example_result.txt

["_ruby_re_search", "0x10007f930"]
["_ruby_re_set_casetable", "0x100073a00"]
["_ruby_release_date", "0x1000a42e1"]
["_ruby_run", "0x100031570"]
["_ruby_safe_level", "0x1000d35c0"]
["_ruby_sandbox_restore", "0x1000f1110"]
["_ruby_sandbox_save", "0x1000f1108"]
["_ruby_scan_hex", "0x1000943e0"]
["_ruby_scan_oct", "0x1000928e0"]
["_ruby_scope", "0x1000f1130"]
["_ruby_script", "0x100080690"]
["_ruby_set_argv", "0x100080460"]
["_ruby_set_current_source", "0x1000163e0"]
["_ruby_set_stack_size", "0x100036a10"]
["_ruby_setenv", "0x10003c010"]
["_ruby_show_copyright", "0x100099db0"]
["_ruby_show_version", "0x100099dd0"]
["_ruby_signal_name", "0x1000820e0"]
["_ruby_sourcefile", "0x1000f1288"]
["_ruby_sourceline", "0x1000f1280"]
["_ruby_stack_check", "0x100036980"]
["_ruby_stack_length", "0x100036930"]
["_ruby_stop", "0x10002b3e0"]
["_ruby_strdup", "0x1000959b0"]
["_ruby_strtod", "0x1000946a0"]
["_ruby_top_cref", "0x1000f1100"]
["_ruby_top_self", "0x1000f1278"]
["_ruby_unsetenv", "0x10003c040"]
["_ruby_verbose", "0x1000d3be0"]
["_ruby_version", "0x1000a42db"]
["_ruby_xcalloc", "0x100039a20"]
["_ruby_xfree", "0x1000370f0"]
["_ruby_xmalloc", "0x100039490"]
["_ruby_xrealloc", "0x100039920"]
["_ruby_yychar", "0x1000f1294"]
["_ruby_yydebug", "0x1000f1290"]
["_ruby_yylval", "0x1000f1298"]
["_ruby_yyparse", "0x10005c510"]

macho.rb

require 'rubygems'
require 'ffi'

module MachO
  MH_MAGIC_64 = 0xfeedfacf
  LC_SYMTAB	= 0x2
  N_SECT = 0xe
  N_TYPE = 0x0e

  class MachHeader64 < FFI::Struct
    layout :magic,      :uint32,
           :cputype,    :int32,
           :cpusubtype, :int32,
           :filetype,   :uint32,
           :ncmds,      :uint32,
           :sizeofcmds, :uint32,
           :flags,      :uint32,
           :reserved,   :uint32
  end

  class LoadCommand < FFI::Struct
    layout :cmd,     :uint32,
           :cmdsize, :uint32
  end

  class SymtabCommand < FFI::Struct
    layout :cmd,     :uint32,
           :cmdsize, :uint32,
           :symoff,  :uint32,
           :nsyms,   :uint32,
           :stroff,  :uint32,
           :strsize, :uint32
  end

  class Nlist64 < FFI::Struct
    layout :n_strx,  :uint32,
           :n_type,  :uint8,
           :n_sect,  :uint8,
           :n_desc,  :uint16,
           :n_value, :uint64
  end
end

data = File.read("/Users/jake/.rvm/rubies/ruby-1.8.7-p249/bin/ruby")

buf = FFI::Buffer.new(data.size)
buf.put_bytes(0, data)

hdr = MachO::MachHeader64.new(buf)
raise "boom" unless hdr[:magic] == MachO::MH_MAGIC_64

bufaddr = buf.inspect.scan(/address\=(\w+)/).first.first.hex

lc_base_ptr = FFI::Pointer.new(bufaddr + MachO::MachHeader64.size) 
lc_off = 0

hdr[:ncmds].times do |i|
  lc = MachO::LoadCommand.new(lc_base_ptr + lc_off)
  if lc[:cmd] == MachO::LC_SYMTAB
    sc = MachO::SymtabCommand.new(lc_base_ptr + lc_off)

    symbol_table = FFI::Pointer.new(bufaddr + sc[:symoff])
    string_table = FFI::Pointer.new(bufaddr + sc[:stroff])

    sc[:nsyms].times do |j|
      nlist = MachO::Nlist64.new(symbol_table + (j * MachO::Nlist64.size))

      if nlist[:n_type] & MachO::N_TYPE == MachO::N_SECT && nlist[:n_strx] > 0
        ptr = (string_table + nlist[:n_strx])
        p [ptr.get_string(0), "0x" + nlist[:n_value].to_s(16)]
      end
    end
  end
  lc_off += lc[:cmdsize]
end