package object

  1. Overview
  2. Docs

Module MachoSource

MacOS Mach-O parser based on /usr/include/mach-o/* headers

Sourcetype magic =
  1. | MAGIC32
  2. | MAGIC64
  3. | CIGAM32
  4. | CIGAM64
    (*

    Magic numbers identifying the endianness and architecture of Mach-O files.

    • MAGIC32: 32-bit Mach-O file, native endianness
    • MAGIC64: 64-bit Mach-O file, native endianness
    • CIGAM32: 32-bit Mach-O file, swapped endianness
    • CIGAM64: 64-bit Mach-O file, swapped endianness
    *)
Sourceval string_of_magic : magic -> string

string_of_magic magic returns a human-readable string representation of the magic number for debugging and display purposes.

Sourcetype unknown = [
  1. | `Unknown of int
]

Represents unknown or unrecognized values with their raw integer representation.

Sourcetype cpu_type = [
  1. | `X86
  2. | `X86_64
  3. | `ARM
  4. | `ARM64
  5. | `ARM64_32
  6. | `POWERPC
  7. | `POWERPC64
  8. | unknown
]

CPU architectures supported by Mach-O binaries. Includes Intel x86/x64, ARM variants, PowerPC architectures, and a catch-all for unknown types.

Sourcetype cpu_subtype = [
  1. | `Intel
  2. | `I386_ALL
  3. | `I386
  4. | `I486
  5. | `I486SX
  6. | `PENT
  7. | `PENTPRO
  8. | `PENTII_M3
  9. | `PENTII_M5
  10. | `CELERON
  11. | `CELERON_MOBILE
  12. | `PENTIUM_3
  13. | `PENTIUM_3_M
  14. | `PENTIUM_3_XEON
  15. | `PENTIUM_M
  16. | `PENTIUM_4
  17. | `PENTIUM_4_M
  18. | `ITANIUM
  19. | `ITANIUM_2
  20. | `XEON
  21. | `XEON_MP
  22. | `INTEL_FAMILY
  23. | `INTEL_FAMILY_MAX
  24. | `INTEL_MODEL
  25. | `INTEL_MODEL_ALL
  26. | `X86_ALL
  27. | `X86_64_ALL
  28. | `X86_ARCH1
  29. | `POWERPC_ALL
  30. | `POWERPC_601
  31. | `POWERPC_602
  32. | `POWERPC_603
  33. | `POWERPC_603e
  34. | `POWERPC_603ev
  35. | `POWERPC_604
  36. | `POWERPC_604e
  37. | `POWERPC_620
  38. | `POWERPC_750
  39. | `POWERPC_7400
  40. | `POWERPC_7450
  41. | `POWERPC_970
  42. | `ARM_ALL
  43. | `ARM_V4T
  44. | `ARM_V6
  45. | `ARM_V5TEJ
  46. | `ARM_XSCALE
  47. | `ARM_V7
  48. | `ARM_V7F
  49. | `ARM_V7S
  50. | `ARM_V7K
  51. | `ARM_V8
  52. | unknown
]

CPU subtypes providing more specific processor identification within a CPU family. Includes various Intel processors, PowerPC variants, ARM versions, and unknown types.

Sourceval cpu_type_to_int : cpu_type -> int

cpu_type_to_int cpu_type converts a CPU type to its integer representation.

Sourceval cpu_type_to_string : cpu_type -> string

cpu_type_to_string cpu_type converts a CPU type to its string representation (e.g., "i386", "x86_64", "arm64").

Sourceval cpu_subtype_to_int : cpu_type -> cpu_subtype -> int

cpu_subtype_to_int cpu_type cpu_subtype converts a CPU subtype to its integer representation. The cpu_type is needed for context-dependent subtype values.

Sourcetype file_type = [
  1. | `OBJECT
  2. | `EXECUTE
  3. | `FVMLIB
  4. | `CORE
  5. | `PRELOAD
  6. | `DYLIB
  7. | `DYLINKER
  8. | `BUNDLE
  9. | `DYLIB_STUB
  10. | `DSYM
  11. | `KEXT_BUNDLE
  12. | `FILESET
  13. | `GPU_EXECUTE
  14. | `GPU_DYLIB
  15. | unknown
]

Types of Mach-O files, from relocatable object files to executables, dynamic libraries, bundles, and specialized types like GPU executables and file sets.

Sourcetype header_flag = [
  1. | `NOUNDEFS
  2. | `BINDATLOAD
  3. | `PREBOUND
  4. | `SPLIT_SEGS
  5. | `TWOLEVEL
  6. | `FORCE_FLAT
  7. | `NOMULTIDEFS
  8. | `NOFIXPREBINDING
  9. | `PREBINDABLE
  10. | `ALLMODSBOUND
  11. | `SUBSECTIONS_VIA_SYMBOLS
  12. | `CANONICAL
  13. | `WEAK_DEFINES
  14. | `BINDS_TO_WEAK
  15. | `ALLOW_STACK_EXECUTION
  16. | `ROOT_SAFE
  17. | `SETUID_SAFE
  18. | `NO_REEXPORTED_DYLIBS
  19. | `PIE
]

Flags in the Mach-O header indicating various linking and loading behaviors, such as undefined references, dynamic linking, prebinding, and security features.

Sourcetype header = {
  1. magic : magic;
  2. cpu_type : cpu_type;
  3. cpu_subtype : cpu_subtype;
  4. file_type : file_type;
  5. flags : header_flag list;
}

The Mach-O header containing essential information about the binary including endianness, architecture, file type, and various flags controlling linking behavior.

Sourcetype reloc_type = [
  1. | `GENERIC_RELOC_VANILLA
  2. | `GENERIC_RELOC_PAIR
  3. | `GENERIC_RELOC_SECTDIFF
  4. | `GENERIC_RELOC_LOCAL_SECTDIFF
  5. | `GENERIC_RELOC_PB_LA_PTR
  6. | `X86_64_RELOC_BRANCH
  7. | `X86_64_RELOC_GOT_LOAD
  8. | `X86_64_RELOC_GOT
  9. | `X86_64_RELOC_SIGNED
  10. | `X86_64_RELOC_UNSIGNED
  11. | `X86_64_RELOC_SUBTRACTOR
  12. | `X86_64_RELOC_SIGNED_1
  13. | `X86_64_RELOC_SIGNED_2
  14. | `X86_64_RELOC_SIGNED_4
  15. | `PPC_RELOC_VANILLA
  16. | `PPC_RELOC_PAIR
  17. | `PPC_RELOC_BR14
  18. | `PPC_RELOC_BR24
  19. | `PPC_RELOC_HI16
  20. | `PPC_RELOC_LO16
  21. | `PPC_RELOC_HA16
  22. | `PPC_RELOC_LO14
  23. | `PPC_RELOC_SECTDIFF
  24. | `PPC_RELOC_LOCAL_SECTDIFF
  25. | `PPC_RELOC_PB_LA_PTR
  26. | `PPC_RELOC_HI16_SECTDIFF
  27. | `PPC_RELOC_LO16_SECTDIFF
  28. | `PPC_RELOC_HA16_SECTDIFF
  29. | `PPC_RELOC_JBSR
  30. | `PPC_RELOC_LO14_SECTDIFF
  31. | unknown
]

Relocation types for different architectures (generic, x86-64, PowerPC) indicating how addresses should be modified during linking and loading.

Sourcetype relocation_info = {
  1. ri_address : int;
    (*

    Offset from start of section to place to be relocated

    *)
  2. ri_symbolnum : Object_types.u32;
    (*

    Index into symbol or section table

    *)
  3. ri_pcrel : bool;
    (*

    Indicates if the item to be relocated is part of an instruction containing PC-relative addressing

    *)
  4. ri_length : Object_types.u32;
    (*

    Length of item containing address to be relocated (literal form (4) instead of power of two (2))

    *)
  5. ri_extern : bool;
    (*

    Indicates whether symbolnum is an index into the symbol table (true) or section table (false)

    *)
  6. ri_type : reloc_type;
    (*

    Relocation type

    *)
}

Information needed to relocate addresses during linking. Contains the location to be relocated, the symbol or section it references, and how the relocation should be performed.

Sourcetype scattered_relocation_info = {
  1. rs_pcrel : bool;
    (*

    Indicates if the item to be relocated is part of an instruction containing PC-relative addressing

    *)
  2. rs_length : Object_types.u32;
    (*

    Length of item containing address to be relocated (literal form (4) instead of power of two (2))

    *)
  3. rs_type : reloc_type;
    (*

    Relocation type

    *)
  4. rs_address : Object_types.u32;
    (*

    Offset from start of section to place to be relocated

    *)
  5. rs_value : Object_types.s32;
    (*

    Address of the relocatable expression for the item in the file that needs to be updated if the address is changed

    *)
}

Scattered relocation information used when the relocation cannot be described by a simple symbol or section reference. Contains the actual address value and relocation details.

Sourcetype relocation = [
  1. | `Relocation_info of relocation_info
  2. | `Scattered_relocation_info of scattered_relocation_info
]

Union type representing either a standard or scattered relocation entry. Standard relocations reference symbols or sections by index, while scattered relocations contain literal addresses.

Sourcetype sec_type = [
  1. | `S_REGULAR
    (*

    Regular section

    *)
  2. | `S_ZEROFILL
    (*

    Zero fill on demand section

    *)
  3. | `S_CSTRING_LITERALS
    (*

    Section with only literal C strings

    *)
  4. | `S_4BYTE_LITERALS
    (*

    Section with only 4 byte literals

    *)
  5. | `S_8BYTE_LITERALS
    (*

    Section with only 8 byte literals

    *)
  6. | `S_LITERAL_POINTERS
    (*

    Section with only pointers to literals

    *)
  7. | `S_NON_LAZY_SYMBOL_POINTERS
    (*

    Section with only non-lazy symbol pointers

    *)
  8. | `S_LAZY_SYMBOL_POINTERS
    (*

    Section with only lazy symbol pointers

    *)
  9. | `S_SYMBOL_STUBS
    (*

    Section with only symbol stubs, byte size of stub in the reserved2 field

    *)
  10. | `S_MOD_INIT_FUNC_POINTERS
    (*

    Section with only function pointers for initialization

    *)
  11. | `S_MOD_TERM_FUNC_POINTERS
    (*

    Section with only function pointers for termination

    *)
  12. | `S_COALESCED
    (*

    Section contains symbols that are to be coalesced

    *)
  13. | `S_GB_ZEROFILL
    (*

    Zero fill on demand section (that can be larger than 4 gigabytes)

    *)
  14. | `S_INTERPOSING
    (*

    Section with only pairs of function pointers for interposing

    *)
  15. | `S_16BYTE_LITERALS
    (*

    Section with only 16 byte literals

    *)
  16. | `S_DTRACE_DOF
    (*

    Section contains DTrace Object Format

    *)
  17. | `S_LAZY_DYLIB_SYMBOL_POINTERS
    (*

    Section with only lazy symbol pointers to lazy loaded dylibs

    *)
  18. | unknown
]

Section types indicating the content and purpose of a section within a segment. Each type defines how the section data should be interpreted and used by the linker and loader.

Sourcetype sec_user_attr = [
  1. | `PURE_INSTRUCTIONS
    (*

    Section contains only true machine instructions

    *)
  2. | `NO_TOC
    (*

    Section contains coalesced symbols that are not to be in a ranlib table of contents

    *)
  3. | `STRIP_STATIC_SYMS
    (*

    OK to strip static symbols in this section in files with the MH_DYLDLINK flag

    *)
  4. | `NO_DEAD_STRIP
    (*

    No dead stripping

    *)
  5. | `LIVE_SUPPORT
    (*

    Blocks are live if they reference live blocks

    *)
  6. | `SELF_MODIFYING_CODE
    (*

    Used with i386 code stubs written on by dyld

    *)
  7. | `DEBUG
    (*

    A debug section

    *)
]

User-defined section attributes controlling how sections are treated during linking and optimization processes.

Sourcetype sec_sys_attr = [
  1. | `SOME_INSTRUCTIONS
    (*

    Section contains some machine instructions

    *)
  2. | `EXT_RELOC
    (*

    Section has external relocation entries

    *)
  3. | `LOC_RELOC
    (*

    Section has local relocation entries

    *)
]

System-defined section attributes indicating relocation and instruction content.

Sourcetype section = {
  1. sec_sectname : string;
    (*

    Name of section

    *)
  2. sec_segname : string;
    (*

    Name of segment that should own this section

    *)
  3. sec_addr : Object_types.u64;
    (*

    Virtual memory address for section

    *)
  4. sec_size : Object_types.u64;
    (*

    Size of section

    *)
  5. sec_offset : Object_types.u32;
    (*

    File offset of section

    *)
  6. sec_align : int;
    (*

    Alignment required by section (literal form, not power of two, e.g. 8 not 3)

    *)
  7. sec_relocs : relocation array;
    (*

    Relocations for this section

    *)
  8. sec_type : sec_type;
    (*

    Type of section

    *)
  9. sec_user_attrs : sec_user_attr list;
    (*

    User attributes of section

    *)
  10. sec_sys_attrs : sec_sys_attr list;
    (*

    System attributes of section

    *)
  11. sec_reserved1 : Object_types.u32;
    (*

    Reserved field 1

    *)
  12. sec_reserved2 : Object_types.u32;
    (*

    Reserved field 2

    *)
}

A section within a segment, containing code or data with specific attributes and relocations. Sections are the finest granularity of organization within Mach-O files.

Sourceval sec_type_to_int : sec_type -> int

sec_type_to_int sec_type converts a section type to its integer representation as used in Mach-O section headers.

Sourceval sec_user_attrs_to_int : sec_user_attr list -> int

sec_user_attrs_to_int attrs converts section user attributes to their combined integer representation.

Sourceval sec_sys_attrs_to_int : sec_sys_attr list -> int

sec_sys_attrs_to_int attrs converts section system attributes to their combined integer representation.

Sourcetype vm_prot = [
  1. | `READ
  2. | `WRITE
  3. | `EXECUTE
]

Virtual memory protection flags controlling access permissions for segments and sections.

Sourcetype seg_flag = [
  1. | `HIGHVM
  2. | `NORELOC
  3. | `FVMLIB
  4. | `PROTECTED_VERSION_1
  5. | `READ_ONLY
]

Segment flags controlling special handling of segment contents and relocations.

Sourcetype segment = {
  1. seg_segname : string;
    (*

    Segment name

    *)
  2. seg_vmaddr : Object_types.u64;
    (*

    Virtual address where the segment is loaded

    *)
  3. seg_vmsize : Object_types.u64;
    (*

    Size of segment at runtime

    *)
  4. seg_fileoff : Object_types.u64;
    (*

    File offset of the segment

    *)
  5. seg_filesize : Object_types.u64;
    (*

    Size of segment in file

    *)
  6. seg_maxprot : vm_prot list;
    (*

    Maximum virtual memory protection

    *)
  7. seg_initprot : vm_prot list;
    (*

    Initial virtual memory protection

    *)
  8. seg_flags : seg_flag list;
    (*

    Segment flags

    *)
  9. seg_sections : section array;
    (*

    Sections owned by this segment

    *)
}

A segment containing one or more sections, representing a contiguous range of virtual memory that is mapped from the file during loading. Segments define memory protection and layout.

Sourceval vm_prot_to_int : vm_prot list -> int

vm_prot_to_int prots converts virtual memory protection flags to their combined integer representation.

Sourceval seg_flags_to_int : seg_flag list -> int

seg_flags_to_int flags converts segment flags to their combined integer representation.

Sourcetype sym_type = [
  1. | `UNDF
  2. | `ABS
  3. | `SECT
  4. | `PBUD
  5. | `INDR
  6. | `GSYM
  7. | `FNAME
  8. | `FUN
  9. | `STSYM
  10. | `LCSYM
  11. | `BNSYM
  12. | `OPT
  13. | `RSYM
  14. | `SLINE
  15. | `ENSYM
  16. | `SSYM
  17. | `SO
  18. | `OSO
  19. | `LSYM
  20. | `BINCL
  21. | `SOL
  22. | `PARAMS
  23. | `VERSION
  24. | `OLEVEL
  25. | `PSYM
  26. | `EINCL
  27. | `ENTRY
  28. | `LBRAC
  29. | `EXCL
  30. | `RBRAC
  31. | `BCOMM
  32. | `ECOMM
  33. | `ECOML
  34. | `LENG
  35. | `PC
  36. | unknown
]

Symbol types including regular symbols (UNDF, ABS, SECT) and STAB debug symbols. STAB symbols provide debugging information like source file names, line numbers, and local variable information used by debuggers.

Sourcetype reference_flag = [
  1. | `UNDEFINED_NON_LAZY
  2. | `UNDEFINED_LAZY
  3. | `DEFINED
  4. | `PRIVATE_DEFINED
  5. | `PRIVATE_UNDEFINED_NON_LAZY
  6. | `PRIVATE_UNDEFINED_LAZY
  7. | `REFERENCED_DYNAMICALLY
  8. | `SYM_WEAK_REF
  9. | `SYM_WEAK_DEF
  10. | `LIBRARY_ORDINAL of Object_types.u16
  11. | unknown
]

Reference flags indicating how symbols are bound and resolved during linking. Controls symbol visibility, weak binding, and library ordinals for two-level namespaces.

Sourcetype symbol = {
  1. sym_name : string;
    (*

    Symbol name

    *)
  2. sym_type : sym_type;
    (*

    Symbol type

    *)
  3. sym_pext : bool;
    (*

    True if limited global scope

    *)
  4. sym_ext : bool;
    (*

    True if external symbol

    *)
  5. sym_sect : Object_types.u8;
    (*

    Section index where the symbol can be found

    *)
  6. sym_flags : [ `Uninterpreted of Object_types.u16 | `Flags of reference_flag list ];
    (*

    For stab entries, uninterpreted flags field; otherwise reference flags

    *)
  7. sym_value : Object_types.u64;
    (*

    Symbol value, 32-bit symbol values are promoted to 64-bit for simplicity

    *)
}

A symbol table entry representing a named location in code or data. Symbols can be functions, variables, or debugging information, and may reference external libraries.

Sourcetype dylib_module = {
  1. dylib_module_name_offset : Object_types.u32;
    (*

    Module name string table offset

    *)
  2. dylib_ext_def_sym : Object_types.u32 * Object_types.u32;
    (*

    (initial, count) pair of symbol table indices for externally defined symbols

    *)
  3. dylib_ref_sym : Object_types.u32 * Object_types.u32;
    (*

    (initial, count) pair of symbol table indices for referenced symbols

    *)
  4. dylib_local_sym : Object_types.u32 * Object_types.u32;
    (*

    (initial, count) pair of symbol table indices for local symbols

    *)
  5. dylib_ext_rel : Object_types.u32 * Object_types.u32;
    (*

    (initial, count) pair of symbol table indices for externally referenced symbols

    *)
  6. dylib_init : Object_types.u32 * Object_types.u32;
    (*

    (initial, count) pair of symbol table indices for the index of the module init section and the number of init pointers

    *)
  7. dylib_term : Object_types.u32 * Object_types.u32;
    (*

    (initial, count) pair of symbol table indices for the index of the module term section and the number of term pointers

    *)
  8. dylib_objc_module_info_addr : Object_types.u32;
    (*

    Statically linked address of the start of the data for this module in the __module_info section in the __OBJC segment

    *)
  9. dylib_objc_module_info_size : Object_types.u64;
    (*

    Number of bytes of data for this module that are used in the __module_info section in the __OBJC segment

    *)
}

Module information for dynamic libraries, containing indices into various symbol tables and initialization/termination routines.

Sourcetype toc_entry = {
  1. symbol_index : Object_types.u32;
    (*

    Index into symbol table

    *)
  2. module_index : Object_types.u32;
    (*

    Index into module table

    *)
}

Table of contents entry mapping symbols to their defining modules.

Sourcetype symbol_table = {
  1. symoff : Object_types.u32;
    (*

    Symbol table offset

    *)
  2. nsyms : Object_types.u32;
    (*

    Number of symbols

    *)
  3. stroff : Object_types.u32;
    (*

    String table offset

    *)
  4. strsize : Object_types.u32;
    (*

    String table size

    *)
  5. symbols : symbol array;
    (*

    Parsed symbols

    *)
  6. strings : Buffer.t;
    (*

    String table buffer

    *)
}

Symbol table command containing symbol and string table information.

Sourcetype dynamic_symbol_table = {
  1. ilocalsym : Object_types.u32;
    (*

    Index of first local symbol

    *)
  2. nlocalsym : Object_types.u32;
    (*

    Number of local symbols

    *)
  3. iextdefsym : Object_types.u32;
    (*

    Index of first external defined symbol

    *)
  4. nextdefsym : Object_types.u32;
    (*

    Number of external defined symbols

    *)
  5. iundefsym : Object_types.u32;
    (*

    Index of first undefined symbol

    *)
  6. nundefsym : Object_types.u32;
    (*

    Number of undefined symbols

    *)
  7. tocoff : Object_types.u32;
    (*

    Table of contents offset

    *)
  8. ntoc : Object_types.u32;
    (*

    Number of table of contents entries

    *)
  9. modtaboff : Object_types.u32;
    (*

    Module table offset

    *)
  10. nmodtab : Object_types.u32;
    (*

    Number of module table entries

    *)
  11. extrefsymoff : Object_types.u32;
    (*

    External reference symbol table offset

    *)
  12. nextrefsyms : Object_types.u32;
    (*

    Number of external reference symbols

    *)
  13. indirectsymoff : Object_types.u32;
    (*

    Indirect symbol table offset

    *)
  14. nindirectsyms : Object_types.u32;
    (*

    Number of indirect symbols

    *)
  15. extreloff : Object_types.u32;
    (*

    External relocation table offset

    *)
  16. nextrel : Object_types.u32;
    (*

    Number of external relocations

    *)
  17. locreloff : Object_types.u32;
    (*

    Local relocation table offset

    *)
  18. nlocrel : Object_types.u32;
    (*

    Number of local relocations

    *)
  19. toc_entries : toc_entry array;
    (*

    Parsed table of contents entries

    *)
  20. modules : dylib_module array;
    (*

    Parsed modules

    *)
  21. ext_ref_syms : Object_types.u32 array;
    (*

    Parsed external reference symbols

    *)
  22. indirect_syms : Object_types.u32 array;
    (*

    Parsed indirect symbols

    *)
  23. ext_rels : relocation array;
    (*

    Parsed external relocations

    *)
  24. loc_rels : relocation array;
    (*

    Parsed local relocations

    *)
}

Dynamic symbol table containing information needed for dynamic linking, including symbol organization and relocation data.

Sourcetype dylib = {
  1. dylib_name : string;
    (*

    Name of the dynamic library

    *)
  2. dylib_timestamp : Object_types.u32;
    (*

    Time when the library was built

    *)
  3. dylib_current_version : Object_types.u32;
    (*

    Current version of the library

    *)
  4. dylib_compatibility_version : Object_types.u32;
    (*

    Oldest version this library is compatible with

    *)
}

Dynamic library information including name and version details.

Sourcetype build_tool = {
  1. tool : Object_types.u32;
  2. version : Object_types.u32;
}

Build tool information including tool type and version.

Sourcetype build_version_info = {
  1. platform : Object_types.u32;
    (*

    Target platform

    *)
  2. minos : Object_types.u32;
    (*

    Minimum OS version

    *)
  3. sdk : Object_types.u32;
    (*

    SDK version used to build

    *)
  4. tools : build_tool array;
    (*

    Build tools used

    *)
}

Build version information for the binary.

Sourcetype command =
  1. | LC_SEGMENT_32 of segment lazy_t
  2. | LC_SYMTAB of symbol_table lazy_t
  3. | LC_THREAD of (Object_types.u32 * Object_types.u32 array) list lazy_t
  4. | LC_UNIXTHREAD of (Object_types.u32 * Object_types.u32 array) list lazy_t
  5. | LC_DYSYMTAB of dynamic_symbol_table lazy_t
  6. | LC_LOAD_DYLIB of dylib lazy_t
  7. | LC_ID_DYLIB of dylib lazy_t
  8. | LC_LOAD_DYLINKER of string
  9. | LC_ID_DYLINKER of string
  10. | LC_PREBOUND_DYLIB of (string * Object_types.u8 array) lazy_t
  11. | LC_ROUTINES_32 of Object_types.u32 * Object_types.u32
  12. | LC_SUB_FRAMEWORK of string
  13. | LC_SUB_UMBRELLA of string
  14. | LC_SUB_CLIENT of string
  15. | LC_SUB_LIBRARY of string
  16. | LC_TWOLEVEL_HINTS of (Object_types.u32 * Object_types.u32) array lazy_t
  17. | LC_PREBIND_CKSUM of Object_types.u32
  18. | LC_LOAD_WEAK_DYLIB of dylib lazy_t
  19. | LC_SEGMENT_64 of segment lazy_t
  20. | LC_ROUTINES_64 of Object_types.u64 * Object_types.u64
  21. | LC_UUID of string
  22. | LC_RPATH of string
  23. | LC_CODE_SIGNATURE of Object_types.u32 * Object_types.u32
  24. | LC_SEGMENT_SPLIT_INFO of Object_types.u32 * Object_types.u32
  25. | LC_MAIN of Object_types.u64 * Object_types.u64
  26. | LC_SOURCE_VERSION of Object_types.u64
  27. | LC_BUILD_VERSION of build_version_info lazy_t
  28. | LC_FUNCTION_STARTS of Object_types.u32 * Object_types.u32
  29. | LC_DATA_IN_CODE of Object_types.u32 * Object_types.u32
  30. | LC_DYLD_EXPORTS_TRIE of Object_types.u32 * Object_types.u32
  31. | LC_DYLD_CHAINED_FIXUPS of Object_types.u32 * Object_types.u32
  32. | LC_UNHANDLED of int * Buffer.t

Load commands instruct the dynamic linker how to set up the process from the Mach-O file. Commands specify segments to load, libraries to link, symbols to resolve, and other setup tasks. Each command contains specific data relevant to its operation.

Sourceval command_name : command -> string

command_name cmd returns the load command name as a string (e.g., "LC_SEGMENT_64", "LC_SYMTAB").

Sourceval read_symbol_table : header -> Buffer.t -> Buffer.cursor -> symbol_table

read_symbol_table header buffer cursor reads the symbol table from a Mach-O LC_SYMTAB load command. Returns a symbol_table record with all symbol and string table buffer. The cursor should be positioned at the start of the symbol table command data (after the standard load command header).

  • parameter header

    The Mach-O header containing architecture information

  • parameter buffer

    The complete Mach-O file buffer

  • parameter cursor

    Buffer cursor positioned at symbol table command data

  • returns

    Tuple of (symbol array, string table buffer)

Sourceval read_load_command : header -> Buffer.t -> Buffer.cursor -> command

read_load_command header buffer cursor reads a single load command from the Mach-O file. The cursor should be positioned at the start of a load command (at the cmd field).

  • parameter header

    The Mach-O header containing architecture information

  • parameter buffer

    The complete Mach-O file buffer

  • parameter cursor

    Buffer cursor positioned at load command start

  • returns

    The parsed load command structure

Sourceval read_load_commands : header -> Buffer.t -> Buffer.cursor -> command list

read_load_commands header buffer cursor reads all remaining load commands from the current cursor position until the end of the load commands region.

  • parameter header

    The Mach-O header containing architecture information

  • parameter buffer

    The complete Mach-O file buffer

  • parameter cursor

    Buffer cursor positioned at start of load commands

  • returns

    List of all parsed load command structures

Sourceval read : Buffer.t -> header * command list

read decodes the header and load command list, from a Buffer.t pointing to a MachO image

Sourceval section_body : Buffer.t -> section -> Buffer.t

section_body macho section returns a sub-buffer with the contents of the section of the MachO image in Buffer.t.

Sourceval get_section_contents : Buffer.t -> string -> Buffer.t option

get_section_contents buffer section_name searches for a section with the given section_name in the Mach-O file and returns its contents as a buffer. Returns None if the section is not found.

FAT/Universal Binary Support

Sourcetype fat_magic =
  1. | FAT_MAGIC
  2. | FAT_CIGAM
  3. | FAT_MAGIC_64
  4. | FAT_CIGAM_64
    (*

    Magic numbers for FAT/Universal binaries.

    • FAT_MAGIC: 32-bit FAT binary, big-endian (0xcafebabe)
    • FAT_CIGAM: 32-bit FAT binary, byte-swapped (0xbebafeca)
    • FAT_MAGIC_64: 64-bit FAT binary, big-endian (0xcafebabf)
    • FAT_CIGAM_64: 64-bit FAT binary, byte-swapped (0xbfbafeca)
    *)
Sourceval fat_magic_to_int : fat_magic -> int

Convert a fat_magic value to its integer representation.

Sourcetype fat_arch = {
  1. fa_cputype : cpu_type;
    (*

    CPU type

    *)
  2. fa_cpusubtype : cpu_subtype;
    (*

    CPU subtype

    *)
  3. fa_offset : Object_types.u32;
    (*

    File offset to this architecture's Mach-O

    *)
  4. fa_size : Object_types.u32;
    (*

    Size of this architecture's Mach-O

    *)
  5. fa_align : Object_types.u32;
    (*

    Alignment as a power of 2

    *)
}

Architecture descriptor for 32-bit FAT binaries. Describes the location and size of a single architecture's Mach-O binary within the FAT file.

Sourcetype fat_arch_64 = {
  1. fa64_cputype : cpu_type;
    (*

    CPU type

    *)
  2. fa64_cpusubtype : cpu_subtype;
    (*

    CPU subtype

    *)
  3. fa64_offset : Object_types.u64;
    (*

    File offset to this architecture's Mach-O

    *)
  4. fa64_size : Object_types.u64;
    (*

    Size of this architecture's Mach-O

    *)
  5. fa64_align : Object_types.u32;
    (*

    Alignment as a power of 2

    *)
  6. fa64_reserved : Object_types.u32;
    (*

    Reserved, must be 0

    *)
}

Architecture descriptor for 64-bit FAT binaries. Used when offsets or sizes exceed 4GB (2^32 bytes).

Sourcetype fat_arch_any = [
  1. | `Fat_arch of fat_arch
  2. | `Fat_arch_64 of fat_arch_64
]

Union type for either 32-bit or 64-bit FAT architecture descriptor.

Sourcetype fat_header = {
  1. fat_magic : fat_magic;
    (*

    Magic number identifying FAT format

    *)
  2. fat_archs : fat_arch_any array;
    (*

    Array of architecture descriptors

    *)
}

FAT binary header containing magic number and all architecture descriptors. FAT binaries are always stored in big-endian format.

Sourceval is_fat : Buffer.t -> bool

is_fat buffer checks if the buffer contains a FAT/Universal binary by examining the magic number at the beginning of the buffer.

Sourceval read_fat : Buffer.t -> fat_header

read_fat buffer parses a FAT binary header from the buffer. The buffer must point to the start of a FAT binary. Handles both 32-bit and 64-bit FAT formats and performs byte-swapping if needed (FAT is always big-endian).

  • raises Buffer.Invalid_format

    if the buffer is not a valid FAT binary

Sourceval extract_arch : Buffer.t -> fat_arch_any -> Buffer.t

extract_arch buffer arch extracts a single architecture's Mach-O binary from a FAT binary as a sub-buffer. The returned buffer can be passed to read to parse the Mach-O contents.

  • parameter buffer

    The complete FAT binary buffer

  • parameter arch

    The architecture descriptor to extract

  • returns

    A sub-buffer containing just that architecture's Mach-O binary

Sourceval arch_name : fat_arch_any -> string

arch_name arch returns the architecture name as a string (e.g. "x86_64", "arm64", "arm64e"). Handles special cases like ARM64E (subtype 2).

  • parameter arch

    The architecture descriptor

  • returns

    Architecture name string

Sourceval find_arch : fat_header -> string -> fat_arch_any option

find_arch fat_header arch_name searches for an architecture by name in the FAT header.

  • parameter fat_header

    The FAT header to search

  • parameter arch_name

    The architecture name to find (e.g. "x86_64", "arm64e")

  • returns

    Some arch if found, None otherwise

Sourceval extract_arch_by_name : Buffer.t -> string -> Buffer.t option

extract_arch_by_name buffer arch_name extracts a single architecture's Mach-O binary by name from a FAT binary. Convenience function combining read_fat, find_arch, and extract_arch.

  • parameter buffer

    The complete FAT binary buffer

  • parameter arch_name

    The architecture name to extract

  • returns

    Some sub-buffer if architecture found, None otherwise

FAT Binary Validation

Sourcetype fat_validation_error =
  1. | Overlap of int * int * int * int
    (*

    Architecture overlap: (offset1, size1, offset2, size2)

    *)
  2. | Invalid_alignment of string * int * int
    (*

    Invalid alignment: (arch_name, offset, align)

    *)
  3. | Out_of_bounds of string * int * int * int
    (*

    Out of bounds: (arch_name, offset, size, buffer_size)

    *)
  4. | Invalid_arch_count of int
    (*

    Invalid architecture count

    *)
Sourceval validate_fat : Buffer.t -> (unit, fat_validation_error list) result

validate_fat buffer validates a FAT binary for correctness. Checks for overlapping architectures, proper alignment, and bounds.

  • parameter buffer

    The FAT binary buffer to validate

  • returns

    Ok () if valid, Error list of validation errors otherwise