Module: MachO::Headers

Defined in:
lib/macho/headers.rb

Overview

Classes and constants for parsing the headers of Mach-O binaries.

Defined Under Namespace

Classes: FatArch, FatArch64, FatHeader, MachHeader, MachHeader64

Constant Summary collapse

FAT_MAGIC =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

big-endian fat magic

0xcafebabe
FAT_CIGAM =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

Note:

This is defined for completeness, but should never appear in ruby-macho code, since fat headers are always big-endian.

little-endian fat magic

0xbebafeca
FAT_MAGIC_64 =

64-bit big-endian fat magic

0xcafebabf
FAT_CIGAM_64 =
Note:

This is defined for completeness, but should never appear in ruby-macho code, since fat headers are always big-endian.

64-bit little-endian fat magic

0xbfbafeca
MH_MAGIC =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

32-bit big-endian magic

0xfeedface
MH_CIGAM =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

32-bit little-endian magic

0xcefaedfe
MH_MAGIC_64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

64-bit big-endian magic

0xfeedfacf
MH_CIGAM_64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

64-bit little-endian magic

0xcffaedfe
MH_MAGICS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of magic numbers to string representations

{
  FAT_MAGIC => "FAT_MAGIC",
  FAT_MAGIC_64 => "FAT_MAGIC_64",
  MH_MAGIC => "MH_MAGIC",
  MH_CIGAM => "MH_CIGAM",
  MH_MAGIC_64 => "MH_MAGIC_64",
  MH_CIGAM_64 => "MH_CIGAM_64",
}.freeze
CPU_ARCH_ABI64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

mask for CPUs with 64-bit architectures (when running a 64-bit ABI?)

0x01000000
CPU_ARCH_ABI32 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

mask for CPUs with 64-bit architectures (when running a 32-bit ABI?)

See Also:

0x02000000
CPU_TYPE_ANY =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

any CPU (unused?)

-1
CPU_TYPE_MC680X0 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

m68k compatible CPUs

0x06
CPU_TYPE_I386 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

i386 and later compatible CPUs

0x07
CPU_TYPE_X86_64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

x86_64 (AMD64) compatible CPUs

(CPU_TYPE_I386 | CPU_ARCH_ABI64)
CPU_TYPE_ARM =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

32-bit ARM compatible CPUs

0x0c
CPU_TYPE_MC88000 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

m88k compatible CPUs

0xd
CPU_TYPE_ARM64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

64-bit ARM compatible CPUs

(CPU_TYPE_ARM | CPU_ARCH_ABI64)
CPU_TYPE_ARM64_32 =

64-bit ARM compatible CPUs (running in 32-bit mode?)

See Also:

(CPU_TYPE_ARM | CPU_ARCH_ABI32)
CPU_TYPE_POWERPC =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

PowerPC compatible CPUs

0x12
CPU_TYPE_POWERPC64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

PowerPC64 compatible CPUs

(CPU_TYPE_POWERPC | CPU_ARCH_ABI64)
CPU_TYPES =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of cpu types to symbol representations

{
  CPU_TYPE_ANY => :any,
  CPU_TYPE_I386 => :i386,
  CPU_TYPE_X86_64 => :x86_64,
  CPU_TYPE_ARM => :arm,
  CPU_TYPE_ARM64 => :arm64,
  CPU_TYPE_ARM64_32 => :arm64_32,
  CPU_TYPE_POWERPC => :ppc,
  CPU_TYPE_POWERPC64 => :ppc64,
}.freeze
CPU_SUBTYPE_MASK =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

mask for CPU subtype capabilities

0xff000000
CPU_SUBTYPE_LIB64 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

64-bit libraries (undocumented!)

See Also:

0x80000000
CPU_SUBTYPE_I386 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_I386

3
CPU_SUBTYPE_486 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the i486 sub-type for CPU_TYPE_I386

4
CPU_SUBTYPE_486SX =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the i486SX sub-type for CPU_TYPE_I386

132
CPU_SUBTYPE_586 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the i586 (P5, Pentium) sub-type for CPU_TYPE_I386

5
CPU_SUBTYPE_PENT =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

See Also:

CPU_SUBTYPE_586
CPU_SUBTYPE_PENTPRO =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the Pentium Pro (P6) sub-type for CPU_TYPE_I386

22
CPU_SUBTYPE_PENTII_M3 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the Pentium II (P6, M3?) sub-type for CPU_TYPE_I386

54
CPU_SUBTYPE_PENTII_M5 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the Pentium II (P6, M5?) sub-type for CPU_TYPE_I386

86
CPU_SUBTYPE_PENTIUM_4 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the Pentium 4 (Netburst) sub-type for CPU_TYPE_I386

10
CPU_SUBTYPE_MC680X0_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_MC680X0

1
CPU_SUBTYPE_MC68030 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

See Also:

CPU_SUBTYPE_MC680X0_ALL
CPU_SUBTYPE_MC68040 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 040 subtype for CPU_TYPE_MC680X0

2
CPU_SUBTYPE_MC68030_ONLY =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 030 subtype for CPU_TYPE_MC680X0

3
CPU_SUBTYPE_X86_64_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_X86_64

CPU_SUBTYPE_I386
CPU_SUBTYPE_X86_64_H =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the Haskell sub-type for CPU_TYPE_X86_64

8
CPU_SUBTYPE_ARM_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_ARM

0
CPU_SUBTYPE_ARM_V4T =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v4t sub-type for CPU_TYPE_ARM

5
CPU_SUBTYPE_ARM_V6 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v6 sub-type for CPU_TYPE_ARM

6
CPU_SUBTYPE_ARM_V5TEJ =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v5 sub-type for CPU_TYPE_ARM

7
CPU_SUBTYPE_ARM_XSCALE =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the xscale (v5 family) sub-type for CPU_TYPE_ARM

8
CPU_SUBTYPE_ARM_V7 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7 sub-type for CPU_TYPE_ARM

9
CPU_SUBTYPE_ARM_V7F =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7f (Cortex A9) sub-type for CPU_TYPE_ARM

10
CPU_SUBTYPE_ARM_V7S =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7s ("Swift") sub-type for CPU_TYPE_ARM

11
CPU_SUBTYPE_ARM_V7K =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7k ("Kirkwood40") sub-type for CPU_TYPE_ARM

12
CPU_SUBTYPE_ARM_V6M =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v6m sub-type for CPU_TYPE_ARM

14
CPU_SUBTYPE_ARM_V7M =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7m sub-type for CPU_TYPE_ARM

15
CPU_SUBTYPE_ARM_V7EM =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v7em sub-type for CPU_TYPE_ARM

16
CPU_SUBTYPE_ARM_V8 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v8 sub-type for CPU_TYPE_ARM

13
CPU_SUBTYPE_ARM64_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_ARM64

0
CPU_SUBTYPE_ARM64_V8 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v8 sub-type for CPU_TYPE_ARM64

1
CPU_SUBTYPE_ARM64_32_V8 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the v8 sub-type for CPU_TYPE_ARM64_32

1
CPU_SUBTYPE_ARM64E =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the e (A12) sub-type for CPU_TYPE_ARM64

2
CPU_SUBTYPE_MC88000_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_MC88000

0
CPU_SUBTYPE_MMAX_JPC =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

See Also:

CPU_SUBTYPE_MC88000_ALL
CPU_SUBTYPE_MC88100 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 100 sub-type for CPU_TYPE_MC88000

1
CPU_SUBTYPE_MC88110 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 110 sub-type for CPU_TYPE_MC88000

2
CPU_SUBTYPE_POWERPC_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the lowest common sub-type for CPU_TYPE_POWERPC

0
CPU_SUBTYPE_POWERPC_601 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 601 sub-type for CPU_TYPE_POWERPC

1
CPU_SUBTYPE_POWERPC_602 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 602 sub-type for CPU_TYPE_POWERPC

2
CPU_SUBTYPE_POWERPC_603 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 603 sub-type for CPU_TYPE_POWERPC

3
CPU_SUBTYPE_POWERPC_603E =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 603e (G2) sub-type for CPU_TYPE_POWERPC

4
CPU_SUBTYPE_POWERPC_603EV =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 603ev sub-type for CPU_TYPE_POWERPC

5
CPU_SUBTYPE_POWERPC_604 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 604 sub-type for CPU_TYPE_POWERPC

6
CPU_SUBTYPE_POWERPC_604E =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 604e sub-type for CPU_TYPE_POWERPC

7
CPU_SUBTYPE_POWERPC_620 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 620 sub-type for CPU_TYPE_POWERPC

8
CPU_SUBTYPE_POWERPC_750 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 750 (G3) sub-type for CPU_TYPE_POWERPC

9
CPU_SUBTYPE_POWERPC_7400 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 7400 (G4) sub-type for CPU_TYPE_POWERPC

10
CPU_SUBTYPE_POWERPC_7450 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 7450 (G4 "Voyager") sub-type for CPU_TYPE_POWERPC

11
CPU_SUBTYPE_POWERPC_970 =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

the 970 (G5) sub-type for CPU_TYPE_POWERPC

100
CPU_SUBTYPE_POWERPC64_ALL =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

any CPU sub-type for CPU type CPU_TYPE_POWERPC64

CPU_SUBTYPE_POWERPC_ALL
CPU_SUBTYPES =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of CPU types/subtype pairs to symbol representations in (very) roughly descending order of commonness

See Also:

{
  CPU_TYPE_I386 => {
    CPU_SUBTYPE_I386 => :i386,
    CPU_SUBTYPE_486 => :i486,
    CPU_SUBTYPE_486SX => :i486SX,
    CPU_SUBTYPE_586 => :i586, # also "pentium" in arch(3)
    CPU_SUBTYPE_PENTPRO => :i686, # also "pentpro" in arch(3)
    CPU_SUBTYPE_PENTII_M3 => :pentIIm3,
    CPU_SUBTYPE_PENTII_M5 => :pentIIm5,
    CPU_SUBTYPE_PENTIUM_4 => :pentium4,
  }.freeze,
  CPU_TYPE_X86_64 => {
    CPU_SUBTYPE_X86_64_ALL => :x86_64,
    CPU_SUBTYPE_X86_64_H => :x86_64h,
  }.freeze,
  CPU_TYPE_ARM => {
    CPU_SUBTYPE_ARM_ALL => :arm,
    CPU_SUBTYPE_ARM_V4T => :armv4t,
    CPU_SUBTYPE_ARM_V6 => :armv6,
    CPU_SUBTYPE_ARM_V5TEJ => :armv5,
    CPU_SUBTYPE_ARM_XSCALE => :xscale,
    CPU_SUBTYPE_ARM_V7 => :armv7,
    CPU_SUBTYPE_ARM_V7F => :armv7f,
    CPU_SUBTYPE_ARM_V7S => :armv7s,
    CPU_SUBTYPE_ARM_V7K => :armv7k,
    CPU_SUBTYPE_ARM_V6M => :armv6m,
    CPU_SUBTYPE_ARM_V7M => :armv7m,
    CPU_SUBTYPE_ARM_V7EM => :armv7em,
    CPU_SUBTYPE_ARM_V8 => :armv8,
  }.freeze,
  CPU_TYPE_ARM64 => {
    CPU_SUBTYPE_ARM64_ALL => :arm64,
    CPU_SUBTYPE_ARM64_V8 => :arm64v8,
    CPU_SUBTYPE_ARM64E => :arm64e,
  }.freeze,
  CPU_TYPE_ARM64_32 => {
    CPU_SUBTYPE_ARM64_32_V8 => :arm64_32v8,
  }.freeze,
  CPU_TYPE_POWERPC => {
    CPU_SUBTYPE_POWERPC_ALL => :ppc,
    CPU_SUBTYPE_POWERPC_601 => :ppc601,
    CPU_SUBTYPE_POWERPC_603 => :ppc603,
    CPU_SUBTYPE_POWERPC_603E => :ppc603e,
    CPU_SUBTYPE_POWERPC_603EV => :ppc603ev,
    CPU_SUBTYPE_POWERPC_604 => :ppc604,
    CPU_SUBTYPE_POWERPC_604E => :ppc604e,
    CPU_SUBTYPE_POWERPC_750 => :ppc750,
    CPU_SUBTYPE_POWERPC_7400 => :ppc7400,
    CPU_SUBTYPE_POWERPC_7450 => :ppc7450,
    CPU_SUBTYPE_POWERPC_970 => :ppc970,
  }.freeze,
  CPU_TYPE_POWERPC64 => {
    CPU_SUBTYPE_POWERPC64_ALL => :ppc64,
    # apparently the only exception to the naming scheme
    CPU_SUBTYPE_POWERPC_970 => :ppc970_64,
  }.freeze,
  CPU_TYPE_MC680X0 => {
    CPU_SUBTYPE_MC680X0_ALL => :m68k,
    CPU_SUBTYPE_MC68030 => :mc68030,
    CPU_SUBTYPE_MC68040 => :mc68040,
  },
  CPU_TYPE_MC88000 => {
    CPU_SUBTYPE_MC88000_ALL => :m88k,
  },
}.freeze
MH_OBJECT =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

relocatable object file

0x1
MH_EXECUTE =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

demand paged executable file

0x2
MH_FVMLIB =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

fixed VM shared library file

0x3
MH_CORE =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

core dump file

0x4
MH_PRELOAD =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

preloaded executable file

0x5
MH_DYLIB =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

dynamically bound shared library

0x6
MH_DYLINKER =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

dynamic link editor

0x7
MH_BUNDLE =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

dynamically bound bundle file

0x8
MH_DYLIB_STUB =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

shared library stub for static linking only, no section contents

0x9
MH_DSYM =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

companion file with only debug sections

0xa
MH_KEXT_BUNDLE =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

x86_64 kexts

0xb
MH_FILETYPES =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of filetypes to Symbol representations

{
  MH_OBJECT => :object,
  MH_EXECUTE => :execute,
  MH_FVMLIB => :fvmlib,
  MH_CORE => :core,
  MH_PRELOAD => :preload,
  MH_DYLIB => :dylib,
  MH_DYLINKER => :dylinker,
  MH_BUNDLE => :bundle,
  MH_DYLIB_STUB => :dylib_stub,
  MH_DSYM => :dsym,
  MH_KEXT_BUNDLE => :kext_bundle,
}.freeze
MH_FLAGS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

association of mach header flag symbols to values

{
  :MH_NOUNDEFS => 0x1,
  :MH_INCRLINK => 0x2,
  :MH_DYLDLINK => 0x4,
  :MH_BINDATLOAD => 0x8,
  :MH_PREBOUND => 0x10,
  :MH_SPLIT_SEGS => 0x20,
  :MH_LAZY_INIT => 0x40,
  :MH_TWOLEVEL => 0x80,
  :MH_FORCE_FLAT => 0x100,
  :MH_NOMULTIDEFS => 0x200,
  :MH_NOPREFIXBINDING => 0x400,
  :MH_PREBINDABLE => 0x800,
  :MH_ALLMODSBOUND => 0x1000,
  :MH_SUBSECTIONS_VIA_SYMBOLS => 0x2000,
  :MH_CANONICAL => 0x4000,
  :MH_WEAK_DEFINES => 0x8000,
  :MH_BINDS_TO_WEAK => 0x10000,
  :MH_ALLOW_STACK_EXECUTION => 0x20000,
  :MH_ROOT_SAFE => 0x40000,
  :MH_SETUID_SAFE => 0x80000,
  :MH_NO_REEXPORTED_DYLIBS => 0x100000,
  :MH_PIE => 0x200000,
  :MH_DEAD_STRIPPABLE_DYLIB => 0x400000,
  :MH_HAS_TLV_DESCRIPTORS => 0x800000,
  :MH_NO_HEAP_EXECUTION => 0x1000000,
  :MH_APP_EXTENSION_SAFE => 0x02000000,
}.freeze