Difference between revisions of "Mach-O"
m (→__module_info) |
|||
Line 32: | Line 32: | ||
objc_module = packed record | objc_module = packed record | ||
− | version : culong; // version number | + | version : culong; // version number = 7 |
size : culong; // sizeof(objc_module)? | size : culong; // sizeof(objc_module)? | ||
name : PChar; // virtual memory address of the module name. | name : PChar; // virtual memory address of the module name. |
Revision as of 01:45, 28 August 2009
from Wikipedia:
Mach-O, short for Mach object file format, is a file format for executables, object code, shared libraries, dynamically-loaded code, and core dumps. A derivation of the a.out format, Mach-O offered more extensibility and faster access to information in the symbol table.
File Format Reference can be found here
Following tools are used in Mac OS X to view Mach-O files:
otool - object file displaying tool
nm - display name list (symbol table)
Objective-C segment
There're no documentation found over __OBJC segment and its sections. The following information has been gathered from cctools sources
Structures strings
Some structures in sections are containing name pointers. This names are stored in c-strings section (segment: __TEXT; section: __cstring). File offset for the string name can be evaluated in the following way:
string_file_offset := cstr_section.offset + (name_addr - cstr_section.addr);
Sections
__module_info
(objc_module record is declared at objc headers)
objc_module = packed record version : culong; // version number = 7 size : culong; // sizeof(objc_module)? name : PChar; // virtual memory address of the module name. _symtab : Symtab; end;
__image_info
The section contents image info information (8 bytes):
imageInfo = packed record version : uint32_t; flags : uint32_t; end;
Flags values:
F_and_C = $01; GC = $02; GC_only = $04;