Mach-O 开头的内存结构

x = _dyld_get_image_header(0);

x为Mach-O起始地址。

x:

0x000: cf  fa  ed fe  0c  00 00 01 00 00 00 00 02 00  00 00  ????............

0x010: 57 00 00 00 e0  2e 00 00 85 00 21 00 00 00  00 00  W...?.....!.....

0x020: 19 00 00 00 48  00 00 00 5f  5f  50 41 47 45  5a 45  ....H...__PAGEZE

0x030: 52 4f  00  00 00 00 00 00 00 00 00 00 00 00 00  00   RO..............

struct mach_header {
	unsigned long	magic;		/* mach magic number identifier */
	cpu_type_t	cputype;	/* cpu specifier */
	cpu_subtype_t	cpusubtype;	/* machine specifier */
	unsigned long	filetype;	/* type of file */
	unsigned long	ncmds;		/* number of load commands */
	unsigned long	sizeofcmds;	/* the size of all the load commands */
	unsigned long	flags;		/* flags */
};

 

#define FAT_MAGIC 0xcafebabe

#define FAT_CIGAM 0xbebafeca

/* NXSwapLong(FAT_MAGIC) */

struct fat_header

{

uint32_t magic; /* FAT_MAGIC */

uint32_t nfat_arch; /* number of structs that follow */

};

第一个4字节为： cf  fa  ed fe   即0xFEEDFACF为 magic表示64位系统

#define CPU_ARCH_ABI64          0x01000000      /* 64 bit ABI */

#define CPU_TYPE_ARM            ((cpu_type_t) 12)

#define CPU_TYPE_ARM64          (CPU_TYPE_ARM | CPU_ARCH_ABI64)

第二个4字节为： 0c  00 00 01 即0x0100000c. 表示CPU_TYPE_ARM64

第三个4字节为：00 00 00 00 表示 cpusubtype

第四个4字节为： 02 00  00 00 是filetype，表示#define MH_EXECUTE 0x2 /* demand paged executable file */

ncmds：57 00 00 00  表示0x57个说明加载命令条数

sizeofcmds：e0  2e 00 00  表示加载命令大小

#define	MH_PIE           0x200000  	
#define MH_BINDS_TO_WEAK 0x010000
#define MH_TWOLEVEL      0x000080
#define MH_NOUNDEFS      0x000001
#define MH_DYLDLINK      0x000004

flags：85 00 21 00  即0x00210085标志位，该字段用位表示二进制文件支持的功能 

struct segment_command { /* for 32-bit architectures */
	uint32_t	cmd;		/* LC_SEGMENT */
	uint32_t	cmdsize;	/* includes sizeof section structs */
	char		segname[16];	/* segment name */
	uint32_t	vmaddr;		/* memory address of this segment */
	uint32_t	vmsize;		/* memory size of this segment */
	uint32_t	fileoff;	/* file offset of this segment */
	uint32_t	filesize;	/* amount to map from the file */
	vm_prot_t	maxprot;	/* maximum VM protection */
	vm_prot_t	initprot;	/* initial VM protection */
	uint32_t	nsects;		/* number of sections in segment */
	uint32_t	flags;		/* flags */
};

segment_command     

0x020: 19 00 00 00 48  00 00 00 5f  5f  50 41 47 45  5a 45   ....H...__PAGEZE

0x030: 52 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 00       RO..............

0x100d24040: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................

0x100d24050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

#define LC_SEGMENT_64 0x19   将段内数据加载映射到内存中去,0x48表示 cmdsize

0x028到0x032 是segname[16]; /* segment name */

0x038为vmaddr，这里是0x00

0x040 为vmsize，这里是0x100000000

0x048为fileoff，这里是0x00

0x050为filesize，这里是0