Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to the __text section in order to disassemble them, i noticed that sometimes in the symbol table the "value" field has the same offset of the function in the __text section, there's a generic rule to parse ObjC classes and methods and take pointers to these methods?
Thanks much.
As you may realize, Objective-C methods don't appear in the symbol table (LC_SYMTAB). However, you're right that information about all Objective-C classes and their methods are embedded in the object since the Objective-C runtime has to parse it and register it.
You can find a section called __DATA,__objc_classlist that contains a list of pointers to struct objc_class (defined here), which contains a pointer to a struct class_ro_t in its bits member, which contains a member baseMethodList, which contains a pointer to a struct method_list_t, which contains a number of struct method_t elements which each contain an imp member which is the pointer to the IMP function. Those would be all the instance methods of the class. You can also follow the isa field of the class to reach the metaclass of the class. The instance methods of the metaclass are the class methods of the class.
One detail is that these pointers that are in the structures stored in the file on disk would not be the final pointers in memory. The dynamic linker dyld will go through the binary and link and rebase everything before the Objective-C runtime starts and parses the information I just described. For the data section, the linker typically will only do rebasing unless an external Objective-C class is used. It may be possible for you to get away with not doing the rebasing (in which case the pointers will just be the same as the case the binary has a slide of 0) if you're only interested in getting the pointers to Objective-C class method IMPs.
