_7450 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 7450 (G4 "Voyager") sub-type for CPU_TYPE_POWERPC

11
CPU_SUBTYPE_POWERPC_970 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 970 (G5) sub-type for CPU_TYPE_POWERPC

100
CPU_SUBTYPE_POWERPC64_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

any CPU sub-type for CPU type CPU_TYPE_POWERPC64

CPU_SUBTYPE_POWERPC_ALL
CPU_SUBTYPES =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of CPU types/subtype pairs to symbol representations in (very) roughly descending order of commonness

{
  CPU_TYPE_I386 => {
    CPU_SUBTYPE_I386 => :i386,
    CPU_SUBTYPE_486 => :i486,
    CPU_SUBTYPE_486SX => :i486SX,
    CPU_SUBTYPE_586 => :i586, # also "pentium" in arch(3)
    CPU_SUBTYPE_PENTPRO => :i686, # also "pentpro" in arch(3)
    CPU_SUBTYPE_PENTII_M3 => :pentIIm3,
    CPU_SUBTYPE_PENTII_M5 => :pentIIm5,
    CPU_SUBTYPE_PENTIUM_4 => :pentium4,
  }.freeze,
  CPU_TYPE_X86_64 => {
    CPU_SUBTYPE_X86_64_ALL => :x86_64,
    CPU_SUBTYPE_X86_64_H => :x86_64h,
  }.freeze,
  CPU_TYPE_ARM => {
    CPU_SUBTYPE_ARM_ALL => :arm,
    CPU_SUBTYPE_ARM_V4T => :armv4t,
    CPU_SUBTYPE_ARM_V6 => :armv6,
    CPU_SUBTYPE_ARM_V5TEJ => :armv5,
    CPU_SUBTYPE_ARM_XSCALE => :xscale,
    CPU_SUBTYPE_ARM_V7 => :armv7,
    CPU_SUBTYPE_ARM_V7F => :armv7f,
    CPU_SUBTYPE_ARM_V7S => :armv7s,
    CPU_SUBTYPE_ARM_V7K => :armv7k,
    CPU_SUBTYPE_ARM_V6M => :armv6m,
    CPU_SUBTYPE_ARM_V7M => :armv7m,
    CPU_SUBTYPE_ARM_V7EM => :armv7em,
    CPU_SUBTYPE_ARM_V8 => :armv8,
  }.freeze,
  CPU_TYPE_ARM64 => {
    CPU_SUBTYPE_ARM64_ALL => :arm64,
    CPU_SUBTYPE_ARM64_V8 => :arm64v8,
  }.freeze,
  CPU_TYPE_POWERPC => {
    CPU_SUBTYPE_POWERPC_ALL => :ppc,
    CPU_SUBTYPE_POWERPC_601 => :ppc601,
    CPU_SUBTYPE_POWERPC_603 => :ppc603,
    CPU_SUBTYPE_POWERPC_603E => :ppc603e,
    CPU_SUBTYPE_POWERPC_603EV => :ppc603ev,
    CPU_SUBTYPE_POWERPC_604 => :ppc604,
    CPU_SUBTYPE_POWERPC_604E => :ppc604e,
    CPU_SUBTYPE_POWERPC_750 => :ppc750,
    CPU_SUBTYPE_POWERPC_7400 => :ppc7400,
    CPU_SUBTYPE_POWERPC_7450 => :ppc7450,
    CPU_SUBTYPE_POWERPC_970 => :ppc970,
  }.freeze,
  CPU_TYPE_POWERPC64 => {
    CPU_SUBTYPE_POWERPC64_ALL => :ppc64,
    # apparently the only exception to the naming scheme
    CPU_SUBTYPE_POWERPC_970 => :ppc970_64,
  }.freeze,
  CPU_TYPE_MC680X0 => {
    CPU_SUBTYPE_MC680X0_ALL => :m68k,
    CPU_SUBTYPE_MC68030 => :mc68030,
    CPU_SUBTYPE_MC68040 => :mc68040,
  },
  CPU_TYPE_MC88000 => {
    CPU_SUBTYPE_MC88000_ALL => :m88k,
  },
}.freeze
MH_OBJECT =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

relocatable object file

0x1
MH_EXECUTE =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

demand paged executable file

0x2
MH_FVMLIB =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

fixed VM shared library file

0x3
MH_CORE =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

core dump file

0x4
MH_PRELOAD =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

preloaded executable file

0x5
MH_DYLIB =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

dynamically bound shared library

0x6
MH_DYLINKER =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

dynamic link editor

0x7
MH_BUNDLE =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

dynamically bound bundle file

0x8
MH_DYLIB_STUB =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

shared library stub for static linking only, no section contents

0x9
MH_DSYM =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

companion file with only debug sections

0xa
MH_KEXT_BUNDLE =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

x86_64 kexts

0xb
MH_FILETYPES =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of filetypes to Symbol representations

{
  MH_OBJECT => :object,
  MH_EXECUTE => :execute,
  MH_FVMLIB => :fvmlib,
  MH_CORE => :core,
  MH_PRELOAD => :preload,
  MH_DYLIB => :dylib,
  MH_DYLINKER => :dylinker,
  MH_BUNDLE => :bundle,
  MH_DYLIB_STUB => :dylib_stub,
  MH_DSYM => :dsym,
  MH_KEXT_BUNDLE => :kext_bundle,
}
MH_FLAGS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of mach header flag symbols to values

{
  :MH_NOUNDEFS => 0x1,
  :MH_INCRLINK => 0x2,
  :MH_DYLDLINK => 0x4,
  :MH_BINDATLOAD => 0x8,
  :MH_PREBOUND => 0x10,
  :MH_SPLIT_SEGS => 0x20,
  :MH_LAZY_INIT => 0x40,
  :MH_TWOLEVEL => 0x80,
  :MH_FORCE_FLAT => 0x100,
  :MH_NOMULTIDEFS => 0x200,
  :MH_NOPREFIXBINDING => 0x400,
  :MH_PREBINDABLE => 0x800,
  :MH_ALLMODSBOUND => 0x1000,
  :MH_SUBSECTIONS_VIA_SYMBOLS => 0x2000,
  :MH_CANONICAL => 0x4000,
  :MH_WEAK_DEFINES => 0x8000,
  :MH_BINDS_TO_WEAK => 0x10000,
  :MH_ALLOW_STACK_EXECUTION => 0x20000,
  :MH_ROOT_SAFE => 0x40000,
  :MH_SETUID_SAFE => 0x80000,
  :MH_NO_REEXPORTED_DYLIBS => 0x100000,
  :MH_PIE => 0x200000,
  :MH_DEAD_STRIPPABLE_DYLIB => 0x400000,
  :MH_HAS_TLV_DESCRIPTORS => 0x800000,
  :MH_NO_HEAP_EXECUTION => 0x1000000,
  :MH_APP_EXTENSION_SAFE => 0x02000000
}
SECTION_TYPE =

type mask

0x000000ff
SECTION_ATTRIBUTES =

attributes mask

0xffffff00
SECTION_ATTRIBUTES_USR =

user settable attributes mask

0xff000000
SECTION_ATTRIBUTES_SYS =

system settable attributes mask

0x00ffff00
SECTION_FLAGS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of section flag symbols to values

{
  :S_REGULAR => 0x0,
  :S_ZEROFILL => 0x1,
  :S_CSTRING_LITERALS => 0x2,
  :S_4BYTE_LITERALS => 0x3,
  :S_8BYTE_LITERALS => 0x4,
  :S_LITERAL_POINTERS => 0x5,
  :S_NON_LAZY_SYMBOL_POINTERS => 0x6,
  :S_LAZY_SYMBOL_POINTERS => 0x7,
  :S_SYMBOL_STUBS => 0x8,
  :S_MOD_INIT_FUNC_POINTERS => 0x9,
  :S_MOD_TERM_FUNC_POINTERS => 0xa,
  :S_COALESCED => 0xb,
  :S_GB_ZEROFILE => 0xc,
  :S_INTERPOSING => 0xd,
  :S_16BYTE_LITERALS => 0xe,
  :S_DTRACE_DOF => 0xf,
  :S_LAZY_DYLIB_SYMBOL_POINTERS => 0x10,
  :S_THREAD_LOCAL_REGULAR => 0x11,
  :S_THREAD_LOCAL_ZEROFILL => 0x12,
  :S_THREAD_LOCAL_VARIABLES => 0x13,
  :S_THREAD_LOCAL_VARIABLE_POINTERS => 0x14,
  :S_THREAD_LOCAL_INIT_FUNCTION_POINTERS => 0x15,
  :S_ATTR_PURE_INSTRUCTIONS => 0x80000000,
  :S_ATTR_NO_TOC => 0x40000000,
  :S_ATTR_STRIP_STATIC_SYMS => 0x20000000,
  :S_ATTR_NO_DEAD_STRIP => 0x10000000,
  :S_ATTR_LIVE_SUPPORT => 0x08000000,
  :S_ATTR_SELF_MODIFYING_CODE => 0x04000000,
  :S_ATTR_DEBUG => 0x02000000,
  :S_ATTR_SOME_INSTRUCTIONS => 0x00000400,
  :S_ATTR_EXT_RELOC => 0x00000200,
  :S_ATTR_LOC_RELOC => 0x00000100
}.freeze
SECTION_NAMES =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of section name symbols to names

{
  :SECT_TEXT => "__text",
  :SECT_FVMLIB_INIT0 => "__fvmlib_init0",
  :SECT_FVMLIB_INIT1 => "__fvmlib_init1",
  :SECT_DATA => "__data",
  :SECT_BSS => "__bss",
  :SECT_COMMON => "__common",
  :SECT_OBJC_SYMBOLS => "__symbol_table",
  :SECT_OBJC_MODULES => "__module_info",
  :SECT_OBJC_STRINGS => "__selector_strs",
  :SECT_OBJC_REFS => "__selector_refs",
  :SECT_ICON_HEADER => "__header",
  :SECT_ICON_TIFF => "__tiff"
}.freeze
LC_REQ_DYLD =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

load commands added after OS X 10.1 need to be bitwise ORed with LC_REQ_DYLD to be recognized by the dynamic linder (dyld)

0x80000000
LOAD_COMMANDS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of load commands to symbol representations

{
  0x1 => :LC_SEGMENT,
  0x2 => :LC_SYMTAB,
  0x3 => :LC_SYMSEG,
  0x4 => :LC_THREAD,
  0x5 => :LC_UNIXTHREAD,
  0x6 => :LC_LOADFVMLIB,
  0x7 => :LC_IDFVMLIB,
  0x8 => :LC_IDENT,
  0x9 => :LC_FVMFILE,
  0xa => :LC_PREPAGE,
  0xb => :LC_DYSYMTAB,
  0xc => :LC_LOAD_DYLIB,
  0xd => :LC_ID_DYLIB,
  0xe => :LC_LOAD_DYLINKER,
  0xf => :LC_ID_DYLINKER,
  0x10 => :LC_PREBOUND_DYLIB,
  0x11 => :LC_ROUTINES,
  0x12 => :LC_SUB_FRAMEWORK,
  0x13 => :LC_SUB_UMBRELLA,
  0x14 => :LC_SUB_CLIENT,
  0x15 => :LC_SUB_LIBRARY,
  0x16 => :LC_TWOLEVEL_HINTS,
  0x17 => :LC_PREBIND_CKSUM,
  (0x18 | LC_REQ_DYLD) => :LC_LOAD_WEAK_DYLIB,
  0x19 => :LC_SEGMENT_64,
  0x1a => :LC_ROUTINES_64,
  0x1b => :LC_UUID,
  (0x1c | LC_REQ_DYLD) => :LC_RPATH,
  0x1d => :LC_CODE_SIGNATURE,
  0x1e => :LC_SEGMENT_SPLIT_INFO,
  (0x1f | LC_REQ_DYLD) => :LC_REEXPORT_DYLIB,
  0x20 => :LC_LAZY_LOAD_DYLIB,
  0x21 => :LC_ENCRYPTION_INFO,
  0x22 => :LC_DYLD_INFO,
  (0x22 | LC_REQ_DYLD) => :LC_DYLD_INFO_ONLY,
  (0x23 | LC_REQ_DYLD) => :LC_LOAD_UPWARD_DYLIB,
  0x24 => :LC_VERSION_MIN_MACOSX,
  0x25 => :LC_VERSION_MIN_IPHONEOS,
  0x26 => :LC_FUNCTION_STARTS,
  0x27 => :LC_DYLD_ENVIRONMENT,
  (0x28 | LC_REQ_DYLD) => :LC_MAIN,
  0x29 => :LC_DATA_IN_CODE,
  0x2a => :LC_SOURCE_VERSION,
  0x2b => :LC_DYLIB_CODE_SIGN_DRS,
  0x2c => :LC_ENCRYPTION_INFO_64,
  0x2d => :LC_LINKER_OPTION,
  0x2e => :LC_LINKER_OPTIMIZATION_HINT,
  0x2f => :LC_VERSION_MIN_TVOS,
  0x30 => :LC_VERSION_MIN_WATCHOS,
}.freeze
LOAD_COMMAND_CONSTANTS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of symbol representations to load command constants

LOAD_COMMANDS.invert.freeze
DYLIB_LOAD_COMMANDS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

load commands responsible for loading dylibs

[
  :LC_LOAD_DYLIB,
  :LC_LOAD_WEAK_DYLIB,
  :LC_REEXPORT_DYLIB,
  :LC_LAZY_LOAD_DYLIB,
  :LC_LOAD_UPWARD_DYLIB,
].freeze
CREATABLE_LOAD_COMMANDS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

load commands that can be created manually via LoadCommand.create

DYLIB_LOAD_COMMANDS + [
  :LC_ID_DYLIB,
  :LC_RPATH,
  :LC_LOAD_DYLINKER,
].freeze
LC_STRUCTURES =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of load command symbols to string representations of classes

{
  :LC_SEGMENT => "SegmentCommand",
  :LC_SYMTAB => "SymtabCommand",
  :LC_SYMSEG => "SymsegCommand", # obsolete
  :LC_THREAD => "ThreadCommand", # seems obsolete, but not documented as such
  :LC_UNIXTHREAD => "ThreadCommand",
  :LC_LOADFVMLIB => "FvmlibCommand", # obsolete
  :LC_IDFVMLIB => "FvmlibCommand", # obsolete
  :LC_IDENT => "IdentCommand", # obsolete
  :LC_FVMFILE => "FvmfileCommand", # reserved for internal use only
  :LC_PREPAGE => "LoadCommand", # reserved for internal use only, no public struct
  :LC_DYSYMTAB => "DysymtabCommand",
  :LC_LOAD_DYLIB => "DylibCommand",
  :LC_ID_DYLIB => "DylibCommand",
  :LC_LOAD_DYLINKER => "DylinkerCommand",
  :LC_ID_DYLINKER => "DylinkerCommand",
  :LC_PREBOUND_DYLIB => "PreboundDylibCommand",
  :LC_ROUTINES => "RoutinesCommand",
  :LC_SUB_FRAMEWORK => "SubFrameworkCommand",
  :LC_SUB_UMBRELLA => "SubUmbrellaCommand",
  :LC_SUB_CLIENT => "SubClientCommand",
  :LC_SUB_LIBRARY => "SubLibraryCommand",
  :LC_TWOLEVEL_HINTS => "TwolevelHintsCommand",
  :LC_PREBIND_CKSUM => "PrebindCksumCommand",
  :LC_LOAD_WEAK_DYLIB => "DylibCommand",
  :LC_SEGMENT_64 => "SegmentCommand64",
  :LC_ROUTINES_64 => "RoutinesCommand64",
  :LC_UUID => "UUIDCommand",
  :LC_RPATH => "RpathCommand",
  :LC_CODE_SIGNATURE => "LinkeditDataCommand",
  :LC_SEGMENT_SPLIT_INFO => "LinkeditDataCommand",
  :LC_REEXPORT_DYLIB => "DylibCommand",
  :LC_LAZY_LOAD_DYLIB => "DylibCommand",
  :LC_ENCRYPTION_INFO => "EncryptionInfoCommand",
  :LC_DYLD_INFO => "DyldInfoCommand",
  :LC_DYLD_INFO_ONLY => "DyldInfoCommand",
  :LC_LOAD_UPWARD_DYLIB => "DylibCommand",
  :LC_VERSION_MIN_MACOSX => "VersionMinCommand",
  :LC_VERSION_MIN_IPHONEOS => "VersionMinCommand",
  :LC_FUNCTION_STARTS => "LinkeditDataCommand",
  :LC_DYLD_ENVIRONMENT => "DylinkerCommand",
  :LC_MAIN => "EntryPointCommand",
  :LC_DATA_IN_CODE => "LinkeditDataCommand",
  :LC_SOURCE_VERSION => "SourceVersionCommand",
  :LC_DYLIB_CODE_SIGN_DRS => "LinkeditDataCommand",
  :LC_ENCRYPTION_INFO_64 => "EncryptionInfoCommand64",
  :LC_LINKER_OPTION => "LinkerOptionCommand",
  :LC_LINKER_OPTIMIZATION_HINT => "LinkeditDataCommand",
  :LC_VERSION_MIN_TVOS => "VersionMinCommand",
  :LC_VERSION_MIN_WATCHOS => "VersionMinCommand",
}.freeze
SEGMENT_NAMES =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of segment name symbols to names

{
  :SEG_PAGEZERO => "__PAGEZERO",
  :SEG_TEXT => "__TEXT",
  :SEG_DATA => "__DATA",
  :SEG_OBJC => "__OBJC",
  :SEG_ICON => "__ICON",
  :SEG_LINKEDIT => "__LINKEDIT",
  :SEG_UNIXSTACK => "__UNIXSTACK",
  :SEG_IMPORT => "__IMPORT",
}.freeze
SEGMENT_FLAGS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of segment flag symbols to values

{
  :SG_HIGHVM => 0x1,
  :SG_FVMLIB => 0x2,
  :SG_NORELOC => 0x4,
  :SG_PROTECTED_VERSION_1 => 0x8,
}.freeze

Class Method Summary collapse

Class Method Details

.open(filename) ⇒ MachO::MachOFile, MachO::FatFile

Opens the given filename as a MachOFile or FatFile, depending on its magic.

Parameters:

  • filename (String)

    the file being opened

Returns:

Raises:


9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
# File 'lib/macho/open.rb', line 9

def self.open(filename)
  raise ArgumentError.new("#{filename}: no such file") unless File.file?(filename)
  raise TruncatedFileError.new unless File.stat(filename).size >= 4

  magic = File.open(filename, "rb") { |f| f.read(4) }.unpack("N").first

  if Utils.fat_magic?(magic)
    file = FatFile.new(filename)
  elsif Utils.magic?(magic)
    file = MachOFile.new(filename)
  else
    raise MagicError.new(magic)
  end

  file
end