Example of symbols enumeration about macho-kit

[k06a]

Right now I have a problem with mk_segment_t creation:

__block mk_memory_map_self_t memory_map;
mk_error_t err = mk_memory_map_self_init(NULL, &memory_map);
NSCAssert(err == MK_ESUCCESS, @"");

for (uint32_t i = 0; i < _dyld_image_count(); i++) {
    const char *image_name = _dyld_get_image_name(i);
    if ([[NSString stringWithCString:image_name encoding:NSUTF8StringEncoding] hasSuffix:@"/dyld_sim"]) {
        continue;
    }

    __block mk_macho_t macho;
    mk_vm_address_t headerAddress = (mk_vm_address_t)_dyld_get_image_header(i);
    intptr_t slide = _dyld_get_image_vmaddr_slide(i);
    mk_error_t err = mk_macho_init(NULL, image_name, slide, headerAddress, &memory_map, &macho);
    if (err != MK_ESUCCESS) {
        NSLog(@"Error parsiong MachO of %s", image_name);
        continue;
    }

    mk_macho_enumerate_commands(&macho, ^(struct load_command *load_command, uint32_t index, mk_vm_address_t host_address) {
        if (load_command->cmd != LC_SYMTAB && load_command->cmd != LC_DYSYMTAB) {
            return;
        }

        mk_load_command_t command_object;
        mk_error_t err = mk_load_command_init(&macho, load_command, &command_object);
        if (err != MK_ESUCCESS) {
            NSLog(@"Error creating MachO command");
            return;
        }

        mk_segment_t segment;
        err = mk_segment_init(&command_object, &segment); // <-- ERROR
        if (err != MK_ESUCCESS) {
            NSLog(@"Error creating MachO segment");
            return;
        }

        mk_symbol_table_t symbol_table;
        if (load_command->cmd == LC_SYMTAB) {
            mk_symbol_table_init(&segment, &command_object, NULL, &symbol_table);
        }
        else {
            mk_symbol_table_init(&segment, NULL, &command_object, &symbol_table);
        }

        mk_symbol_table_enumerate_mach_symbols(&symbol_table, 0, ^(const mk_mach_nlist symbol, uint32_t index, mk_vm_address_t host_address) {
            NSLog(@"");
        });
    });

    mk_macho_free(&macho);
}

My error is:

libMachO/libMachO/MachO_ABI/Segments/segment.c:61 The load_command used to initialize an mk_segment must be one of LC_SEGMENT or LC_SEGMENT64, got LC_SYMTAB

I think I need segment to init symbol table with it.

[DeVaukz]

You get that error because you can only initialize an mk_segment_t with an LC_SEGMENT_64 or LC_SEGMENT load command. I would use the mk_symbol_table_init_with_segment(...) convienience initializer for initializing the symbol table. It requires only the LinkEdit segment (it will find the SYMTAB and DYSYMTAB load commands for you).

    mk_macho_enumerate_commands(&macho, ^(struct load_command *load_command, uint32_t index, mk_vm_address_t host_address) {
        if (load_command->cmd != LC_SEGMENT_64 && load_command->cmd != LC_SEGMENT) {
            return;
        }

        struct segment_command_64 *segment_command = (typeof(segment_command))load_command; // The choice between casting to segment_command_64 vs segment_command does not matter here

        if (strncmp(load_command->segname, SEG_LINKEDIT, 16) != 0) {
            return;
        }

        mk_segment_t segment;
        err = mk_segment_init_with_mach_load_command(&macho, segment_command, &segment);
        if (err != MK_ESUCCESS) {
            NSLog(@"Error creating MachO segment");
            return;
        }

        mk_symbol_table_t symbol_table;
        err = mk_symbol_table_init_with_segment(&segment, &symbol_table);
        if (err != MK_ESUCCESS) {
            NSLog(@"Error creating MachO symbol table");
            return;
        }

        mk_symbol_table_enumerate_mach_symbols(&symbol_table, 0, ^(const mk_mach_nlist symbol, uint32_t index, mk_vm_address_t host_address) {
            NSLog(@"");
        });
    });

[k06a]

@DeVaukz thanks! Is it true I need to access string_table to get symbol chars?

__block mk_string_table_t string_table;
err = mk_string_table_init_with_segment(&segment, &string_table);
if (err != MK_ESUCCESS) {
    NSLog(@"Error creating MachO string table");
    return;
}

mk_symbol_table_enumerate_mach_symbols(&symbol_table, 0, ^(const mk_mach_nlist symbol, uint32_t index, mk_vm_address_t host_address) {
    uint32_t string_index = symbol.nlist_64->n_un.n_strx;
    const char *name = mk_string_table_get_string_at_offset(&string_table, string_index, &host_address);
    NSLog(@"Symbol: %s address: %x", name, (void *)host_address);
});

And do I need to calculate mk_vm_address_t - base address + real module address to get real symbol address in memory? I am trying to create map of addresses to symbols, some kind of DSYM-less symbolication.

[DeVaukz]

You need to initialize an mk_string_table_t and call mk_string_table_get_string_at_offset() to retrieve the symbol name.

For the address, assuming you are doing this in-process, add the result of mk_macho_get_slide() to the symbol n_value to get the in-process address.

[k06a]

@DeVaukz thanks! This code works fine for my purpose:

__block mk_string_table_t string_table;
err = mk_string_table_init_with_segment(&segment, &string_table);
if (err != MK_ESUCCESS) {
    NSLog(@"Error creating MachO string table");
    return;
}

mk_symbol_table_enumerate_mach_symbols(&symbol_table, 0, ^(const mk_mach_nlist symbol, uint32_t index, mk_vm_address_t host_address) {
    uint32_t string_index = symbol.nlist_64->n_un.n_strx;
#ifdef __LP64__
    uint64_t address = symbol.nlist_64->n_value + (uint64_t)slide;
#else
    uint64_t address = symbol.nlist->n_value + (uint64_t)slide;
#endif
    const char *str = mk_string_table_get_string_at_offset(&string_table, string_index, &host_address);
    if (strlen(str)) {
        NSLog(@"Symbol: %s address: %p", str, address);
    }
});

[k06a]

@DeVaukz thanks! Just published PuppyWatchdog pod with libMachO pod dependency: https://github.com/ML-Works/PuppyWatchdog