I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to the __text section in order to disassemble them, i noticed that sometimes in the symbol table the "value" field has the same offset of the function in the __text section, there's a generic rule to parse ObjC classes and methods and take pointers to these methods?

Thanks much.

up vote 0 down vote accepted

As you may realize, Objective-C methods don't appear in the symbol table (LC_SYMTAB). However, you're right that information about all Objective-C classes and their methods are embedded in the object since the Objective-C runtime has to parse it and register it.

You can find a section called __DATA,__objc_classlist that contains a list of pointers to struct objc_class (defined here), which contains a pointer to a struct class_ro_t in its bits member, which contains a member baseMethodList, which contains a pointer to a struct method_list_t, which contains a number of struct method_t elements which each contain an imp member which is the pointer to the IMP function. Those would be all the instance methods of the class. You can also follow the isa field of the class to reach the metaclass of the class. The instance methods of the metaclass are the class methods of the class.

One detail is that these pointers that are in the structures stored in the file on disk would not be the final pointers in memory. The dynamic linker dyld will go through the binary and link and rebase everything before the Objective-C runtime starts and parses the information I just described. For the data section, the linker typically will only do rebasing unless an external Objective-C class is used. It may be possible for you to get away with not doing the rebasing (in which case the pointers will just be the same as the case the binary has a slide of 0) if you're only interested in getting the pointers to Objective-C class method IMPs.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.