#include "common/binary.h" #include "common/io.h" #include "common/strutil.h" #include #include #include #include #include #include #pragma GCC diagnostic ignored "-Wdeprecated-declarations" // swap_fat_arch // Ref: https://github.com/AlexDenisov/segment_dumper/blob/master/main.c typedef struct { const uint8_t* data; size_t length; } FFMemoryMapping; static inline void wrapMunmap(FFMemoryMapping* mapping) { assert(mapping); if (mapping->data == NULL || mapping->data == MAP_FAILED) { return; } munmap((void*) mapping->data, mapping->length); } /** * Helper function to access data from a memory-mapped file at a specific offset */ static inline const void* readData(const FFMemoryMapping* mapping, size_t size, off_t offset) { if (offset < 0) { return NULL; } size_t start = (size_t) offset; if (start > mapping->length || size > mapping->length - start) { return NULL; } return mapping->data + start; } /** * Handles a Mach-O section by extracting strings from the __cstring section * * @param mapping Memory mapping of the Mach-O object file * @param name Section name to check * @param offset Offset of the section in the file * @param size Size of the section * @param cb Callback function to process strings * @param userdata User data for the callback * @param minLength Minimum string length to extract * * @return true to continue processing, false to stop */ static bool handleMachSection(const FFMemoryMapping* mapping, const char* name, off_t offset, size_t size, bool (*cb)(const char* str, uint32_t len, void* userdata), void* userdata, uint32_t minLength) { if (!ffStrEquals(name, "__cstring")) { return true; } const char* data = readData(mapping, size, offset); if (!data) { return true; } for (size_t off = 0; off < size; ++off) { const char* p = data + off; if (*p == '\0') { continue; } uint32_t len = (uint32_t) strnlen(p, size - off); if (len < minLength) { off += len; // Skip short strings continue; } if (*p >= ' ' && *p <= '~') { // Ignore control characters if (!cb(p, len, userdata)) { return false; } } off += len; } return true; } /** * Processes a Mach-O header (32-bit or 64-bit) * * This function parses the load commands in a Mach-O header, looking for * LC_SEGMENT or LC_SEGMENT_64 commands that contain the __TEXT segment. * It then processes the sections within that segment to extract strings. * * @param mapping Memory mapping of the Mach-O object file * @param offset Offset of the Mach header in the file * @param is_64 Whether this is a 64-bit Mach-O header * @param cb Callback function to process strings * @param userdata User data for the callback * @param minLength Minimum string length to extract * * @return NULL on success, error message on failure */ static const char* dumpMachHeader(const FFMemoryMapping* mapping, off_t offset, bool is_64, bool (*cb)(const char* str, uint32_t len, void* userdata), void* userdata, uint32_t minLength) { uint32_t ncmds; off_t loadCommandsOffset = offset; if (is_64) { const struct mach_header_64* header = readData(mapping, sizeof(struct mach_header_64), offset); if (!header) { return "read mach header failed"; } ncmds = header->ncmds; loadCommandsOffset += sizeof(*header); } else { const struct mach_header* header = readData(mapping, sizeof(struct mach_header), offset); if (!header) { return "read mach header failed"; } ncmds = header->ncmds; loadCommandsOffset += sizeof(*header); } off_t commandOffset = loadCommandsOffset; const struct load_command* cmd = NULL; for (uint32_t i = 0U; i < ncmds; i++, commandOffset += cmd->cmdsize) { cmd = readData(mapping, sizeof(*cmd), commandOffset); if (!cmd) { break; } if (cmd->cmdsize < sizeof(*cmd)) { break; } if (cmd->cmd == LC_SEGMENT_64) { const struct segment_command_64* segment = readData(mapping, sizeof(struct segment_command_64), commandOffset); if (!segment) { continue; } if (!ffStrEquals(segment->segname, "__TEXT")) { continue; } for (uint32_t j = 0U; j < segment->nsects; j++) { off_t sectionOffset = commandOffset + (off_t) sizeof(*segment) + (off_t) (j * sizeof(struct section_64)); const struct section_64* section = readData(mapping, sizeof(struct section_64), sectionOffset); if (!section) { continue; } if (!handleMachSection(mapping, section->sectname, (off_t) section->offset, (size_t) section->size, cb, userdata, minLength)) { return NULL; } } } else if (cmd->cmd == LC_SEGMENT) { const struct segment_command* segment = readData(mapping, sizeof(struct segment_command), commandOffset); if (!segment) { continue; } if (!ffStrEquals(segment->segname, "__TEXT")) { continue; } for (uint32_t j = 0; j < segment->nsects; j++) { off_t sectionOffset = commandOffset + (off_t) sizeof(*segment) + (off_t) (j * sizeof(struct section)); const struct section* section = readData(mapping, sizeof(struct section), sectionOffset); if (!section) { continue; } if (!handleMachSection(mapping, section->sectname, (off_t) section->offset, (size_t) section->size, cb, userdata, minLength)) { return NULL; } } } } return NULL; } /** * Processes a Fat binary header (Universal binary) * * This function handles the fat header of a universal binary, which can contain * multiple Mach-O binaries for different architectures. It extracts and processes * each embedded Mach-O file. * * @param mapping Memory mapping of the universal binary * @param cb Callback function to process strings * @param userdata User data for the callback * @param minLength Minimum string length to extract * * @return NULL on success, error message on failure */ static const char* dumpFatHeader(const FFMemoryMapping* mapping, bool (*cb)(const char* str, uint32_t len, void* userdata), void* userdata, uint32_t minLength) { const struct fat_header* headerRaw = readData(mapping, sizeof(struct fat_header), 0); if (!headerRaw) { return "read fat header failed"; } struct fat_header header = *headerRaw; bool needSwap = header.magic == FAT_CIGAM || header.magic == FAT_CIGAM_64; if (needSwap) { swap_fat_header(&header, NX_UnknownByteOrder); } for (uint32_t i = 0U; i < header.nfat_arch; i++) { off_t machHeaderOffset = 0; if (header.magic == FAT_MAGIC) { off_t archOffset = (off_t) sizeof(struct fat_header) + (off_t) (i * sizeof(struct fat_arch)); const struct fat_arch* archRaw = readData(mapping, sizeof(struct fat_arch), archOffset); if (!archRaw) { continue; } struct fat_arch arch = *archRaw; if (needSwap) { swap_fat_arch(&arch, 1, NX_UnknownByteOrder); } machHeaderOffset = (off_t) arch.offset; } else { off_t archOffset = (off_t) sizeof(struct fat_header) + (off_t) (i * sizeof(struct fat_arch_64)); const struct fat_arch_64* archRaw = readData(mapping, sizeof(struct fat_arch_64), archOffset); if (!archRaw) { continue; } struct fat_arch_64 arch = *archRaw; if (needSwap) { swap_fat_arch_64(&arch, 1, NX_UnknownByteOrder); } machHeaderOffset = (off_t) arch.offset; } const uint32_t* magic = readData(mapping, sizeof(uint32_t), machHeaderOffset); if (!magic) { continue; } if (*magic == MH_MAGIC_64 || *magic == MH_MAGIC) { return dumpMachHeader(mapping, machHeaderOffset, *magic == MH_MAGIC_64, cb, userdata, minLength); } } return "Unsupported fat header"; } /** * Extracts string literals from a Mach-O (Apple) binary file * * This function supports both single-architecture Mach-O files and * universal binaries (fat binaries) containing multiple architectures. * It locates the __cstring section in the __TEXT segment which contains * the string literals used in the program. */ const char* ffBinaryExtractStrings(const char* machoFile, bool (*cb)(const char* str, uint32_t len, void* userdata), void* userdata, uint32_t minLength) { FF_AUTO_CLOSE_FD int fd = open(machoFile, O_RDONLY | O_CLOEXEC); if (fd < 0) { return "File could not be opened"; } struct stat st; if (fstat(fd, &st) != 0 || st.st_size <= 0) { return "Failed to stat file"; } FF_A_CLEANUP(wrapMunmap) FFMemoryMapping mapping = { .data = mmap(NULL, (size_t) st.st_size, PROT_READ, MAP_PRIVATE, fd, 0), .length = (size_t) st.st_size, }; if (mapping.data == MAP_FAILED) { return "mmap failed"; } // Read the magic number to determine the type of binary const uint32_t* magic = readData(&mapping, sizeof(uint32_t), 0); if (!magic) { return "read magic number failed"; } // Check for supported formats // MH_CIGAM and MH_CIGAM_64 seem to be no longer used, as `swap_mach_header` is marked as deprecated. // However FAT_CIGAM and FAT_CIGAM_64 are still used (/usr/bin/vim). if (*magic != MH_MAGIC && *magic != MH_MAGIC_64 && *magic != FAT_CIGAM && *magic != FAT_CIGAM_64 && *magic != FAT_MAGIC && *magic != FAT_MAGIC_64) { return "Unsupported format or big endian mach-o file"; } // Process either a fat binary or a regular Mach-O binary if (*magic == FAT_MAGIC || *magic == FAT_MAGIC_64 || *magic == FAT_CIGAM || *magic == FAT_CIGAM_64) { return dumpFatHeader(&mapping, cb, userdata, minLength); } else { return dumpMachHeader(&mapping, 0, *magic == MH_MAGIC_64, cb, userdata, minLength); } }