10_窥探Mach-O的工具

一、file：查看Mach-O的文件类型

file 文件路径

zhanglingli@bogon 逆向 % file weather                                          
weather: Mach-O universal binary with 2 architectures: [arm_v7:Mach-O executable arm_v7] [arm64:Mach-O 64-bit executable arm64]
weather (for architecture armv7):   Mach-O executable arm_v7
weather (for architecture arm64):   Mach-O 64-bit executable arm64

二、lipo：常用于多架构Mach-O文件的处理

• 查看架构信息：lipo -info 文件路径

zhanglingli@bogon 逆向 % lipo -info weather 
Architectures in the fat file: weather are: armv7 arm64 

• 导出某种特定架构：lipo 文件路径 -thin 架构类型 -output 输出文件路径

zhanglingli@bogon 逆向 % lipo weather -thin armv7 -output Weather_armv7
zhanglingli@bogon 逆向 % lipo weather -thin arm64 -output Weather_arm64

• 合并多种架构：lipo -create 文件路径1 文件路径2 -output 输出文件路径

zhanglingli@bogon 逆向 % lipo -create Weather_armv7 Weather_arm64 -output weater2

三、otool：查看Mach-O特定部分和段的内容

zhanglingli@bogon 逆向 % otool
Usage: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/otool [-arch arch_type] [-fahlLDtdorSTMRIHGvVcXmqQjCP] [-mcpu=arg] [--version] <object file> ...
    -f print the fat headers
    -a print the archive header
    -h print the mach header
    -l print the load commands
    -L print shared libraries used
    -D print shared library id name
    -t print the text section (disassemble with -v)
    -x print all text sections (disassemble with -v)
    -p <routine name>  start dissassemble from routine name
    -s <segname> <sectname> print contents of section
    -d print the data section
    -o print the Objective-C segment
    -r print the relocation entries
    -S print the table of contents of a library (obsolete)
    -T print the table of contents of a dynamic shared library (obsolete)
    -M print the module table of a dynamic shared library (obsolete)
    -R print the reference table of a dynamic shared library (obsolete)
    -I print the indirect symbol table
    -H print the two-level hints table (obsolete)
    -G print the data in code table
    -v print verbosely (symbolically) when possible
    -V print disassembled operands symbolically
    -c print argument strings of a core file
    -X print no leading addresses or headers
    -m don't use archive(member) syntax
    -B force Thumb disassembly (ARM objects only)
    -q use llvm's disassembler (the default)
    -Q use otool(1)'s disassembler
    -mcpu=arg use `arg' as the cpu for disassembly
    -j print opcode bytes
    -P print the info plist section as strings
    -C print linker optimization hints
    --version print the version of /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/otool

zhanglingli@bogon 逆向 % otool -h Weather_arm64
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
 0xfeedfacf 16777228          0  0x00           2    26       3736 0x00200085

四、MachOView（https://github.com/gdbinit/MachOView）

Snip20200804_2.png

五、class-dump

它的作用就是把Mach-O文件的class信息给dump出来（把类信息给导出来），生成对应的.h头文件

官方地址：http://stevenygard.com/projects/class-dump/

下载完工具包后将class-dump文件复制到Mac的/usr/local/bin目录，这样在终端就能识别class-dump命令了

常用格式：
class-dump -H Mach-O文件路径 -o 头文件存放目录
-H表示要生成头文件
-o用于制定头文件的存放目录

zhanglingli@bogon 逆向 % class-dump -H Weather_arm64 -o WeatherHeaders

六、Hopper Disassmbler

Hopper Disassmbler能够将Mach-O文件的机器语言代码反编译成汇编代码、OC伪代码或者Swift伪代码

常用快捷键
Shift + Option + X ：找出哪里引用了这个方法