1

Processing a Mach-0 file with Rabin2 I'm obtaining the following result:

$ rabin2 -I mybinaryfile
arw 00000000000000000000000000000000000000000000000000000000000000001f0000000000000000000000170000001f0000001f0000000000000000000000
arch     x86
baddr    0x0
binsz    69256
bintype  mach0
bits     32
canary   false
sanitiz  false
class    MACH0
crypto   false
endian   little
havecode true
laddr    0x0
lang     c++
linenum  false
lsyms    false
machine  386
maxopsz  16
minopsz  1
nx       false
os       darwin
pcalign  0
pic      false
relocs   false
static   true
stripped false
subsys   darwin
va       true

Opening it with Radare2 the same "arw" line appears:

$ radare2 mybinaryfile
arw 00000000000000000000000000000000000000000000000000000000000000001f0000000000000000000000170000001f0000001f0000000000000000000000
 -- radare2-built farm beats the facebook one.
[0x00000000]> 

[0x00000000]> ih
0x00000000  Magic       0xfeedface
0x00000004  CpuType     0x7
0x00000008  CpuSubType  0x3
0x0000000c  FileType    0x1
0x00000010  nCmds       3
0x00000014  sizeOfCmds  840
0x00000018  Flags       0x2000
0x00000020  cmd       0 0x1 LC_SEGMENT
0x00000024  cmdsize     736
0x00000300  cmd       1 0x2 LC_SYMTAB
0x00000304  cmdsize     24
0x00000318  cmd       2 0x5 LC_UNIXTHREAD
0x0000031c  cmdsize     80

I've searched but I didn't find any answer. What does this "arw" line mean?

0

It looks like it's a raw byte dump of an arch-specific thread_state structure (e.g. for 32bit x86). See here for where the dump happens.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.