Package ghidra.app.util.bin.format.macho

# Class MachHeader

java.lang.Object
ghidra.app.util.bin.format.macho.MachHeader

All Implemented Interfaces:
  `StructConverter`

public class MachHeader extends Object implements StructConverter
Represents a mach_header structure.

See Also:
  - EXTERNAL_HEADERS/mach-o/loader.h

- ## Field Summary

  ### Fields inherited from interface ghidra.app.util.bin.StructConverter

  `ASCII, BYTE, DWORD, IBO32, IBO64, POINTER, QWORD, SLEB128, STRING, ULEB128, UTF16, UTF8, VOID, WORD`

- ## Constructor Summary

  Constructors
  Constructor
  Description
  `MachHeader(ByteProvider provider)`
  Creates a new `MachHeader`.
  `MachHeader(ByteProvider provider, long machHeaderStartIndexInProvider)`
  Creates a new `MachHeader`.
  `MachHeader(ByteProvider provider, long machHeaderStartIndexInProvider, boolean isRemainingMachoRelativeToStartIndex)`
  Creatse a new `MachHeader`.

- ## Method Summary

  Modifier and Type
  Method
  Description
  `static byte[]`
  `create(int magic, int cpuType, int cpuSubType, int fileType, int nCmds, int sizeOfCmds, int flags, int reserved)`
  Creates a new Mach Header byte array
  `int`
  `getAddressSize()`
  `List<Section>`
  `getAllSections()`
  `List<SegmentCommand>`
  `getAllSegments()`
  `int`
  `getCpuSubType()`
  `int`
  `getCpuType()`
  `String`
  `getDescription()`
  `int`
  `getFileType()`
  `<T> T`
  `getFirstLoadCommand(Class<T> classType)`
  `int`
  `getFlags()`
  `long`
  `getImageBase()`
  `List<LoadCommand>`
  `getLoadCommands()`
  `<T> List<T>`
  `getLoadCommands(Class<T> classType)`
  `int`
  `getMagic()`
  `int`
  `getNumberOfCommands()`
  `int`
  `getReserved()`
  `Section`
  `getSection(String segmentName, String sectionName)`
  `SegmentCommand`
  `getSegment(String segmentName)`
  `long`
  `getSize()`
  Gets the size of this `MachHeader` in bytes
  `int`
  `getSizeOfCommands()`
  `long`
  `getStartIndex()`
  Returns the start index that should be used for calculating offsets.
  `long`
  `getStartIndexInProvider()`
  Returns the offset of the MachHeader in the ByteProvider
  `boolean`
  `is32bit()`
  `boolean`
  `isLittleEndian()`
  `static boolean`
  `isMachHeader(ByteProvider provider)`
  Returns true if the specified ByteProvider starts with a Mach header magic signature.
  `MachHeader`
  `parse()`
  Parses this `MachHeader`'s `load commands`
  `MachHeader`
  `parse(DyldCacheUtils.SplitDyldCache splitDyldCache)`
  Parses this `MachHeader`'s `load commands`
  `List<SegmentCommand>`
  `parseSegments()`
  Parses only this `MachHeader`'s `segments`
  `DataType`
  `toDataType()`
  Returns a structure datatype representing the contents of the implementor of this interface.
  `String`
  `toString()`

  ### Methods inherited from class java.lang.Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait`

- ## Constructor Details

  - ### MachHeader

    public MachHeader(ByteProvider provider) throws IOException, MachException
    Creates a new `MachHeader`. Assumes the MachHeader starts at index 0 in the ByteProvider.
    Parameters:
      `provider` - the ByteProvider
    Throws:
      `IOException` - if an I/O error occurs while reading from the ByteProvider
      `MachException` - if an invalid MachHeader is detected

  - ### MachHeader

    public MachHeader(ByteProvider provider, long machHeaderStartIndexInProvider) throws IOException, MachException
    Creates a new `MachHeader`. Assumes the MachHeader starts at index machHeaderStartIndexInProvider in the ByteProvider.
    Parameters:
      `provider` - the ByteProvider
      `machHeaderStartIndexInProvider` - the index into the ByteProvider where the MachHeader begins
    Throws:
      `IOException` - if an I/O error occurs while reading from the ByteProvider
      `MachException` - if an invalid MachHeader is detected

  - ### MachHeader

    public MachHeader(ByteProvider provider, long machHeaderStartIndexInProvider, boolean isRemainingMachoRelativeToStartIndex) throws IOException, MachException
    Creatse a new `MachHeader`. Assumes the MachHeader starts at index machHeaderStartIndexInProvider in the ByteProvider.
    Parameters:
      `provider` - the ByteProvider
      `machHeaderStartIndexInProvider` - the index into the ByteProvider where the MachHeader begins.
      `isRemainingMachoRelativeToStartIndex` - true if the rest of the macho uses relative indexin (this is common in UBI and kernel cache files); otherwise, false if the rest of the file uses absolute indexing from 0 (this is common in DYLD cache files)
    Throws:
      `IOException` - if an I/O error occurs while reading from the ByteProvider
      `MachException` - if an invalid MachHeader is detected

- ## Method Details

  - ### isMachHeader

    public static boolean isMachHeader(ByteProvider provider)
    Returns true if the specified ByteProvider starts with a Mach header magic signature.
    Parameters:
      `provider` - `ByteProvider` to check
    Returns:
      boolean true if byte provider starts with a MachHeader

  - ### parse

    public MachHeader parse() throws IOException, MachException
    Parses this `MachHeader`'s `load commands`
    Returns:
      This `MachHeader`, for convenience
    Throws:
      `IOException` - If there was an IO-related error
      `MachException` - if the load command is invalid

  - ### parse

    public MachHeader parse(DyldCacheUtils.SplitDyldCache splitDyldCache) throws IOException, MachException
    Parses this `MachHeader`'s `load commands`
    Parameters:
      `splitDyldCache` - The `DyldCacheUtils.SplitDyldCache` that this header resides in. Could be null if a split DYLD cache is not being used.
    Returns:
      This `MachHeader`, for convenience
    Throws:
      `IOException` - If there was an IO-related error
      `MachException` - if the load command is invalid

  - ### parseSegments

    public List<SegmentCommand> parseSegments() throws IOException, MachException
    Parses only this `MachHeader`'s `segments`
    Returns:
      A of this `MachHeader`'s `segments`
    Throws:
      `IOException` - If there was an IO-related error
      `MachException` - if the load command is invalid

  - ### getMagic

    public int getMagic()

  - ### getCpuType

    public int getCpuType()

  - ### getImageBase

    public long getImageBase()

  - ### getCpuSubType

    public int getCpuSubType()

  - ### getFileType

    public int getFileType()

  - ### getNumberOfCommands

    public int getNumberOfCommands()

  - ### getSizeOfCommands

    public int getSizeOfCommands()

  - ### getFlags

    public int getFlags()

  - ### getReserved

    public int getReserved() throws MachException
    Throws:
      `MachException`

  - ### toDataType

    public DataType toDataType() throws DuplicateNameException, IOException
    Description copied from interface: `StructConverter`
    Returns a structure datatype representing the contents of the implementor of this interface.

    For example, given:

         class A {
             int foo;
             double bar;
         }

    The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

    Specified by:
      `toDataType` in interface `StructConverter`
    Returns:
      returns a structure datatype representing the implementor of this interface
    Throws:
      `DuplicateNameException` - when a datatype of the same name already exists
      `IOException`
    See Also:
      - `StructureDataType`

  - ### getStartIndex

    public long getStartIndex()
    Returns the start index that should be used for calculating offsets. This will be 0 for things such as the dyld shared cache where offsets are based off the beginning of the file.
    Returns:
      the start index that should be used for calculating offsets

  - ### getStartIndexInProvider

    public long getStartIndexInProvider()
    Returns the offset of the MachHeader in the ByteProvider
    Returns:
      the offset of the MachHeader in the ByteProvider

  - ### is32bit

    public boolean is32bit()

  - ### getAddressSize

    public int getAddressSize()

  - ### getAllSegments

    public List<SegmentCommand> getAllSegments()

  - ### getSegment

    public SegmentCommand getSegment(String segmentName)

  - ### getSection

    public Section getSection(String segmentName, String sectionName)

  - ### getAllSections

    public List<Section> getAllSections()

  - ### getLoadCommands

    public List<LoadCommand> getLoadCommands()

  - ### getLoadCommands

    public <T> List<T> getLoadCommands(Class<T> classType)

  - ### getFirstLoadCommand

    public <T> T getFirstLoadCommand(Class<T> classType)

  - ### isLittleEndian

    public boolean isLittleEndian()

  - ### getSize

    public long getSize()
    Gets the size of this `MachHeader` in bytes
    Returns:
      The size of this `MachHeader` in bytes

  - ### getDescription

    public String getDescription()

  - ### toString

    public String toString()
    Overrides:
      `toString` in class `Object`

  - ### create

    public static byte[] create(int magic, int cpuType, int cpuSubType, int fileType, int nCmds, int sizeOfCmds, int flags, int reserved) throws MachException
    Creates a new Mach Header byte array
    Parameters:
      `magic` - The magic
      `cpuType` - The cpu type
      `cpuSubType` - The cpu subtype
      `fileType` - The file type
      `nCmds` - The number of commands
      `sizeOfCmds` - The size of the commands
      `flags` - The flags
      `reserved` - A reserved value (ignored for 32-bit magic)
    Returns:
      The new header in byte array form
    Throws:
      `MachException` - if an invalid magic value was passed in (see `MachConstants`)