Re: Finding the architectures of a binary

• Subject: Re: Finding the architectures of a binary
• From: Iceberg-Dev <email@hidden>
• Date: Mon, 10 Nov 2008 14:48:12 +0100
• Delivered-to: email@hidden
• Delivered-to: email@hidden
• Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:in-reply-to:references :mime-version:content-type:message-id:cc:content-transfer-encoding :from:subject:date:to:x-mailer; bh=MMZ984YbNsBV/ssAQNMbJ3vVdPxNOXMWyduvyPq/u/w=; b=eNlm+hX89/wdZvh+jfRQbz2dVOMxmxBibzfgzuGEnseAx5itNL5lkKB0FVTZlH6LRw 7t9NlehmOB80BUE6PfQypg+da4hfFZQiqyA4g4qJ3Yuq2PmHrnXCP/KTk6Zv2R8aTYt0 Wz2RqeWANPqRDBkhLjEYn/B7tAnKNG8c7JRSk=
• Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=in-reply-to:references:mime-version:content-type:message-id:cc :content-transfer-encoding:from:subject:date:to:x-mailer; b=xQhQ4xUXreAXaeo9PZ44Kg51wL+rTpCh4ftMmIHx4VZE51sTGcNWGb3AUsETyteXXo qJx+n9Ao+JQ5xNP+5k2kaSIK5ChlFC6lwNPvCwx+CdXRjNzKlIIjzURFG5DPaf1Sszpa 5AsmZJT4XLyuDKWY9e3rPpllGqlbpHdT1LKi4=

On Nov 10, 2008, at 10:58 AM, Brian Bergstrand wrote:

On Nov 10, 2008, at 11:30 AM, Iceberg-Dev wrote:

I'm trying to find all the architectures available in a binary using code.

...

What I don't know/understand:

- I'm not sure to understand how you can inspect a binary without loading it in memory. It looks as if the dyld API work only with the running binary (no parameter for instance to enumerate the number of images with _dyld_image_count();).

- There doesn't seem to be an API for peff binaries. Is it safe to assume that the magic cookie is always at the beginning of the file?

Open the file and parse the info yourself using mach-o/loader.h and mach-o/fat.h. PEF is very rare these days, but you can do the same thing using CarbonCore/PEFBinaryFormat.h. Of course on OS X, PEF will only contain PPC code.

Thanks. I followed your suggestion.

Here's the code I come up with:

#import "ICArchitectureUtilities.h"

#include <mach-o/loader.h>
#include <mach-o/fat.h>

#include <CoreServices/CoreServices.h>

@implementation ICArchitectureUtilities

+ (NSArray *) architecturesOfFile:(NSString *) inPath
{
	if (inPath!=nil)
	{
		FILE * tFile;
	
		tFile=fopen([inPath fileSystemRepresentation],"r");
		
		if (tFile!=NULL)
		{
			uint32_t tMagicCookie;
			size_t tSize;
			
			tSize=sizeof(uint32_t);
			
			if (fread(&tMagicCookie,tSize,1,tFile)==1)
			{
				
#if BYTE_ORDER==LITTLE_ENDIAN
				tMagicCookie=CFSwapInt32(tMagicCookie);
#endif
				
				fseek(tFile,0,SEEK_SET);
				
				// PEF
					
				if (tMagicCookie==kPEFTag1)
				{
					PEFContainerHeader tContainerHeader;
					
					tSize=sizeof(PEFContainerHeader);
					
					if (fread(&tContainerHeader,tSize,1,tFile)==1)
					{

						if (tContainerHeader.tag2==kPEFTag2 &&
							tContainerHeader.architecture==kPowerPCCFragArch)
						{
							return [NSArray arrayWithObject:@"ppc"];
						}
					}
				}
				else
				{
					// mach-o
					
					if (tMagicCookie==FAT_MAGIC)
					{
						struct fat_header tFatHeader;
						
						tSize=sizeof(struct fat_header);
					
						if (fread(&tFatHeader,tSize,1,tFile)==1)
						{
							NSMutableArray * tMutableArray;
							
							tMutableArray=[NSMutableArray array];
							
							if (tMutableArray!=nil)
							{
								uint32_t i;
							
#if BYTE_ORDER==LITTLE_ENDIAN
								tFatHeader.nfat_arch=CFSwapInt32(tFatHeader.nfat_arch);
#endif

								for(i=0;i<tFatHeader.nfat_arch;i++)
								{
									struct fat_arch tFatArch;
								
									tSize=sizeof(struct fat_arch);
					
									if (fread(&tFatArch,tSize,1,tFile)==1)
									{
#if BYTE_ORDER==LITTLE_ENDIAN
										tFatArch.cputype=CFSwapInt32(tFatArch.cputype);
#endif										
									
										switch(tFatArch.cputype)
										{
											case CPU_TYPE_X86:
											
												[tMutableArray addObject:@"i386"];
												
												break;
												
											case CPU_TYPE_X86_64:
											
												[tMutableArray addObject:@"x86_64"];
												
												break;
												
											case CPU_TYPE_POWERPC:
											
												[tMutableArray addObject:@"ppc"];
												
												break;
												
											case CPU_TYPE_POWERPC64:
											
												[tMutableArray addObject:@"ppc64"];
												
												break;
										}
									
									}
								}
								
								[tMutableArray sortUsingSelector:@selector(compare:)];
								
								return tMutableArray;
							}
						}
					}
					else if (tMagicCookie==MH_MAGIC)
					{
						struct mach_header tMachHeader;
						
						tSize=sizeof(struct mach_header);
					
						if (fread(&tMachHeader,tSize,1,tFile)==1)
						{
#if BYTE_ORDER==LITTLE_ENDIAN
							tMachHeader.cputype=CFSwapInt32(tMachHeader.cputype);
#endif

							switch(tMachHeader.cputype)
							{
								case CPU_TYPE_X86:
								
									return [NSArray arrayWithObject:@"i386"];
									
								case CPU_TYPE_POWERPC:
								
									return [NSArray arrayWithObject:@"ppc"];
							}
						}
					}
					else if (tMagicCookie==MH_MAGIC_64)
					{
						struct mach_header_64 tMachHeader64;
						
						tSize=sizeof(struct mach_header_64);
					
						if (fread(&tMachHeader64,tSize,1,tFile)==1)
						{
#if BYTE_ORDER==LITTLE_ENDIAN
							tMachHeader64.cputype=CFSwapInt32(tMachHeader64.cputype);
#endif

							switch(tMachHeader64.cputype)
							{
								case CPU_TYPE_X86_64:
								
									return [NSArray arrayWithObject:@"x86_64"];
									
								case CPU_TYPE_POWERPC64:
								
									return [NSArray arrayWithObject:@"ppc64"];
							}
						}
					}
				}
			}
		}
	}
	
	return nil;
}

@end

_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/darwin-dev/email@hidden

• Follow-Ups:
  • Re: Finding the architectures of a binary
    • From: "Clark Cox" <email@hidden>

• Prev by Date: Re: Creating new thread
• Next by Date: Re: Finding the architectures of a binary
• Previous by thread: Re: Finding the architectures of a binary
• Next by thread: Re: Finding the architectures of a binary
• Index(es):
  • Date
  • Thread