美文网首页
macho 文件查看常用命令

macho 文件查看常用命令

作者: 繁星mind | 来源:发表于2019-01-18 17:42 被阅读8次

命令汇总

  1. file XXX
    查看macho文件架构信息和是否是动态库
ZBMAC:Frameworks XXX$ file /usr/lib/dyld
/usr/lib/dyld: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit dynamic linker x86_64] [i386:Mach-O dynamic linker i386]
/usr/lib/dyld (for architecture x86_64):    Mach-O 64-bit dynamic linker x86_64
/usr/lib/dyld (for architecture i386):  Mach-O dynamic linker i386

从上面信息可以看出来，dyld是一个dynamic linker（动态库），支持i386和 x86_64

2.lipo -info XXX
查看macho文件架构信息

ZBMAC:Frameworks XXX$ lipo -info  /usr/lib/dyld
Architectures in the fat file: /usr/lib/dyld are: x86_64 i386

从上面信息可以看出来，dyld支持i386和 x86_64架构

3.lipo XXX -thin arm64 -output XXX_arm64
提取arm64架构文件

4.ar -t XXX_arm64
查看提取arm64架构下，文件组成，打印.o文件集合

ZBMAC:Frameworks XXX$ ar -t XXX_arm64
A.o
B.o
C.o

5.ar xv XXX_arm64
提取arm64架构下，文件组成，会生成一个.o文件的集合。

6.ar rcs arm64 XXX文件夹/*.o
将上一步的所有.o文件合成一个 arm64架构，这一步主要是用于瘦身的时候，删除某个.o文件以后，重新组合其它.o文件。

7.ar -d -sv arm64 XXX.o
删除arm64架构中，某个.o文件。

8.otool -L XXX
查看macho文件依赖动态库

ZBMAC:Frameworks XXX$ otool -L /usr/lib/libobjc.dylib
/usr/lib/libobjc.dylib:
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /usr/lib/libc++abi.dylib (compatibility version 1.0.0, current version 400.8.0)
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 400.9.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.0.0)

从上面信息可以看出来，libobjc.dylib依赖libobjc.A.dylib 、libc++abi.dylib 、libc++.1.dylib、libSystem.B.dylib这四个动态库

9.otool -l Taobao4iPhone | grep crypt
查看macho文件是否被加密

ZBMAC:Taobao4iPhone.app XXX$ otool -l  Taobao4iPhone | grep crypt 
     cryptoff 16384
    cryptsize 53575680
      cryptid 0
     cryptoff 16384
    cryptsize 58785792
      cryptid 0

如果cryptid 为1，则表示是加密的，为0则是未加密，从上面信心可以看出macho文件未加密，因为我的macho文件是下载的越狱ipa，如果从appstore下载的，cryptid内容为1，为加密的。

10.otool -v -s __DATA __objc_selrefs XXX
查看macho文件中，被引用的方法，这个可以结合linkmap中的方法，分析出可执行文件中，无用的方法。

淘宝实例

如何获取macho文件，可以查看这篇文章 iOS 如何完全抓取出ipa包内的所有图片资源，把ipa包解压出来，里面就有macho文件。

下面我们以淘宝的macho文件为例，我用的淘宝8.4.0版本，查看相关信息：
1.架构信息

ZBMAC:Taobao4iPhone.app XXX$ file Taobao4iPhone
Taobao4iPhone: Mach-O universal binary with 2 architectures: [arm_v7:Mach-O executable arm_v7] [arm64]
Taobao4iPhone (for architecture armv7): Mach-O executable arm_v7
Taobao4iPhone (for architecture arm64): Mach-O 64-bit executable arm64

以上信息可以看出，淘宝支持arm_v7和arm64架构

2.淘宝依赖库信息

ZBMAC:Taobao4iPhone.app XXX$ otool -L Taobao4iPhone
Taobao4iPhone (architecture armv7):
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 400.9.1)
    /usr/lib/libc++abi.dylib (compatibility version 1.0.0, current version 400.7.0)
    /usr/lib/libicucore.A.dylib (compatibility version 1.0.0, current version 59.1.0)
    /usr/lib/libresolv.9.dylib (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libxml2.2.dylib (compatibility version 10.0.0, current version 10.9.0)
    /usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)
    @rpath/ALSharedExtension.framework/ALSharedExtension (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AVFoundation.framework/AVFoundation (compatibility version 1.0.0, current version 2.0.0)
    /System/Library/Frameworks/AVKit.framework/AVKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Accelerate.framework/Accelerate (compatibility version 1.0.0, current version 4.0.0)
    /System/Library/Frameworks/AdSupport.framework/AdSupport (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AddressBook.framework/AddressBook (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AddressBookUI.framework/AddressBookUI (compatibility version 1.0.0, current version 33.0.0)
    /System/Library/Frameworks/AssetsLibrary.framework/AssetsLibrary (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AudioToolbox.framework/AudioToolbox (compatibility version 1.0.0, current version 492.0.0)
    /System/Library/Frameworks/CFNetwork.framework/CFNetwork (compatibility version 1.0.0, current version 887.0.0)
    /System/Library/Frameworks/CoreAudio.framework/CoreAudio (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreBluetooth.framework/CoreBluetooth (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreData.framework/CoreData (compatibility version 1.0.0, current version 847.1.0)
    /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1443.0.0)
    /System/Library/Frameworks/CoreGraphics.framework/CoreGraphics (compatibility version 64.0.0, current version 1125.2.1)
    /System/Library/Frameworks/CoreImage.framework/CoreImage (compatibility version 1.0.0, current version 5.0.0)
    /System/Library/Frameworks/CoreLocation.framework/CoreLocation (compatibility version 1.0.0, current version 2235.0.2)
    /System/Library/Frameworks/CoreMedia.framework/CoreMedia (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreMotion.framework/CoreMotion (compatibility version 1.0.0, current version 2235.0.2)
    /System/Library/Frameworks/CoreTelephony.framework/CoreTelephony (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/CoreText.framework/CoreText (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreVideo.framework/CoreVideo (compatibility version 1.2.0, current version 1.5.0)
    /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1444.12.0)
    /System/Library/Frameworks/GLKit.framework/GLKit (compatibility version 1.0.0, current version 92.0.0)
    /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
    /System/Library/Frameworks/ImageIO.framework/ImageIO (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore (compatibility version 1.0.0, current version 604.1.38)
    /System/Library/Frameworks/LocalAuthentication.framework/LocalAuthentication (compatibility version 1.0.0, current version 425.1.13)
    /System/Library/Frameworks/MapKit.framework/MapKit (compatibility version 1.0.0, current version 14.0.0)
    /System/Library/Frameworks/MediaPlayer.framework/MediaPlayer (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MessageUI.framework/MessageUI (compatibility version 1.0.0, current version 3445.0.12)
    /System/Library/Frameworks/Metal.framework/Metal (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MobileCoreServices.framework/MobileCoreServices (compatibility version 1.0.0, current version 822.8.0)
    /System/Library/Frameworks/MultipeerConnectivity.framework/MultipeerConnectivity (compatibility version 1.0.0, current version 146.0.0)
    /System/Library/Frameworks/OpenGLES.framework/OpenGLES (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Photos.framework/Photos (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/QuartzCore.framework/QuartzCore (compatibility version 1.2.0, current version 1.11.0)
    /System/Library/Frameworks/SafariServices.framework/SafariServices (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Security.framework/Security (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/Social.framework/Social (compatibility version 1.0.0, current version 87.0.0)
    /System/Library/Frameworks/StoreKit.framework/StoreKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration (compatibility version 1.0.0, current version 963.0.0)
    /System/Library/Frameworks/UIKit.framework/UIKit (compatibility version 1.0.0, current version 3694.4.18)
    /System/Library/Frameworks/VideoToolbox.framework/VideoToolbox (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Contacts.framework/Contacts (compatibility version 0.0.0, current version 0.0.0)
    /System/Library/Frameworks/ContactsUI.framework/ContactsUI (compatibility version 1.0.0, current version 33.0.0)
    /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlight (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MetalPerformanceShaders.framework/MetalPerformanceShaders (compatibility version 1.0.0, current version 88.2.0)
    /System/Library/Frameworks/UserNotifications.framework/UserNotifications (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/WatchConnectivity.framework/WatchConnectivity (compatibility version 1.0.0, current version 157.0.0)
    /System/Library/Frameworks/WebKit.framework/WebKit (compatibility version 1.0.0, current version 604.1.38)
    @rpath/TBSharedFramework.framework/TBSharedFramework (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.0.0)
    /System/Library/Frameworks/EventKit.framework/EventKit (compatibility version 1.0.0, current version 100.0.0)
    /System/Library/Frameworks/HealthKit.framework/HealthKit (compatibility version 1.0.0, current version 1.0.0)
Taobao4iPhone (architecture arm64):
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 400.9.1)
    /usr/lib/libc++abi.dylib (compatibility version 1.0.0, current version 400.7.0)
    /usr/lib/libicucore.A.dylib (compatibility version 1.0.0, current version 59.1.0)
    /usr/lib/libresolv.9.dylib (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libxml2.2.dylib (compatibility version 10.0.0, current version 10.9.0)
    /usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)
    @rpath/ALSharedExtension.framework/ALSharedExtension (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AVFoundation.framework/AVFoundation (compatibility version 1.0.0, current version 2.0.0)
    /System/Library/Frameworks/AVKit.framework/AVKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Accelerate.framework/Accelerate (compatibility version 1.0.0, current version 4.0.0)
    /System/Library/Frameworks/AdSupport.framework/AdSupport (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AddressBook.framework/AddressBook (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AddressBookUI.framework/AddressBookUI (compatibility version 1.0.0, current version 33.0.0)
    /System/Library/Frameworks/AssetsLibrary.framework/AssetsLibrary (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AudioToolbox.framework/AudioToolbox (compatibility version 1.0.0, current version 492.0.0)
    /System/Library/Frameworks/CFNetwork.framework/CFNetwork (compatibility version 1.0.0, current version 887.0.0)
    /System/Library/Frameworks/CoreAudio.framework/CoreAudio (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreBluetooth.framework/CoreBluetooth (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreData.framework/CoreData (compatibility version 1.0.0, current version 847.1.0)
    /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1443.0.0)
    /System/Library/Frameworks/CoreGraphics.framework/CoreGraphics (compatibility version 64.0.0, current version 1125.2.1)
    /System/Library/Frameworks/CoreImage.framework/CoreImage (compatibility version 1.0.0, current version 5.0.0)
    /System/Library/Frameworks/CoreLocation.framework/CoreLocation (compatibility version 1.0.0, current version 2235.0.2)
    /System/Library/Frameworks/CoreMedia.framework/CoreMedia (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreMotion.framework/CoreMotion (compatibility version 1.0.0, current version 2235.0.2)
    /System/Library/Frameworks/CoreTelephony.framework/CoreTelephony (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/CoreText.framework/CoreText (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreVideo.framework/CoreVideo (compatibility version 1.2.0, current version 1.5.0)
    /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1444.12.0)
    /System/Library/Frameworks/GLKit.framework/GLKit (compatibility version 1.0.0, current version 92.0.0)
    /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
    /System/Library/Frameworks/ImageIO.framework/ImageIO (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore (compatibility version 1.0.0, current version 604.1.38)
    /System/Library/Frameworks/LocalAuthentication.framework/LocalAuthentication (compatibility version 1.0.0, current version 425.1.13)
    /System/Library/Frameworks/MapKit.framework/MapKit (compatibility version 1.0.0, current version 14.0.0)
    /System/Library/Frameworks/MediaPlayer.framework/MediaPlayer (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MessageUI.framework/MessageUI (compatibility version 1.0.0, current version 3445.0.12)
    /System/Library/Frameworks/Metal.framework/Metal (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MobileCoreServices.framework/MobileCoreServices (compatibility version 1.0.0, current version 822.8.0)
    /System/Library/Frameworks/MultipeerConnectivity.framework/MultipeerConnectivity (compatibility version 1.0.0, current version 146.0.0)
    /System/Library/Frameworks/OpenGLES.framework/OpenGLES (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Photos.framework/Photos (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/QuartzCore.framework/QuartzCore (compatibility version 1.2.0, current version 1.11.0)
    /System/Library/Frameworks/SafariServices.framework/SafariServices (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Security.framework/Security (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/Social.framework/Social (compatibility version 1.0.0, current version 87.0.0)
    /System/Library/Frameworks/StoreKit.framework/StoreKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration (compatibility version 1.0.0, current version 963.0.0)
    /System/Library/Frameworks/UIKit.framework/UIKit (compatibility version 1.0.0, current version 3694.4.18)
    /System/Library/Frameworks/VideoToolbox.framework/VideoToolbox (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Contacts.framework/Contacts (compatibility version 0.0.0, current version 0.0.0)
    /System/Library/Frameworks/ContactsUI.framework/ContactsUI (compatibility version 1.0.0, current version 33.0.0)
    /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlight (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MetalPerformanceShaders.framework/MetalPerformanceShaders (compatibility version 1.0.0, current version 88.2.0)
    /System/Library/Frameworks/UserNotifications.framework/UserNotifications (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/WatchConnectivity.framework/WatchConnectivity (compatibility version 1.0.0, current version 157.0.0)
    /System/Library/Frameworks/WebKit.framework/WebKit (compatibility version 1.0.0, current version 604.1.38)
    @rpath/TBSharedFramework.framework/TBSharedFramework (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.0.0)
    /System/Library/Frameworks/EventKit.framework/EventKit (compatibility version 1.0.0, current version 100.0.0)
    /System/Library/Frameworks/HealthKit.framework/HealthKit (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libcompression.dylib (compatibility version 1.0.0, current version 1.0.0)

以上依赖库中，/System/Library/和/usr/lib/路径均为系统动态库，@rpath/为自己封装到ipa中的动态库。

相关文章

  • macho 文件查看常用命令

    命令汇总 file XXX查看macho文件架构信息和是否是动态库 从上面信息可以看出来，dyld是一个dynam...

  • IOS 逆向工具的使用

    工具的使用 MachO View 查看MachO（可执行文件）的文件信息 LLDB low level debug...

  • 6.MachO

    MachO文件 MachO文件 MachO文件结构 DYLD Mach-O其实是Mach Object文件格式的缩...

  • MachO 文件解析

    如何查看MachO文件 下载ipa文件（砸壳之后的）->解压缩->找到ipa同名的文件->显示包内容 通过Mach...

  • iOS逆向-砸壳（Clutch & dumpdecryp

    MachO文件 -> 苹果加密 -> 加壳文件加壳文件 -> 苹果解密 -> MachO文件（DYLD） 解密过程...

  • Git常用命令

    Git常用命令 查看、添加、提交、删除、找回，重置修改文件 查看文件diff 查看提交记录 查看、切换、创建和删除...

  • 2018-08-22linux 命令操作

    查看日志流程 查看文件常用命令 cat 文件名 :打开文件输出至控制台 more 文件名: 打开文件从头查看,手动...

  • Linux--常用命令第一篇

    一.常用命令 - ifconfig 查看网络 $ ifconfig - ls 查看文件 $ ls $ ls -a ...

  • py基础之Linux基础（一）

    Linux 基础 常用命令 帮助命令 查看文件 使用cat和并文件 编辑文件 查看历史命令 查看文件只显示一屏 一...

  • Linux常用命令ls、cat、mv、touch

    常用命令： ls：查看当前目录下文件 ls 查看当前目录下文件（不包含隐藏文件） ls -a 查看当前目录下文件（...

网友评论

      本文标题：macho 文件查看常用命令

      本文链接：https://www.haomeiwen.com/subject/ssendqtx.html

      延伸阅读

      深度阅读

      • 您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！

      栏目导航

      热点阅读

      关于我们|服务条款|联系我们|macho 文件查看常用命令|投稿指南|网站地图|RSS订阅|排版工具|手机版

      提供经典美文摘抄,优美散文欣赏,现代诗歌精选,短篇小说,心情随笔,表白情书范文,故事会在线阅读欣赏

      Copyright © 2014-2023 Haomeiwen.com All Rights Reserved. 好美文阅读网 版权所有

      备案信息：桂公网安备 45052102000051号 · 桂ICP备13007215号-3

      本站所收录作品、热点评论等信息部分来源互联网，目的只是为了系统归纳学习和传递资讯

      所有作品版权归原创作者所有，与本站立场无关，如不慎侵犯了你的权益，请联系我们告知，我们将做删除处理！