Package ghidra.app.util.bin.format.macho.dyld

Class DyldCacheHeader

java.lang.Object
ghidra.app.util.bin.format.macho.dyld.DyldCacheHeader
All Implemented Interfaces:
StructConverter
public class DyldCacheHeader extends Object implements StructConverter
Represents a dyld_cache_header structure.
See Also:

  • Constructor Details

  • Method Details

    • parseFromFile

      public void parseFromFile(boolean parseLocalSymbols, MessageLog log, TaskMonitor monitor) throws CancelledException
      Parses the structures referenced by this DyldCacheHeader from a file.
      Parameters:
      parseLocalSymbols - True if local symbols should be parsed; otherwise, false
      log - The log
      monitor - A cancellable task monitor
      Throws:
      CancelledException - if the user cancelled the operation

    • parseFromMemory

      public void parseFromMemory(Program program, AddressSpace space, MessageLog log, TaskMonitor monitor) throws CancelledException
      Parses the structures referenced by this DyldCacheHeader from memory.
      Parameters:
      program - The Program whose memory to parse
      space - The Program's AddressSpace
      log - The log
      monitor - A cancellable task monitor
      Throws:
      CancelledException - if the user cancelled the operation

    • markup

      public void markup(Program program, boolean markupLocalSymbols, AddressSpace space, TaskMonitor monitor, MessageLog log) throws CancelledException
      Marks up this DyldCacheHeader with data structures and comments.
      Parameters:
      program - The Program to mark up
      markupLocalSymbols - True if the local symbols should be marked up; otherwise, false
      space - The Program's AddressSpace
      monitor - A cancellable task monitor
      log - The log
      Throws:
      CancelledException - if the user cancelled the operation

    • getMagic

      public byte[] getMagic()
      Returns the magic bytes, which contain version information.
      Returns:
      the magic bytes, which contain version information

    • getMappingOffset

      public int getMappingOffset()
      Returns the mapping offset.
      Returns:
      the mapping offset

    • getMappingCount

      public int getMappingCount()
      Returns the mapping count.
      Returns:
      the mapping count

    • getImagesOffsetOld

      public int getImagesOffsetOld()
      Returns the old images offset.
      Returns:
      the old images offset

    • getImagesCountOld

      public int getImagesCountOld()
      Returns the old images count.
      Returns:
      the old images count

    • getDyldBaseAddress

      public long getDyldBaseAddress()
      Returns the dyld base address.
      Returns:
      the dyld base address

    • getCodeSignatureOffset

      public long getCodeSignatureOffset()
      Returns the code signature offset.
      Returns:
      the code signature offset

    • getCodeSignatureSize

      public long getCodeSignatureSize()
      Returns the code signature size.
      Returns:
      the code signature size

    • getSlideInfoOffset

      public long getSlideInfoOffset()
      Returns the slide info offset.
      Returns:
      the slide info offset

    • getSlideInfoSize

      public long getSlideInfoSize()
      Returns the slide info size.
      Returns:
      the slide info size

    • getLocalSymbolsOffset

      public long getLocalSymbolsOffset()
      Returns the local symbols offset.
      Returns:
      the local symbols offset

    • getLocalSymbolsSize

      public long getLocalSymbolsSize()
      Returns the local symbols size.
      Returns:
      the local symbols size

    • getUUID

      public byte[] getUUID()
      Returns the UUID, or null if it is not defined.
      Returns:
      the UUID, or null if it is not defined

    • getCacheType

      public long getCacheType()
      Returns the cache type.
      Returns:
      the cache type

    • getBranchPoolsOffset

      public int getBranchPoolsOffset()
      Returns the branch pools offset.
      Returns:
      the branch pools offset

    • getBranchPoolsCount

      public int getBranchPoolsCount()
      Returns the branch pools count.
      Returns:
      the branch pools count

    • getAccelerateInfoAddrOrDyldInCacheMH

      public long getAccelerateInfoAddrOrDyldInCacheMH()
      Returns the old accelerate info address or new address of mach header in dyld cache, or null if it is not defined.
      Returns:
      the old accelerate info address or new address of mach header in dyld cache, or null if it is not defined

    • getAccelerateInfoSizeOrDyldInCacheEntry

      public long getAccelerateInfoSizeOrDyldInCacheEntry()
      Returns the old accelerate info size or new address of entry point in dyld cache, or null if it is not defined.
      Returns:
      the old accelerate info size or new address of entry point in dyld cache, or null if it is not defined

    • getImagesTextOffset

      public long getImagesTextOffset()
      Returns the images text offset.
      Returns:
      the images text offset

    • getImagesTextCount

      public long getImagesTextCount()
      Returns the images text count.
      Returns:
      the images text count

    • getPatchInfoAddr

      public long getPatchInfoAddr()
      Returns the patch info address.
      Returns:
      the patch info address

    • getPatchInfoSize

      public long getPatchInfoSize()
      Returns the patch info size.
      Returns:
      the patch info size

    • getOtherImageGroupAddrUnused

      public long getOtherImageGroupAddrUnused()
      Returns the other image group address (unused).
      Returns:
      the other image group address (unused)

    • getOtherImageGroupSizeUnused

      public long getOtherImageGroupSizeUnused()
      Returns the other image group size (unused).
      Returns:
      the other image group size (unused)

    • getProgClosuresAddr

      public long getProgClosuresAddr()
      Returns the program launch closures address.
      Returns:
      the program launch closures address

    • getProgClosuresSize

      public long getProgClosuresSize()
      Returns the program launch closures size.
      Returns:
      the program launch closures size

    • getProgClosuresTrieAddr

      public long getProgClosuresTrieAddr()
      Returns the program launch closures trie address.
      Returns:
      the program launch closures trie address

    • getProgClosuresTrieSize

      public long getProgClosuresTrieSize()
      Returns the program launch closures trie size.
      Returns:
      the program launch closures trie size

    • getPlatform

      public int getPlatform()
      Returns the platform.
      Returns:
      the platform

    • getDyldInfo

      public int getDyldInfo()
      Returns the dyld info.
      Returns:
      the dyld info

    • getFormatVersion

      public int getFormatVersion()
      Returns the format version.
      Returns:
      the format version

    • getDylibsExpectedOnDisk

      public boolean getDylibsExpectedOnDisk()
      Returns the dylibs expected on disk value.
      Returns:
      the dylibs expected on disk value

    • getSimulator

      public boolean getSimulator()
      Returns the simulator value.
      Returns:
      the simulator value

    • getLocallyBuildCache

      public boolean getLocallyBuildCache()
      Returns the locally built cache value.
      Returns:
      the locally built cache value

    • getBuiltFromChainedFixups

      public boolean getBuiltFromChainedFixups()
      Returns the built from chained fixups value.
      Returns:
      the built from chained fixups value

    • getSharedRegionStart

      public long getSharedRegionStart()
      Returns the shared region start.
      Returns:
      the shared region start

    • getSharedRegionSize

      public long getSharedRegionSize()
      Returns the shared region size.
      Returns:
      the shared region size

    • getMaxSlide

      public long getMaxSlide()
      Returns the max slide.
      Returns:
      the max slide

    • getDylibsImageArrayAddr

      public long getDylibsImageArrayAddr()
      Returns the dylibs image array address.
      Returns:
      the dylibs image array address

    • getDylibsImageArraySize

      public long getDylibsImageArraySize()
      Returns the dylibs image array size.
      Returns:
      the dylibs image array size

    • getDylibsTriAddr

      public long getDylibsTriAddr()
      Returns the dylibs trie address.
      Returns:
      the dylibs trie address

    • getDylibsTrieSize

      public long getDylibsTrieSize()
      Returns the dylibs trie size.
      Returns:
      the dylibs trie size

    • getOtherImageArrayAddr

      public long getOtherImageArrayAddr()
      Returns the other image array address.
      Returns:
      the other image array address

    • getOtherImageArraySize

      public long getOtherImageArraySize()
      Returns the other image array size.
      Returns:
      the other image array size

    • getOtherTriAddr

      public long getOtherTriAddr()
      Returns the other trie address.
      Returns:
      the other trie address

    • getOtherTrieSize

      public long getOtherTrieSize()
      Returns the other trie size.
      Returns:
      the other trie size

    • getMappingWithSlideOffset

      public int getMappingWithSlideOffset()
      Returns the mapping with slide offset.
      Returns:
      the mapping with slide offset

    • getMappingWithSlideCount

      public int getMappingWithSlideCount()
      Returns the mapping with slide count.
      Returns:
      the mapping with slide count

    • getDylibsPBLStateArrayAddrUnused

      public long getDylibsPBLStateArrayAddrUnused()
      Returns the dylibs PrebuildLoaderSet state array address (unused), or null if it is not defined.
      Returns:
      the dylibs PrebuildLoaderSet state array address (unused), or null if it is not defined

    • getDylibsPBLSetAddr

      public long getDylibsPBLSetAddr()
      Returns the dylibs PrebuildLoaderSet set address.
      Returns:
      the dylibs PrebuildLoaderSet set address

    • getProgramsPBLSetPoolAddr

      public long getProgramsPBLSetPoolAddr()
      Returns the programs PrebuildLoaderSet set pool address, or null if it is not defined.
      Returns:
      the programs PrebuildLoaderSet set pool address, or null if it is not defined

    • getProgramsPBLSetPoolSize

      public long getProgramsPBLSetPoolSize()
      Returns the programs PrebuildLoaderSet set pool size.
      Returns:
      the programs PrebuildLoaderSet set pool size

    • getProgramTrieAddr

      public long getProgramTrieAddr()
      Returns the program trie address.
      Returns:
      the program trie address

    • getProgramTrieSize

      public int getProgramTrieSize()
      Returns the program trie size.
      Returns:
      the program trie size

    • getOsVersion

      public int getOsVersion()
      Returns the OS version.
      Returns:
      the OS version

    • getAltPlatform

      public int getAltPlatform()
      Returns the alt platform.
      Returns:
      the alt platform

    • getAltOsVersion

      public int getAltOsVersion()
      Returns the alt OS version.
      Returns:
      the alt OS version

    • getSwiftOptsOffset

      public long getSwiftOptsOffset()
      Returns the swift opts offset.
      Returns:
      the swift opts offset

    • getSwiftOptsSize

      public long getSwiftOptsSize()
      Returns the swift opts size.
      Returns:
      the swift opts size

    • getSubCacheArrayOffset

      public int getSubCacheArrayOffset()
      Returns the subcache array offset.
      Returns:
      the subcache array offset

    • getSubCacheArrayCount

      public Integer getSubCacheArrayCount()
      Returns the subcache array count, or null if it is not defined.
      Returns:
      the subcache array count, or null if it is not defined

    • getSymbolFileUUID

      public byte[] getSymbolFileUUID()
      Returns the symbol file UUID, or null if it is not defined.
      Returns:
      the symbol file UUID, or null if it is not defined

    • getRosettaReadOnlyAddr

      public long getRosettaReadOnlyAddr()
      Returns the rosetta read-only address.
      Returns:
      the rosetta read-only address

    • getRosettaReadOnlySize

      public long getRosettaReadOnlySize()
      Returns the rosetta read-only size.
      Returns:
      the rosetta read-only size

    • getRosettaReadWriteAddr

      public long getRosettaReadWriteAddr()
      Returns the rosetta read-write address.
      Returns:
      the rosetta read-write address

    • getRosettaReadWriteSize

      public long getRosettaReadWriteSize()
      Returns the rosetta read-write size.
      Returns:
      the rosetta read-write size

    • getImagesOffset

      public int getImagesOffset()
      Returns the images offset.
      Returns:
      the images offset

    • getImagesCount

      public int getImagesCount()
      Returns the images count.
      Returns:
      the images count

    • getCacheSubType

      public Integer getCacheSubType()
      Returns the cache subtype, or null if it is not defined.
      Returns:
      the cache subtype, or null if it is not defined

    • getObjcOptsOffset

      public long getObjcOptsOffset()
      Returns the ObjC opts offset.
      Returns:
      the ObjC opts offset

    • getObjcOptsSize

      public long getObjcOptsSize()
      Returns the ObjC opts size.
      Returns:
      the ObjC opts size

    • getCacheAtlasOffset

      public long getCacheAtlasOffset()
      Returns the cache atlas offset.
      Returns:
      the cache atlas offset

    • getCacheAtlasSize

      public long getCacheAtlasSize()
      Returns the cache atlas size.
      Returns:
      the cache atlas size

    • getDynamicDataOffset

      public long getDynamicDataOffset()
      Returns the dynamic data offset.
      Returns:
      the dynamic data offset

    • getDynamicDataMaxSize

      public long getDynamicDataMaxSize()
      Returns the dynamic data max size.
      Returns:
      the dynamic data max size

    • getTproMappingsOffset

      public int getTproMappingsOffset()
      Returns the tpro mappings offset.
      Returns:
      the tpro mappings offset

    • getTproMappingsCount

      public int getTproMappingsCount()
      Returns the tpro mappings count.
      Returns:
      the tpro mappings count

    • getReader

      public BinaryReader getReader()
      Returns the reader associated with the header.
      Returns:
      the reader associated with the header

    • getBaseAddress

      public long getBaseAddress()
      Returns the base address of the DYLD cache.

      This is where the cache should be loaded in memory.

      Returns:
      the base address of the DYLD cache

    • getMappingInfos

      public List<DyldCacheMappingInfo> getMappingInfos()
      Gets the List of DyldCacheMappingInfos. Requires header to have been parsed.
      Returns:
      The List of DyldCacheMappingInfos

    • getMappedImages

      public List<DyldCacheImage> getMappedImages()
      Generates a List of DyldCacheImages that are mapped in by this DyldCacheHeader. Requires header to have been parsed.

      NOTE: A DYLD subcache header may declare an image, but that image may get loaded at an address defined by the memory map of a different subcache header. This method will only return the images that are mapped by "this" header's memory map.

      Returns:
      A List of DyldCacheImages mapped by this DyldCacheHeader

    • getSubcacheEntries

      public List<DyldSubcacheEntry> getSubcacheEntries()
      Gets the List of DyldSubcacheEntrys. Requires header to have been parsed.
      Returns:
      The List of DyldSubcacheEntrys

    • getCacheMappingAndSlideInfos

      public List<DyldCacheMappingAndSlideInfo> getCacheMappingAndSlideInfos()
      Gets the List of DyldCacheMappingAndSlideInfos. Requires header to have been parsed.
      Returns:
      The List of DyldCacheMappingAndSlideInfos

    • getLocalSymbolsInfo

      public DyldCacheLocalSymbolsInfo getLocalSymbolsInfo()
      Gets the DyldCacheLocalSymbolsInfo.
      Returns:
      The DyldCacheLocalSymbolsInfo. Could be null if it didn't parse.

    • getSlideInfos

      public List<DyldCacheSlideInfoCommon> getSlideInfos()
      Gets the List of DyldCacheSlideInfoCommons.
      Returns:
      the List of DyldCacheSlideInfoCommons.

    • getBranchPoolAddresses

      public List<Long> getBranchPoolAddresses()
      Gets the List of branch pool address. Requires header to have been parsed.
      Returns:
      The List of branch pool address

    • getArchitecture

      public DyldArchitecture getArchitecture()
      Gets architecture information.
      Returns:
      architecture information

    • toDataType

      public DataType toDataType() throws DuplicateNameException, IOException
      Description copied from interface: StructConverter
      Returns a structure datatype representing the contents of the implementor of this interface.

      For example, given: 

       class A {
     int foo;
     double bar;
 }

      The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

      Specified by:
      toDataType in interface StructConverter
      Returns:
      returns a structure datatype representing the implementor of this interface
      Throws:
      DuplicateNameException - when a datatype of the same name already exists
      IOException - if an IO-related error occurs
      See Also:

    • parseLocalSymbolsInfo

      public void parseLocalSymbolsInfo(boolean shouldParse, MessageLog log, TaskMonitor monitor) throws CancelledException
      Throws:
      CancelledException

    • setFileBlock

      public void setFileBlock(MemoryBlock block)
      Sets the MemoryBlock associated with this header's FILE block.
      Parameters:
      block - The MemoryBlock associated with this header's FILE block

    • hasSlideInfo

      public boolean hasSlideInfo()
      Checks to see if any slide info exists
      Returns:
      True if any slide info exists; otherwise, false

    • unslidLoadAddress

      public long unslidLoadAddress()
      Get the original unslid load address. This is found in the first mapping infos.
      Returns:
      the original unslid load address

    • isSubcache

      public boolean isSubcache()
      Checks to see whether or not this is a subcache
      Returns:
      True if this is a subcache; otherwise, false if it's a base cache

    • hasAccelerateInfo

      public boolean hasAccelerateInfo()
      Checks to see whether or not the old accelerate info fields are being used
      Returns:
      True if the old accelerate info fields are being used; otherwise, false if the new dyldInCache fields are being used