Skip to content

collection of utils help to analysis macho binaries

Notifications You must be signed in to change notification settings

eeeyes/macho_analysis

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

9 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

#MachoAnalysis

MachoAnalysis is a collection of utils written in python2 to help developers analysis Mach-O Binaries.At this time,it can help us to figure out which module call some target functions,and the dependencies between the modules in a binary.

##UseAge

To figure out which module call some target functions,you can do this in your python script:

import macho_analysis;

module_array = macho_analysis.utils.findCallingSymbolModule("_NSLog","linkmap_path","disassemblyfile_path")];

The findCallingSymbolModule function take three arguments,which are the name of the symbol(in this case,is the _NSLog),the path to the linkmap file which is generated by xcode, and the path to disassembly code file generated by otool(otool -t -V -arch [arch] [macho_path]) util in xcode app.It returns an array contains the name of all the modules that call the symbol.

To find the dependencies between the modules,you can do this in your python script:

import macho_analysis;

lib_dep_hash = macho_analysis.utils.findDependency(lib_path_array,'armv7');

The findDependency function takes two arguments,the first is an array contains the paths to the libs,and the second is the arch name which will be passed to the nm utils in the xcode.It returns a dictionary,the key is the lib name,and its value is also a dictionary,which map the lib's undefined symbol to the module that defines it.

##Prerequisites

We need xcode to run this tool.

About

collection of utils help to analysis macho binaries

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages