加密软件VMProtect教程：使用脚本Mach-O文件

VMProtect是新一代软件保护实用程序。VMProtect支持德尔菲、Borland C Builder、Visual C/C++、Visual Basic（本机）、Virtual Pascal和XCode编译器。

同时，VMProtect有一个内置的反汇编程序，可以与Windows和Mac OS X可执行文件一起使用，并且还可以链接编译器创建的MAP文件，以快速选择要保护的代码片段。

为了轻松实现应用程序保护任务的自动化，VMProtect实现了内置脚本语言。VMProtect完全支持Windows系列的32/64位操作系统（从Windows 2000开始）和Mac OSX（从版本10.6开始）。重要的是，无论目标平台如何，VMProtect都支持所有范围的可执行文件，即Windows版本可以处理Mac OS X版本的文件，反之亦然。

VMProtect最新版下载（qun：766135708）https://www.evget.com/product/1859/download

常量，以配合Mach-O格式：

enum MacFormat {  	// Load Command Types  	LC_SEGMENT,  	LC_SYMTAB,  	LC_SYMSEG,  	LC_THREAD,  	LC_UNIXTHREAD,  	LC_LOADFVMLIB,  	LC_IDFVMLIB,  	LC_IDENT,  	LC_FVMFILE,  	LC_PREPAGE,  	LC_DYSYMTAB,  	LC_LOAD_DYLIB,  	LC_ID_DYLIB,  	LC_LOAD_DYLINKER,  	LC_PREBOUND_DYLIB,  	LC_ROUTINES,  	LC_SUB_FRAMEWORK,  	LC_SUB_UMBRELLA,  	LC_SUB_CLIENT,  	LC_SUB_LIBRARY,  	LC_TWOLEVEL_HINTS,  	LC_PREBIND_CKSUM,  	LC_LOAD_WEAK_DYLIB,  	LC_SEGMENT_64,  	LC_ROUTINES_64,  	LC_UUID,  	LC_RPATH,  	LC_CODE_SIGNATURE,  	LC_SEGMENT_SPLIT_INFO,  	LC_REEXPORT_DYLIB,  	LC_LAZY_LOAD_DYLIB,  	LC_ENCRYPTION_INFO,  	LC_DYLD_INFO,  	LC_DYLD_INFO_ONLY,  	LC_LOAD_UPWARD_DYLIB,  	LC_VERSION_MIN_MACOSX,  	// Section Types	  	SECTION_TYPE,  	SECTION_ATTRIBUTES,  	S_REGULAR,  	S_ZEROFILL,  	S_CSTRING_LITERALS,  	S_4BYTE_LITERALS,  	S_8BYTE_LITERALS,  	S_LITERAL_POINTERS,  	S_NON_LAZY_SYMBOL_POINTERS,  	S_LAZY_SYMBOL_POINTERS,  	S_SYMBOL_STUBS,  	S_MOD_INIT_FUNC_POINTERS,  	S_MOD_TERM_FUNC_POINTERS,  	S_COALESCED,  	S_GB_ZEROFILL,  	S_INTERPOSING,  	S_16BYTE_LITERALS,  	S_DTRACE_DOF,  	S_LAZY_DYLIB_SYMBOL_POINTERS,  	SECTION_ATTRIBUTES_USR,  	S_ATTR_PURE_INSTRUCTIONS,  	S_ATTR_NO_TOC,  	S_ATTR_STRIP_STATIC_SYMS,  	S_ATTR_NO_DEAD_STRIP,  	S_ATTR_LIVE_SUPPORT,  	S_ATTR_SELF_MODIFYING_CODE,  	S_ATTR_DEBUG,  	SECTION_ATTRIBUTES_SYS,  	S_ATTR_SOME_INSTRUCTIONS,  	S_ATTR_EXT_RELOC,  	S_ATTR_LOC_RELOC  };

一个处理Mach-O文件的课程：

class MacFile {  public:  	string name(); // returns the name of the file  	string format(); // returns the name of the "Mach-O" format  	uint64 size(); // returns the size of the file  	int count(); // returns the number of architectures in the list  	MacArchitecture item(int index); // returns an architecture with the given index  	uint64 seek(uint64 offset); // sets the file position  	uint64 tell(); // returns the file position  	int write(string buffer); // writes a buffer to the file  };

一个使用Mach-O架构的课程：

class MacArchitecture {  public:  	string name(); // returns the name of the architecture  	MacFile file(); // returns the parent file  	uint64 entryPoint(); // returns the starting address  	OperandSize cpuAddressSize(); // returns bit count of the architecture  	uint64 size(); // returns the size of the architecture  	MacSegments segments(); // returns the list of segments  	MacSections sections(); // returns the list of sections  	MacCommands commands(); // returns the list of load commands  	MacSymbols symbols(); // returns the list of symbols  	MacImports imports(); // returns the list of imported libraries  	MacExports exports(); // returns the list of exported functions  	MacFixups fixups(); // returns the list of fixups (relocations)  	MapFunctions mapFunctions(); // returns the list of functions available for protection  	IntelFunctions functions(); // returns the list of protected functions  	bool addressSeek(uint64 address); // sets the file position  	uint64 seek(uint64 offset); // sets the file position  	uint64 tell(); // returns the file position  	int write(string buffer); // writes a buffer to the file  };

一个用于处理Mach-O结构段列表的类：

class MacSegments {  public:  	MacSegment item(int index); // returns a segment with the given index  	int count(); // returns the number of segments in the list  	MacSegment itemByAddress(); // returns a segment at the given address  };

一个与Mach-O架构段合作的课程：

class MacSegment {  public:  	uint64 address(); // returns the address of the segment  	string name(); // returns the name of the segment  	uint64 size(); // returns the size of the segment  	int physicalOffset(); // returns the file position of the segment  	int physicalSize(); // returns the file size of the segment  	int flags(); // returns flags of the segment  	bool excludedFromPacking(); // returns the "Excluded from packing" property  };

一个处理Mach-O架构部分列表的类：

class MacSections {  public:  	MacSection item(int index); // returns a section with the given index  	int count(); // returns the number of sections in the list  	MacSection itemByAddress(uint64 address); // returns a section at the given address  };

一个与Mach-O架构部分合作的类：

class MacCommands {  public:  	MacCommand item(int index); // returns a command with the given index  	int count(); // returns the number of command in the list  	MacCommand itemByType(int type); // returns a command of the given type  };

一个用于处理Mach-O架构加载命令列表的类：

class MacCommand {  public:  	uint64 address(); // returns the address of the command  	int type(); // returns the type of the command  	string name(); // returns the name of the command  	int size(); // returns the size of the command  };

一个处理Mach-O架构符号列表的类：

class MacSymbols {  public:  	MacSymbol item(int index); // returns a symbol with the given index  	int count(); // returns the number of symbols in the list  };

一个使用马赫-O架构符号的类：

class MacSymbol {  public:  	uint64 value(); // returns the value of the symbol  	string name(); // returns the name of the symbol  };

一个用于处理Mach-O架构的导入库列表的类：

class MacImports {  public:  	MacImport item(int index); // returns an imported library with the given index  	int count(); // returns the number of imported libraries in the list  	MacImport itemByName(string name); // returns an imported library with the given name  };

一个与Mach-O架构的导入库一起工作的类：

class MacImport {  public:  	string name(); // returns the name of the imported library  	MacImportFunction item(int index); // returns an imported function with the given index  	int count(); // returns the number of imported functions in the list  	void setName(string name); // sets the name of the imported library  };

一个使用Mach-O架构导入函数的类：

class MacImportFunction {  public:  	uint64 address(); // returns the memory address where the address of the imported function is stored  	string name(); // returns the name of the imported function  };

一个用于处理Mach-O架构的导出函数列表的类：

class MacExports {  public:  	string name(); // returns the name of the library  	MacExport item(); // returns an exported function with the given index  	int count(); // returns the number of exported functions in the list  	void clear(); // clears the list  	MacExport itemByAddress(uint64 address); // returns an exported function at the given address  	MacExport itemByName(string name); // returns an exported function with the given name  };

一个与Mach-O架构导出的函数一起工作的类：

class MacExport {  public:  	uint64 address(); // returns the address of the exported function  	string name(); // returns the name of the exported function  	string forwardedName(); // returns the name of the function the exported function is forwarded to  	void destroy(); // destroys the exported function  };

一个用于处理Mach-O架构的修复（重新定位）列表的类：

class MacFixups {  public:  	MacFixup item(int index); // returns an element with the given index  	int count(); // returns the number of elements in the list  	MacFixup itemByAddress(uint64 address); // returns an element at the given address  };

一个与Mach-O架构固定工作的类：

class MacFixup { public: uint64 address(); // returns the address of the element };

获取完整>>>vmprotect 中文支持手册