#define SG_HIGHVM 0x1 /* the file contents for this segment is for the high part of the VM space, the low part is zero filled (for stacks in core files) */ #define SG_FVMLIB 0x2 /* this segment is the VM that is allocated by a fixed VM library, for overlap checking in the link editor */ #define SG_NORELOC 0x4 /* this segment has nothing that was relocated in it and nothing relocated to it, that is it maybe safely replaced without relocation*/ #define SG_PROTECTED_VERSION_1 0x8 /* This segment is protected. If the segment starts at file offset 0, the first page of the segment is not protected. All other pages of the segment are protected. */
SECTION
一个段(Segment)是由 0 到 n 个区(section)组成的:
1 2 3 4 5 6 7 8 9 10 11 12 13
struct section { /* for 32-bit architectures */ char sectname[16]; /* name of this section */ char segname[16]; /* segment this section goes in */ uint32_t addr; /* memory address of this section */ uint32_t size; /* size in bytes of this section */ uint32_t offset; /* file offset of this section */ uint32_t align; /* section alignment (power of 2) */ uint32_t reloff; /* file offset of relocation entries */ uint32_t nreloc; /* number of relocation entries */ uint32_t flags; /* flags (section type and attributes)*/ uint32_t reserved1; /* reserved (for offset or index) */ uint32_t reserved2; /* reserved (for count or sizeof) */ };
0x000000ff最后2位定义section type 0xffffff00前面6位定义section attributes
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
section type: ... #define S_REGULAR 0x0 /* regular section */ #define S_ZEROFILL 0x1 /* zero fill on demand section */ #define S_CSTRING_LITERALS 0x2 /* section with only literal C strings*/ #define S_SYMBOL_STUBS 0x8 /* section with only symbol stubs, byte size of stub in the reserved2 field */ ... section attributes: #define S_ATTR_PURE_INSTRUCTIONS 0x80000000 /* section contains only true machine instructions */ #define S_ATTR_SOME_INSTRUCTIONS 0x00000400 /* section contains some machine instructions */ ...
而这些不同的flag标志构成了不同的section:
section
用途
__text
主程序代码
stubs, stub_helper
用于动态链接的stub
__cstring
程序中硬编码的字符串
…
…
__TEXT.__obj_method
OC方法名
…
…
__DATA.__bss
BSS
…
…
1 2 3 4 5 6
`S_ATTR_PURE_INSTRUCTIONS`: This section contains only executable machine instructions. The standard tools set this flag for the sections __TEXT,__text, __TEXT,__symbol_stub, and __TEXT,__picsymbol_stub. `S_ATTR_SOME_INSTRUCTIONS`: This section contains executable machine instructions. ... `S_REGULAR`: This section has no particular type. The standard tools create a __TEXT,__text section of this type. `S_ZEROFILL`: Zero-fill-on-demand section—when this section is first read from or written to, each page within is automatically filled with bytes containing zero. __DATA.__bss `S_CSTRING_LITERALS`: This section contains only constant C strings. The standard tools create a __TEXT,__cstring section of this type.
struct dylib { union lc_str name; /* library's path name */ uint32_t timestamp; /* library's build time stamp */ uint32_t current_version; /* library's current version number */ uint32_t compatibility_version; /* library's compatibility vers number*/ };
union lc_str { uint32_t offset; /* offset to the string */ #ifndef __LP64__ char *ptr; /* pointer to the string */ #endif };
dyld加载命令
<3>. LC_CODE_SIGNATURE
1 2 3 4 5 6 7 8 9
struct linkedit_data_command { uint32_t cmd; /* LC_CODE_SIGNATURE, LC_SEGMENT_SPLIT_INFO, LC_FUNCTION_STARTS, LC_DATA_IN_CODE, LC_DYLIB_CODE_SIGN_DRS or LC_LINKER_OPTIMIZATION_HINT. */ uint32_t cmdsize; /* sizeof(struct linkedit_data_command) */ uint32_t dataoff; /* file offset of data in __LINKEDIT segment */ uint32_t datasize; /* file size of data in __LINKEDIT segment */ };
/* Check to see if SUGID scripts are permitted. If they aren't then * clear the SUGID bits. * imgp->ip_vattr is known to be valid. */ if (sugid_scripts == 0) { imgp->ip_origvattr->va_mode &= ~(VSUID | VSGID); }
/* Try to find the first non-whitespace character */ for( ihp = &vdata[2]; ihp < &vdata[IMG_SHSIZE]; ihp++ ) { if (IS_EOL(*ihp)) { /* Did not find interpreter, "#!\n" */ return (ENOEXEC); } else if (IS_WHITESPACE(*ihp)) { /* Whitespace, like "#! /bin/sh\n", keep going. */ } else { /* Found start of interpreter */ break; } } ... /* The character after the last non-whitespace is our logical end of line */ line_endp = ihp + 1;
/* * Now we have pointers to the usable part of: * * "#! /usr/bin/int first second third \n" * ^ line_startp ^ line_endp */
/* copy the interpreter name */ interp = imgp->ip_interp_buffer; for ( ihp = line_startp; (ihp < line_endp) && !IS_WHITESPACE(*ihp); ihp++) *interp++ = *ihp; *interp = '\0';
