class Rex::MachParsey::Fat

Attributes

fat_archs[RW]
fat_header[RW]
isource[RW]
machos[RW]

Public Class Methods

new(isource, offset = 0) click to toggle source
# File lib/rex/machparsey/mach.rb, line 106
def initialize(isource, offset = 0)
  self.fat_archs = []
  self.machos = []
  self.isource = isource
  self.fat_header = FatHeader.new(isource.read(offset, FAT_HEADER_SIZE))

  if !self.fat_header
    raise FatHeaderError, "Could not parse FAT header"
  end

  print "Detected " +  self.fat_header.nfat_arch.to_s +  " archs in binary.\n"

  offset += FAT_HEADER_SIZE

  self.fat_header.nfat_arch.times do
    fat_arch = FatArch.new(isource.read(offset, FAT_ARCH_SIZE), self.fat_header.endian)
    self.fat_archs << fat_arch
    self.machos << Mach.new(isource, fat_arch.offset, true)
    offset += FAT_ARCH_SIZE
  end


end
new_from_file(filename, disk_backed = false) click to toggle source
# File lib/rex/machparsey/mach.rb, line 162
def self.new_from_file(filename, disk_backed = false)

  file = ::File.open(filename, "rb")

  if disk_backed
    return self.new(ImageSource::Disk.new(file))
  else
    obj = new_from_string(file.read)
    file.close
    return obj
  end
end
new_from_string(data) click to toggle source
# File lib/rex/machparsey/mach.rb, line 176
def self.new_from_string(data)
  return self.new(ImageSource::Memory.new(data))
end

Public Instance Methods

_parse_fat_header(isource, offset) click to toggle source

this is useful for debugging but we don’t use it for anything.

# File lib/rex/machparsey/mach.rb, line 131
def _parse_fat_header(isource, offset)
  archs = []
  nfat_arch = self.fat_header.nfat_arch

  print "Number of archs in binary: " + nfat_arch.to_s + "\n"

  nfat_arch.times do
    arch = FatArch.new(isource.read(offset, FAT_ARCH_SIZE), self.endian)

    case arch.cpu_type

    when CPU_TYPE_I386
      print "i386\n"

    when CPU_TYPE_X86_64
      print "x86_64\n"

    when CPU_TYPE_ARM
      print "Arm\n"

    when CPU_TYPE_POWERPC
      print "Power PC\n"

    when CPU_TYPE_POWERPC64
      print "Power PC 64\n"
    end

    offset += FAT_ARCH_SIZE
  end
end
close() click to toggle source
# File lib/rex/machparsey/mach.rb, line 200
def close
  isource.close
end
index(*args) click to toggle source
# File lib/rex/machparsey/mach.rb, line 196
def index(*args)
  isource.index(*args)
end
ptr_32?() click to toggle source
# File lib/rex/machparsey/mach.rb, line 184
def ptr_32?
  ptr_64? == false
end
ptr_64?() click to toggle source
# File lib/rex/machparsey/mach.rb, line 180
def ptr_64?
  mach_header.bits == BITS_64
end
ptr_s(vaddr) click to toggle source
# File lib/rex/machparsey/mach.rb, line 188
def ptr_s(vaddr)
  (ptr_32?) ? ("0x%.8x" % vaddr) : ("0x%.16x" % vaddr)
end
read(offset, len) click to toggle source
# File lib/rex/machparsey/mach.rb, line 192
def read(offset, len)
  isource.read(offset, len)
end