Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
My end goal here is to find the Mach-O header in a dylib file.
Here's what I've come up with so far:
All my dylib files have the following first four bytes: 0xcafebabe. Then after 4096 bytes the actual Mach-O header starts, followed by the usual commands and so on.
But 0xcafebabe is also used to identify Java class files. So how do I distinguish between both of those based on the actual content? What are the fields after 0xcafebabe in a dylib file?
Since a dylib file is just going to be a Mach-O file, you're going to need to understand the header format, which is laid out pretty well in the code itself. You can take a look at the Mach-O parsing functions on Apple's site
http://www.opensource.apple.com/source/xar/xar-45/xar/lib/macho.c
What you're seeing is that FAT Header part of the Mach-O file, which is telling you where to find the rest of the of the Mach-O file. This is used to have one file, with two separate architectures inside of it. The FAT header describes where the to find the rest of the data needed by the system running it.
While doing some reversing and forensics work, I created a 010Editor template for parsing through Mach-O files - it might be useful in conjunction with the source from Apple for understanding what is coming after the 0xCAFEBABE and loading you're actual dylib files;
https://github.com/strazzere/010Editor-stuff/blob/master/Templates/MachOTemplate.bt
