I'm working on a reverse engineering project with fat executables on OS X. So far I have established the structure of the fat_header, fat_arch and macho_header, but am having trouble finding documentation about the ordering of the fat_arch sections. Right now my project works by assuming that fat_arch sections appear in order of ascending offset fields. Is this assumption correct, or can the fat_arch sections appear in any order?
Add a comment
|
1 Answer
There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections?
The kernel simply loads the Universal Binary at execution time, parses the fat_arch structure(s) and selects a matching architecture type. So in my understanding there is no need for a fixed (or expectable) order of the fat_arch sections.
