2

My end goal here is to find the Mach-O header in a dylib file.

Here's what I've come up with so far:

All my dylib files have the following first four bytes: 0xcafebabe. Then after 4096 bytes the actual Mach-O header starts, followed by the usual commands and so on.

But 0xcafebabe is also used to identify Java class files. So how do I distinguish between both of those based on the actual content? What are the fields after 0xcafebabe in a dylib file?

3

Since a dylib file is just going to be a Mach-O file, you're going to need to understand the header format, which is laid out pretty well in the code itself. You can take a look at the Mach-O parsing functions on Apple's site

http://www.opensource.apple.com/source/xar/xar-45/xar/lib/macho.c

What you're seeing is that FAT Header part of the Mach-O file, which is telling you where to find the rest of the of the Mach-O file. This is used to have one file, with two separate architectures inside of it. The FAT header describes where the to find the rest of the data needed by the system running it.

While doing some reversing and forensics work, I created a 010Editor template for parsing through Mach-O files - it might be useful in conjunction with the source from Apple for understanding what is coming after the 0xCAFEBABE and loading you're actual dylib files;

https://github.com/strazzere/010Editor-stuff/blob/master/Templates/MachOTemplate.bt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.