Skip to content
forked from gdbinit/MachOView

MachOView fork, slightly updated unless patches are merged

Notifications You must be signed in to change notification settings

keith/MachOView

This branch is 5 commits ahead of, 69 commits behind gdbinit/MachOView:master.

Folders and files

NameName
Last commit message
Last commit date

Latest commit

e4be386 · Jun 13, 2023

History

58 Commits
Mar 2, 2014
Apr 23, 2015
Jun 13, 2023
Mar 1, 2014
Jun 13, 2023
Sep 6, 2013
Sep 8, 2013
Mar 1, 2014
Sep 6, 2013
Apr 23, 2015
Sep 8, 2013
Apr 23, 2015
Oct 13, 2012
Nov 20, 2014
Mar 1, 2014
Apr 23, 2015
Apr 23, 2015
Sep 6, 2013
Sep 6, 2013
Oct 13, 2012
Aug 18, 2021
Oct 13, 2012
Apr 23, 2015
Oct 13, 2012
Apr 23, 2015
Sep 6, 2013
Apr 23, 2015
Apr 23, 2015
Apr 23, 2015
Aug 18, 2021
Mar 1, 2014
Apr 23, 2015
Oct 13, 2012
Jun 13, 2023
Apr 23, 2015
Apr 23, 2015
Oct 13, 2012
Apr 23, 2015
Mar 2, 2014
Apr 23, 2015
Apr 23, 2015
Jun 24, 2020
Apr 23, 2015
Apr 23, 2015
Apr 23, 2015
Sep 2, 2014
Apr 23, 2015
Mar 1, 2014
Oct 13, 2012
Oct 13, 2012
Oct 13, 2012
Oct 13, 2012

Repository files navigation

   _____                .__     ____________   ____.__               
  /     \ _____    ____ |  |__  \_____  \   \ /   /|__| ______  _  __
 /  \ /  \\__  \ _/ ___\|  |  \  /   |   \   Y   / |  |/ __ \ \/ \/ /
/    Y    \/ __ \\  \___|   Y  \/    |    \     /  |  \  ___/\     / 
\____|__  (____  /\___  >___|  /\_______  /\___/   |__|\___  >\/\_/  
        \/     \/     \/     \/         \/                 \/        

A fork from MachOView to update and fix some bugs, mostly Mountain Lion & iOS 6 related.
Also some small changes to the original behaviour.

Original MachOView by psaghelyi at http://sourceforge.net/projects/machoview/.
Thanks to psaghelyi for his great work :-)

Latest versions are Lion+ only.
The LLVM disassembler was replaced with Capstone. This eliminates Clang/LLVM packages requirements.
The downside is that Capstone stops disassembling on bad instructions which means that for now data in code and jump tables data will create problems and __text section disassembly might be incomplete in binaries that contain such data.
Capstone improved disassembly on error but data in code locations are available in header so this can and should be improved.

A static Capstone library extracted from the official DMG is included in the repo.
If you want to be safe you should download Capstone and compile it yourself.

Now features the attach option to analyse headers of a running process.
To use this feature you will need to codesign the binary.
Follow this LLDB guide to create the certificate and then codesign MachOView binary.
https://llvm.org/svn/llvm-project/lldb/trunk/docs/code-signing.txt
The necessary entitlements are already added to Info.plist.

Be warned that this allows MachOView to have task_for_pid() privs under current under and control
every process from user running it.
The whole Mach-O parsing code needs to be reviewed and made more robust.

Enjoy,
fG!

Note:
This repo is frozen in time and there are kinda active forks out there.
The main problem of this codebase is that the Mach-O parser has quite some problems
and needs a significant overhaul to make it more robust and secure.
I do have much better code but it's under NDAs etc and I don't have energy to reinvent
the wheel once again. Secure executable binary parsing is a ton of work in C/C++.
It's possible but it's is exhausting.

About

MachOView fork, slightly updated unless patches are merged

Resources

Stars

Watchers

Forks

Packages

No packages published

Languages

  • POV-Ray SDL 49.8%
  • C++ 30.5%
  • C 15.1%
  • Objective-C++ 4.4%
  • Objective-C 0.2%
  • Shell 0.0%