Skip to content

Instantly share code, notes, and snippets.

@0x75
Created May 4, 2013 10:51
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save 0x75/5517128 to your computer and use it in GitHub Desktop.
Save 0x75/5517128 to your computer and use it in GitHub Desktop.
parse fat macho binary
#include <iostream>
#include <math.h>
#include <mach-o/loader.h>
#include <mach-o/nlist.h>
#include <mach-o/fat.h>
int main () {
std::string FileName = "/bin/ls";
char * File;
FILE *fp;
int fsize;
fp = fopen(FileName.c_str(), "r");
if (!fp) {
fprintf(stderr, "[!] ERROR: Could not open file to read %s\n", FileName.c_str());
exit(1);
}
fseek(fp, 0, SEEK_END);
fsize = ftell(fp);
fseek(fp, 0, SEEK_SET);
File = (char *) malloc(fsize);
fread(File, fsize, 1, fp);
fclose(fp);
struct fat_header *FH = (struct fat_header *)File;
struct fat_arch *FA;
FA = (struct fat_arch *)(File + sizeof(struct fat_header));
printf ("%i - %i - %i - %i - %i\n",ntohl(FA->cputype), ntohl(FA->cpusubtype), ntohl(FA->offset), ntohl(FA->size), ntohl(FA->align));
FA = (struct fat_arch *)(File + sizeof(struct fat_header) + sizeof(struct fat_arch));
printf ("%i - %i - %i - %i - %i\n",ntohl(FA->cputype), ntohl(FA->cpusubtype), ntohl(FA->offset), ntohl(FA->size), ntohl(FA->align));
/* according to MachOView output shouled be
CPUTYPE_X86_64_ALL - CPUTSUBYPE_X86_64_ALL - 4096 - 39584 - 12
CPU_TYPE_i386 - CPUTSUBYPE_X86_ALL - 45056 - 35696 - 12
*/
free(File);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment