mach-o格式分析

拼搏现实的明天。 2022-07-18 04:09 242阅读 0赞

文章出处：[http://turingh.github.io/2016/03/07/mach-o%E6%96%87%E4%BB%B6%E6%A0%BC%E5%BC%8F%E5%88%86%E6%9E%90/][http_turingh.github.io_2016_03_07_mach-o_E6_96_87_E4_BB_B6_E6_A0_BC_E5_BC_8F_E5_88_86_E6_9E_90]

`mach-o`格式是OS X系统上的可执行文件格式，类似于windows的`PE`与linux的`ELF`，如果不彻底搞清楚`mach-o`的格式与相关知识，去做其他研究，无异于建造空中阁楼。

每个Mach-O文件斗包含一个Mach-O头，然后是载入命令(Load Commands),最后是数据块(Data)。

接下来就对整个Mach-O的格式做出详细的分析。

# 0x01 Mach-O格式简单介绍 #

Mach-O文件的格式如下图所示：

[![Mach-O][]][Mach-O]

又如下几个部分组成：

*  Header：保存了Mach-O的一些基本信息，包括了平台、文件类型、LoadCommands的个数等等。
 *  LoadCommands：这一段紧跟Header，加载Mach-O文件时会使用这里的数据来确定内存的分布。
 *  Data：每一个segment的具体数据都保存在这里，这里包含了具体的代码、数据等等。

# 0x02 Headers #

## 2.1 数据结构 ##

Headers的定义可以在开源的内核代码中找到。

根据`mach_header`与`mach_header_64`的定义，很明显可以看出，Headers的主要作用就是帮助系统迅速的定位Mach-O文件的运行环境，文件类型。

[![Header][]][Header]

## 2.2 实例 ##

使用工具分析一个mach-o文件来具体的看一下Mach-O Headers。

通过otool可以得到Mach header的具体的情况，但是可读性略微有一点差。

还有一个工具是MachOview可以看的更清楚一点。

[![Header][Header 1]][Header 1]

*  MagicNumber的值为0xFEEDFACF所以该文件是一个64位平台上的文件
 *  CPU Type和CPU SubType也很容易理解，运行在X86\_64的CPU平台上
 *  File Type标示了该文件是一个可执行文件，后面具体分析
 *  Flags标示了这个MachO文件的四个特性，后面具体分析

## 2.3 具体参数 ##

### 2.3.1 FileType ###

因为Mach-O文件不仅仅用来实现可执行文件，同时还用来实现了其他内容

*  内核扩展
 *  库文件
 *  CoreDump
 *  …

他的源码定义如下：

解释一下一些常用到的文件类型。

<table style="margin:20px 0px; padding:0px; border:1px solid rgb(222,222,222); outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; border-collapse:collapse; border-spacing:0px; width:1007px; color:rgb(255,255,255)"> 
 <thead style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline"> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px; background:rgb(45,45,45)"> 
 <th style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-weight:normal; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; text-align:left"> File Type</th> 
 <th style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-weight:normal; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; text-align:left"> 用处</th> 
 <th style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-weight:normal; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; text-align:left"> 例子</th> 
 </tr> 
 </thead> 
 <tbody style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline"> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> MH_OBJECT</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 编译过程中产生的*.obj文件</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> gcc -c xxx.c 生成xxx.o文件</td> 
 </tr> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> MH_EXECUTABLE</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 可执行二进制文件</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> /usr/bin/git</td> 
 </tr> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> MH_CORE</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> CoreDump</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 崩溃时的Dump文件</td> 
 </tr> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> MH_DYLIB</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 动态库</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> /usr/lib/里面的那些库文件</td> 
 </tr> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> MH_DYLINKER</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 连接器linker</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> /usr/lib/dyld文件</td> 
 </tr> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> MH_KEXT_BUNDLE</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 内核扩展文件</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 自己开发的简单内核模块</td> 
 </tr> 
 </tbody> 
</table>

### 2.3.2 flags ###

Mach-O headers还包含了一些很重要的dyld的加载参数。代码中的定义如下：

同样简单的介绍几个比较重要的。

## 2.4 Headers小结 ##

[![Headers][]][Headers]

# 0x03 Load Commands #

这是load\_command的数据结构

Load Commands 直接就跟在Header后面，所有command占用内存的总和在Mach-O Header里面已经给出了。在加载过Header之后就是通过解析LoadCommand来加载接下来的数据了。我简单的看了一下内核中是如何解析macho数据的，抛开内核的实现细节，逻辑其实也十分简单。

<table style="margin:20px 0px; padding:0px; border:none; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; border-collapse:collapse; border-spacing:0px; width:auto; color:rgb(255,255,255)"> 
 <tbody style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline"> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px; border:none; outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> <pre style="margin-top:0px; margin-bottom:0px; padding:0px 20px 0px 0px; border:none; outline:0px; font-weight:inherit; font-style:inherit; font-family:Menlo,Consolas,&quot;Source Code Pro&quot;,Inconsolata,Monaco,monospace; font-size:10px; vertical-align:baseline; line-height:22.4px; overflow:auto; color:rgb(153,153,153); text-align:right; background:rgb(0,43,54)">1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
</pre> </td> 
 <td style="margin:0px; padding:0px; border:none; outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> <pre style="margin-top:0px; margin-bottom:0px; padding:0px; border:none; outline:0px; font-weight:inherit; font-style:inherit; font-family:Menlo,Consolas,&quot;Source Code Pro&quot;,Inconsolata,Monaco,monospace; font-size:10px; vertical-align:baseline; line-height:22.4px; overflow:auto; background:rgb(0,43,54)">static
load_return_t
parse_machfile(
	struct vnode 		*vp, 
	vm_map_t		map,
	thread_t		thread,
	struct mach_header	*header,
	off_t			file_offset,
	off_t			macho_size,
	int			depth,
	int64_t			aslr_offset,
	int64_t			dyld_aslr_offset,
	load_result_t		*result
)
{
 
	[...] //此处省略大量初始化与检测

		/*
		 * Loop through each of the load_commands indicated by the
		 * Mach-O header; if an absurd value is provided, we just
		 * run off the end of the reserved section by incrementing
		 * the offset too far, so we are implicitly fail-safe.
		 */
		offset = mach_header_sz;
		ncmds = header-&gt;ncmds;

		while (ncmds--) {
 
			/*
			 *	Get a pointer to the command.
			 */
			lcp = (struct load_command *)(addr + offset);
			//lcp设为当前要解析的cmd的地址
			oldoffset = offset;
			//oldoffset是从macho文件内存开始的地方偏移到当前command的偏移量
			offset += lcp-&gt;cmdsize;
			//重新计算offset，再加上当前command的长度，offset的值为文件内存起始地址到下一个command的偏移量
			/*
			 * Perform prevalidation of the struct load_command
			 * before we attempt to use its contents. Invalid
			 * values are ones which result in an overflow, or
			 * which can not possibly be valid commands, or which
			 * straddle or exist past the reserved section at the
			 * start of the image.
			 */
			if (oldoffset &gt; offset ||
			 lcp-&gt;cmdsize &lt; sizeof(struct load_command) ||
			 offset &gt; header-&gt;sizeofcmds + mach_header_sz) {
 
				ret = LOAD_BADMACHO;
				break;
			}
			//做了一个检测，与如何加载进入内存无关

			/*
			 * Act on struct load_command's for which kernel
			 * intervention is required.
			 */
			switch(lcp-&gt;cmd) {
 
			case LC_SEGMENT:
				[...]
				ret = load_segment(lcp,
				 header-&gt;filetype,
				 control,
				 file_offset,
				 macho_size,
				 vp,
				 map,
				 slide,
				 result);
				break;
			case LC_SEGMENT_64:
				[...]
				ret = load_segment(lcp,
				 header-&gt;filetype,
				 control,
				 file_offset,
				 macho_size,
				 vp,
				 map,
				 slide,
				 result);
				break;
			case LC_UNIXTHREAD:
				if (pass != 1)
					break;
				ret = load_unixthread(
						 (struct thread_command *) lcp,
						 thread,
						 slide,
						 result);
				break;
			case LC_MAIN:
				if (pass != 1)
					break;
				if (depth != 1)
					break;
				ret = load_main(
						 (struct entry_point_command *) lcp,
						 thread,
						 slide,
						 result);
				break;
			case LC_LOAD_DYLINKER:
				if (pass != 3)
					break;
				if ((depth == 1) &amp;&amp; (dlp == 0)) {
 
					dlp = (struct dylinker_command *)lcp;
					dlarchbits = (header-&gt;cputype &amp; CPU_ARCH_MASK);
				} else {
 
					ret = LOAD_FAILURE;
				}
				break;
			case LC_UUID:
				if (pass == 1 &amp;&amp; depth == 1) {
 
					ret = load_uuid((struct uuid_command *) lcp,
							(char *)addr + mach_header_sz + header-&gt;sizeofcmds,
							result);
				}
				break;
			case LC_CODE_SIGNATURE:
				[...]
				ret = load_code_signature(
					(struct linkedit_data_command *) lcp,
					vp,
					file_offset,
					macho_size,
					header-&gt;cputype,
					result);
				[...]
				break;
#if CONFIG_CODE_DECRYPTION
			case LC_ENCRYPTION_INFO:
			case LC_ENCRYPTION_INFO_64:
				if (pass != 3)
					break;
				ret = set_code_unprotect(
					(struct encryption_info_command *) lcp,
					addr, map, slide, vp, file_offset,
					header-&gt;cputype, header-&gt;cpusubtype);
				if (ret != LOAD_SUCCESS) {
 
					printf("proc %d: set_code_unprotect() error %d "
					 "for file \"%s\"\n",
					 p-&gt;p_pid, ret, vp-&gt;v_name);
					/* 
					 * Don't let the app run if it's 
					 * encrypted but we failed to set up the
					 * decrypter. If the keys are missing it will
					 * return LOAD_DECRYPTFAIL.
					 */
					 if (ret == LOAD_DECRYPTFAIL) {
 
						/* failed to load due to missing FP keys */
						proc_lock(p);
						p-&gt;p_lflag |= P_LTERM_DECRYPTFAIL;
						proc_unlock(p);
					 }
					 psignal(p, SIGKILL);
				}
				break;
#endif
			default:
				/* Other commands are ignored by the kernel */
				ret = LOAD_SUCCESS;
				break;
			}
			if (ret != LOAD_SUCCESS)
				break;
		}
		if (ret != LOAD_SUCCESS)
			break;
	}

	[...] //此处略去加载之后的处理代码
}
</pre> </td> 
 </tr> 
 </tbody> 
</table>

### 3.1cmdsize字段 ###

这里主要看while循环刚刚进入的时候几行代码,来理解是如何通过load\_command的cmd字段来解析Macho文件的数据。

### 3.2 cmd字段 ###

从这一段代码可以看出，根据cmd字段的类型不同，使用了不同的函数来加载。简单的列出一张表看一看在内核代码中不同的command类型都有哪些作用。

<table style="margin:20px 0px; padding:0px; border:1px solid rgb(222,222,222); outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; border-collapse:collapse; border-spacing:0px; width:1007px; color:rgb(255,255,255)"> 
 <thead style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline"> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px; background:rgb(45,45,45)"> 
 <th style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-weight:normal; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; text-align:left"> Command类型</th> 
 <th style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-weight:normal; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; text-align:left"> 处理函数</th> 
 <th style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-weight:normal; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; text-align:left"> 用途</th> 
 </tr> 
 </thead> 
 <tbody style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline"> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> LC_SEGMENT；LC_SEGMENT_64</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> load_segment</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 将segment中的数据加载并映射到进程的内存空间去</td> 
 </tr> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> LC_LOAD_DYLINKER</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> load_dylinker</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 调用/usr/lib/dyld程序</td> 
 </tr> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> LC_UUID</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> load_uuid</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 加载128-bit的唯一ID</td> 
 </tr> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> LC_THREAD</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> load_thread</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 开启一个MACH线程，但是不分配栈空间。</td> 
 </tr> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> LC_UNIXTHREAD</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> load_unixthread</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 开启一个UNIX线程</td> 
 </tr> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> LC_CODE_SIGNATURE</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> load_code_signature</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 进行数字签名</td> 
 </tr> 
 <tr style="margin:0px; padding:0px; border:0px; outline:0px; font-weight:inherit; font-style:inherit; font-family:inherit; vertical-align:baseline; height:35px"> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> LC_ENCRYPTION_INFO</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> set_code_unprotect</td> 
 <td style="margin:0px; padding:0px 10px; border:1px solid rgb(2,2,2); outline:0px; font-style:inherit; font-family:inherit; font-size:16px; vertical-align:middle; height:35px"> 加密二进制文件</td> 
 </tr> 
 </tbody> 
</table>

# 0x04 Segment&Section #

加载数据时，主要加载的就是LC\_SEGMET活着LC\_SEGMENT\_64。其他的Segment的用途在上一节已经简单的介绍了，这里不做深究。

LCSEGMENT以及LC\_SEGMENT\_64的数据结构是这样的。

可以看出，这里大部分的数据是用来帮助内核将Segment映射到虚拟内存的。主要要关注的是`nsects`

字段，标示了Segment中有多少secetion。section是具体有用的数据存放的地方。

Section的数据结构如下：

除了同样有帮助内存映射的变量外，在了解Mach-O格式的时候，只需要知道不同的Section有着不同的作用就可以了。

因为section类型已经是最小的分类了，还有更多复杂section段就不一一例举了，遇到没见过的section类型可以自行查找Apple文档。

# 0x05 小结 #

通过对Mach-O格式的仔细分析，可以更好的理解Mach-O文件的加载过程，为研究dyld或者其他OS X系统下的模块打好基础。

# 参考 #

1.mach-o文件加载的全过程(1)

[http://dongaxis.github.io/2015/01/01/mac-o%E6%96%87%E4%BB%B6%E5%8A%A0%E8%BD%BD%E7%9A%84%E5%85%A8%E8%BF%87%E7%A8%8B-1/][http_dongaxis.github.io_2015_01_01_mac-o_E6_96_87_E4_BB_B6_E5_8A_A0_E8_BD_BD_E7_9A_84_E5_85_A8_E8_BF_87_E7_A8_8B-1]

2.Mach-O 可执行文件

[http://objccn.io/issue-6-3/][http_objccn.io_issue-6-3]

3.iPhone Mach-O文件格式与代码签名

[http://zhiwei.li/text/2012/02/15/iphone-mach-o%E6%96%87%E4%BB%B6%E6%A0%BC%E5%BC%8F%E4%B8%8E%E4%BB%A3%E7%A0%81%E7%AD%BE%E5%90%8D/][http_zhiwei.li_text_2012_02_15_iphone-mach-o_E6_96_87_E4_BB_B6_E6_A0_BC_E5_BC_8F_E4_B8_8E_E4_BB_A3_E7_A0_81_E7_AD_BE_E5_90_8D]

4.Dynamic Linking of Imported Functions in Mach-O

[http://www.codeproject.com/Articles/187181/Dynamic-Linking-of-Imported-Functions-in-Mach-O][http_www.codeproject.com_Articles_187181_Dynamic-Linking-of-Imported-Functions-in-Mach-O]

5.otool详解Mach-o文件头部

[http://www.mc2lab.com/?p=68][http_www.mc2lab.com_p_68]

# PS: #

更多文章可以在我的学习分享博客[http://BLOGIMAGE/][http_BLOGIMAGE]

希望可以多多交流，不足之处还希望大家可以给与指正：）

**本文标题:**[mach-o格式分析][http_turingh.github.io_2016_03_07_mach-o_E6_96_87_E4_BB_B6_E6_A0_BC_E5_BC_8F_E5_88_86_E6_9E_90]

**文章作者:**[mrh][]

**发布时间:**2016年03月07日 - 11时18分

**最后更新:**2016年03月23日 - 23时37分

**原始链接:**[http://turingh.github.io/2016/03/07/mach-o文件格式分析/][http_turingh.github.io_2016_03_07_mach-o_E6_96_87_E4_BB_B6_E6_A0_BC_E5_BC_8F_E5_88_86_E6_9E_90]

**许可协议:** ["署名-非商用-相同方式共享 3.0"][-_-_ 3.0] 转载请保留原文链接及作者。

[http_turingh.github.io_2016_03_07_mach-o_E6_96_87_E4_BB_B6_E6_A0_BC_E5_BC_8F_E5_88_86_E6_9E_90]: http://turingh.github.io/2016/03/07/mach-o%E6%96%87%E4%BB%B6%E6%A0%BC%E5%BC%8F%E5%88%86%E6%9E%90/
[Mach-O]: /images/20220717/a42fa3b489704b73a5bec7a2b778ac4a.png
[Header]: /images/20220717/8954fc5071274180a68bb062d65c8d4c.png
[Header 1]: /images/20220717/8357767d40f3402ca5d9b48c60ae46b5.png
[Headers]: /images/20220717/e839b57dc4ea4e2cafbbe2b848b217b5.png
[http_dongaxis.github.io_2015_01_01_mac-o_E6_96_87_E4_BB_B6_E5_8A_A0_E8_BD_BD_E7_9A_84_E5_85_A8_E8_BF_87_E7_A8_8B-1]: http://dongaxis.github.io/2015/01/01/mac-o%E6%96%87%E4%BB%B6%E5%8A%A0%E8%BD%BD%E7%9A%84%E5%85%A8%E8%BF%87%E7%A8%8B-1/
[http_objccn.io_issue-6-3]: http://objccn.io/issue-6-3/
[http_zhiwei.li_text_2012_02_15_iphone-mach-o_E6_96_87_E4_BB_B6_E6_A0_BC_E5_BC_8F_E4_B8_8E_E4_BB_A3_E7_A0_81_E7_AD_BE_E5_90_8D]: http://zhiwei.li/text/2012/02/15/iphone-mach-o%E6%96%87%E4%BB%B6%E6%A0%BC%E5%BC%8F%E4%B8%8E%E4%BB%A3%E7%A0%81%E7%AD%BE%E5%90%8D/
[http_www.codeproject.com_Articles_187181_Dynamic-Linking-of-Imported-Functions-in-Mach-O]: http://www.codeproject.com/Articles/187181/Dynamic-Linking-of-Imported-Functions-in-Mach-O
[http_www.mc2lab.com_p_68]: http://www.mc2lab.com/?p=68
[http_BLOGIMAGE]: http://blogimage/
[mrh]: http://turingh.github.io/
[-_-_ 3.0]: http://creativecommons.org/licenses/by-nc-sa/3.0/cn/