| 1 | use alloc::vec::Vec; |
| 2 | use core::slice; |
| 3 | |
| 4 | use crate::endian::{Endian, Endianness}; |
| 5 | use crate::macho; |
| 6 | use crate::read::{Architecture, Error, File, ReadError, ReadRef, Result}; |
| 7 | |
| 8 | /// A parsed representation of the dyld shared cache. |
| 9 | #[derive (Debug)] |
| 10 | pub struct DyldCache<'data, E = Endianness, R = &'data [u8]> |
| 11 | where |
| 12 | E: Endian, |
| 13 | R: ReadRef<'data>, |
| 14 | { |
| 15 | endian: E, |
| 16 | data: R, |
| 17 | subcaches: Vec<DyldSubCache<'data, E, R>>, |
| 18 | mappings: &'data [macho::DyldCacheMappingInfo<E>], |
| 19 | images: &'data [macho::DyldCacheImageInfo<E>], |
| 20 | arch: Architecture, |
| 21 | } |
| 22 | |
| 23 | /// Information about a subcache. |
| 24 | #[derive (Debug)] |
| 25 | pub struct DyldSubCache<'data, E = Endianness, R = &'data [u8]> |
| 26 | where |
| 27 | E: Endian, |
| 28 | R: ReadRef<'data>, |
| 29 | { |
| 30 | data: R, |
| 31 | mappings: &'data [macho::DyldCacheMappingInfo<E>], |
| 32 | } |
| 33 | |
| 34 | /// A slice of structs describing each subcache. The struct gained |
| 35 | /// an additional field (the file suffix) in dyld-1042.1 (macOS 13 / iOS 16), |
| 36 | /// so this is an enum of the two possible slice types. |
| 37 | #[derive (Debug, Clone, Copy)] |
| 38 | #[non_exhaustive ] |
| 39 | pub enum DyldSubCacheSlice<'data, E: Endian> { |
| 40 | /// V1, used between dyld-940 and dyld-1042.1. |
| 41 | V1(&'data [macho::DyldSubCacheEntryV1<E>]), |
| 42 | /// V2, used since dyld-1042.1. |
| 43 | V2(&'data [macho::DyldSubCacheEntryV2<E>]), |
| 44 | } |
| 45 | |
| 46 | // This is the offset of the end of the images_across_all_subcaches_count field. |
| 47 | const MIN_HEADER_SIZE_SUBCACHES_V1: u32 = 0x1c8; |
| 48 | |
| 49 | // This is the offset of the end of the cacheSubType field. |
| 50 | // This field comes right after the images_across_all_subcaches_count field, |
| 51 | // and we don't currently have it in our definition of the DyldCacheHeader type. |
| 52 | const MIN_HEADER_SIZE_SUBCACHES_V2: u32 = 0x1d0; |
| 53 | |
| 54 | impl<'data, E, R> DyldCache<'data, E, R> |
| 55 | where |
| 56 | E: Endian, |
| 57 | R: ReadRef<'data>, |
| 58 | { |
| 59 | /// Parse the raw dyld shared cache data. |
| 60 | /// |
| 61 | /// For shared caches from macOS 12 / iOS 15 and above, the subcache files need to be |
| 62 | /// supplied as well, in the correct order, with the `.symbols` subcache last (if present). |
| 63 | /// For example, `data` would be the data for `dyld_shared_cache_x86_64`, |
| 64 | /// and `subcache_data` would be the data for `[dyld_shared_cache_x86_64.1, dyld_shared_cache_x86_64.2, ...]`. |
| 65 | pub fn parse(data: R, subcache_data: &[R]) -> Result<Self> { |
| 66 | let header = macho::DyldCacheHeader::parse(data)?; |
| 67 | let (arch, endian) = header.parse_magic()?; |
| 68 | let mappings = header.mappings(endian, data)?; |
| 69 | |
| 70 | let symbols_subcache_uuid = header.symbols_subcache_uuid(endian); |
| 71 | let subcaches_info = header.subcaches(endian, data)?; |
| 72 | let subcaches_count = match subcaches_info { |
| 73 | Some(DyldSubCacheSlice::V1(subcaches)) => subcaches.len(), |
| 74 | Some(DyldSubCacheSlice::V2(subcaches)) => subcaches.len(), |
| 75 | None => 0, |
| 76 | }; |
| 77 | if subcache_data.len() != subcaches_count + symbols_subcache_uuid.is_some() as usize { |
| 78 | return Err(Error("Incorrect number of SubCaches" )); |
| 79 | } |
| 80 | |
| 81 | // Split out the .symbols subcache data from the other subcaches. |
| 82 | let (symbols_subcache_data_and_uuid, subcache_data) = |
| 83 | if let Some(symbols_uuid) = symbols_subcache_uuid { |
| 84 | let (sym_data, rest_data) = subcache_data.split_last().unwrap(); |
| 85 | (Some((*sym_data, symbols_uuid)), rest_data) |
| 86 | } else { |
| 87 | (None, subcache_data) |
| 88 | }; |
| 89 | |
| 90 | // Read the regular SubCaches, if present. |
| 91 | let mut subcaches = Vec::new(); |
| 92 | if let Some(subcaches_info) = subcaches_info { |
| 93 | let (v1, v2) = match subcaches_info { |
| 94 | DyldSubCacheSlice::V1(s) => (s, &[][..]), |
| 95 | DyldSubCacheSlice::V2(s) => (&[][..], s), |
| 96 | }; |
| 97 | let uuids = v1.iter().map(|e| &e.uuid).chain(v2.iter().map(|e| &e.uuid)); |
| 98 | for (&data, uuid) in subcache_data.iter().zip(uuids) { |
| 99 | let sc_header = macho::DyldCacheHeader::<E>::parse(data)?; |
| 100 | if &sc_header.uuid != uuid { |
| 101 | return Err(Error("Unexpected SubCache UUID" )); |
| 102 | } |
| 103 | let mappings = sc_header.mappings(endian, data)?; |
| 104 | subcaches.push(DyldSubCache { data, mappings }); |
| 105 | } |
| 106 | } |
| 107 | |
| 108 | // Read the .symbols SubCache, if present. |
| 109 | // Other than the UUID verification, the symbols SubCache is currently unused. |
| 110 | let _symbols_subcache = match symbols_subcache_data_and_uuid { |
| 111 | Some((data, uuid)) => { |
| 112 | let sc_header = macho::DyldCacheHeader::<E>::parse(data)?; |
| 113 | if sc_header.uuid != uuid { |
| 114 | return Err(Error("Unexpected .symbols SubCache UUID" )); |
| 115 | } |
| 116 | let mappings = sc_header.mappings(endian, data)?; |
| 117 | Some(DyldSubCache { data, mappings }) |
| 118 | } |
| 119 | None => None, |
| 120 | }; |
| 121 | |
| 122 | let images = header.images(endian, data)?; |
| 123 | Ok(DyldCache { |
| 124 | endian, |
| 125 | data, |
| 126 | subcaches, |
| 127 | mappings, |
| 128 | images, |
| 129 | arch, |
| 130 | }) |
| 131 | } |
| 132 | |
| 133 | /// Get the architecture type of the file. |
| 134 | pub fn architecture(&self) -> Architecture { |
| 135 | self.arch |
| 136 | } |
| 137 | |
| 138 | /// Get the endianness of the file. |
| 139 | #[inline ] |
| 140 | pub fn endianness(&self) -> Endianness { |
| 141 | if self.is_little_endian() { |
| 142 | Endianness::Little |
| 143 | } else { |
| 144 | Endianness::Big |
| 145 | } |
| 146 | } |
| 147 | |
| 148 | /// Return true if the file is little endian, false if it is big endian. |
| 149 | pub fn is_little_endian(&self) -> bool { |
| 150 | self.endian.is_little_endian() |
| 151 | } |
| 152 | |
| 153 | /// Iterate over the images in this cache. |
| 154 | pub fn images<'cache>(&'cache self) -> DyldCacheImageIterator<'data, 'cache, E, R> { |
| 155 | DyldCacheImageIterator { |
| 156 | cache: self, |
| 157 | iter: self.images.iter(), |
| 158 | } |
| 159 | } |
| 160 | |
| 161 | /// Find the address in a mapping and return the cache or subcache data it was found in, |
| 162 | /// together with the translated file offset. |
| 163 | pub fn data_and_offset_for_address(&self, address: u64) -> Option<(R, u64)> { |
| 164 | if let Some(file_offset) = address_to_file_offset(address, self.endian, self.mappings) { |
| 165 | return Some((self.data, file_offset)); |
| 166 | } |
| 167 | for subcache in &self.subcaches { |
| 168 | if let Some(file_offset) = |
| 169 | address_to_file_offset(address, self.endian, subcache.mappings) |
| 170 | { |
| 171 | return Some((subcache.data, file_offset)); |
| 172 | } |
| 173 | } |
| 174 | None |
| 175 | } |
| 176 | } |
| 177 | |
| 178 | /// An iterator over all the images (dylibs) in the dyld shared cache. |
| 179 | #[derive (Debug)] |
| 180 | pub struct DyldCacheImageIterator<'data, 'cache, E = Endianness, R = &'data [u8]> |
| 181 | where |
| 182 | E: Endian, |
| 183 | R: ReadRef<'data>, |
| 184 | { |
| 185 | cache: &'cache DyldCache<'data, E, R>, |
| 186 | iter: slice::Iter<'data, macho::DyldCacheImageInfo<E>>, |
| 187 | } |
| 188 | |
| 189 | impl<'data, 'cache, E, R> Iterator for DyldCacheImageIterator<'data, 'cache, E, R> |
| 190 | where |
| 191 | E: Endian, |
| 192 | R: ReadRef<'data>, |
| 193 | { |
| 194 | type Item = DyldCacheImage<'data, 'cache, E, R>; |
| 195 | |
| 196 | fn next(&mut self) -> Option<DyldCacheImage<'data, 'cache, E, R>> { |
| 197 | let image_info: &'data DyldCacheImageInfo = self.iter.next()?; |
| 198 | Some(DyldCacheImage { |
| 199 | cache: self.cache, |
| 200 | image_info, |
| 201 | }) |
| 202 | } |
| 203 | } |
| 204 | |
| 205 | /// One image (dylib) from inside the dyld shared cache. |
| 206 | #[derive (Debug)] |
| 207 | pub struct DyldCacheImage<'data, 'cache, E = Endianness, R = &'data [u8]> |
| 208 | where |
| 209 | E: Endian, |
| 210 | R: ReadRef<'data>, |
| 211 | { |
| 212 | pub(crate) cache: &'cache DyldCache<'data, E, R>, |
| 213 | image_info: &'data macho::DyldCacheImageInfo<E>, |
| 214 | } |
| 215 | |
| 216 | impl<'data, 'cache, E, R> DyldCacheImage<'data, 'cache, E, R> |
| 217 | where |
| 218 | E: Endian, |
| 219 | R: ReadRef<'data>, |
| 220 | { |
| 221 | /// The file system path of this image. |
| 222 | pub fn path(&self) -> Result<&'data str> { |
| 223 | let path: &'data [u8] = self.image_info.path(self.cache.endian, self.cache.data)?; |
| 224 | // The path should always be ascii, so from_utf8 should always succeed. |
| 225 | let path: &str = core::str::from_utf8(path).map_err(|_| Error("Path string not valid utf-8" ))?; |
| 226 | Ok(path) |
| 227 | } |
| 228 | |
| 229 | /// The subcache data which contains the Mach-O header for this image, |
| 230 | /// together with the file offset at which this image starts. |
| 231 | pub fn image_data_and_offset(&self) -> Result<(R, u64)> { |
| 232 | let address: u64 = self.image_info.address.get(self.cache.endian); |
| 233 | self.cache |
| 234 | .data_and_offset_for_address(address) |
| 235 | .ok_or(err:Error("Address not found in any mapping" )) |
| 236 | } |
| 237 | |
| 238 | /// Parse this image into an Object. |
| 239 | pub fn parse_object(&self) -> Result<File<'data, R>> { |
| 240 | File::parse_dyld_cache_image(self) |
| 241 | } |
| 242 | } |
| 243 | |
| 244 | impl<E: Endian> macho::DyldCacheHeader<E> { |
| 245 | /// Read the dyld cache header. |
| 246 | pub fn parse<'data, R: ReadRef<'data>>(data: R) -> Result<&'data Self> { |
| 247 | data.read_at::<macho::DyldCacheHeader<E>>(0) |
| 248 | .read_error("Invalid dyld cache header size or alignment" ) |
| 249 | } |
| 250 | |
| 251 | /// Returns (arch, endian) based on the magic string. |
| 252 | pub fn parse_magic(&self) -> Result<(Architecture, E)> { |
| 253 | let (arch, is_big_endian) = match &self.magic { |
| 254 | b"dyld_v1 i386 \0" => (Architecture::I386, false), |
| 255 | b"dyld_v1 x86_64 \0" => (Architecture::X86_64, false), |
| 256 | b"dyld_v1 x86_64h \0" => (Architecture::X86_64, false), |
| 257 | b"dyld_v1 ppc \0" => (Architecture::PowerPc, true), |
| 258 | b"dyld_v1 armv6 \0" => (Architecture::Arm, false), |
| 259 | b"dyld_v1 armv7 \0" => (Architecture::Arm, false), |
| 260 | b"dyld_v1 armv7f \0" => (Architecture::Arm, false), |
| 261 | b"dyld_v1 armv7s \0" => (Architecture::Arm, false), |
| 262 | b"dyld_v1 armv7k \0" => (Architecture::Arm, false), |
| 263 | b"dyld_v1 arm64 \0" => (Architecture::Aarch64, false), |
| 264 | b"dyld_v1 arm64e \0" => (Architecture::Aarch64, false), |
| 265 | _ => return Err(Error("Unrecognized dyld cache magic" )), |
| 266 | }; |
| 267 | let endian = |
| 268 | E::from_big_endian(is_big_endian).read_error("Unsupported dyld cache endian" )?; |
| 269 | Ok((arch, endian)) |
| 270 | } |
| 271 | |
| 272 | /// Return the mapping information table. |
| 273 | pub fn mappings<'data, R: ReadRef<'data>>( |
| 274 | &self, |
| 275 | endian: E, |
| 276 | data: R, |
| 277 | ) -> Result<&'data [macho::DyldCacheMappingInfo<E>]> { |
| 278 | data.read_slice_at::<macho::DyldCacheMappingInfo<E>>( |
| 279 | self.mapping_offset.get(endian).into(), |
| 280 | self.mapping_count.get(endian) as usize, |
| 281 | ) |
| 282 | .read_error("Invalid dyld cache mapping size or alignment" ) |
| 283 | } |
| 284 | |
| 285 | /// Return the information about subcaches, if present. |
| 286 | /// |
| 287 | /// Returns `None` for dyld caches produced before dyld-940 (macOS 12). |
| 288 | pub fn subcaches<'data, R: ReadRef<'data>>( |
| 289 | &self, |
| 290 | endian: E, |
| 291 | data: R, |
| 292 | ) -> Result<Option<DyldSubCacheSlice<'data, E>>> { |
| 293 | let header_size = self.mapping_offset.get(endian); |
| 294 | if header_size >= MIN_HEADER_SIZE_SUBCACHES_V2 { |
| 295 | let subcaches = data |
| 296 | .read_slice_at::<macho::DyldSubCacheEntryV2<E>>( |
| 297 | self.subcaches_offset.get(endian).into(), |
| 298 | self.subcaches_count.get(endian) as usize, |
| 299 | ) |
| 300 | .read_error("Invalid dyld subcaches size or alignment" )?; |
| 301 | Ok(Some(DyldSubCacheSlice::V2(subcaches))) |
| 302 | } else if header_size >= MIN_HEADER_SIZE_SUBCACHES_V1 { |
| 303 | let subcaches = data |
| 304 | .read_slice_at::<macho::DyldSubCacheEntryV1<E>>( |
| 305 | self.subcaches_offset.get(endian).into(), |
| 306 | self.subcaches_count.get(endian) as usize, |
| 307 | ) |
| 308 | .read_error("Invalid dyld subcaches size or alignment" )?; |
| 309 | Ok(Some(DyldSubCacheSlice::V1(subcaches))) |
| 310 | } else { |
| 311 | Ok(None) |
| 312 | } |
| 313 | } |
| 314 | |
| 315 | /// Return the UUID for the .symbols subcache, if present. |
| 316 | pub fn symbols_subcache_uuid(&self, endian: E) -> Option<[u8; 16]> { |
| 317 | if self.mapping_offset.get(endian) >= MIN_HEADER_SIZE_SUBCACHES_V1 { |
| 318 | let uuid = self.symbols_subcache_uuid; |
| 319 | if uuid != [0; 16] { |
| 320 | return Some(uuid); |
| 321 | } |
| 322 | } |
| 323 | None |
| 324 | } |
| 325 | |
| 326 | /// Return the image information table. |
| 327 | pub fn images<'data, R: ReadRef<'data>>( |
| 328 | &self, |
| 329 | endian: E, |
| 330 | data: R, |
| 331 | ) -> Result<&'data [macho::DyldCacheImageInfo<E>]> { |
| 332 | if self.mapping_offset.get(endian) >= MIN_HEADER_SIZE_SUBCACHES_V1 { |
| 333 | data.read_slice_at::<macho::DyldCacheImageInfo<E>>( |
| 334 | self.images_across_all_subcaches_offset.get(endian).into(), |
| 335 | self.images_across_all_subcaches_count.get(endian) as usize, |
| 336 | ) |
| 337 | .read_error("Invalid dyld cache image size or alignment" ) |
| 338 | } else { |
| 339 | data.read_slice_at::<macho::DyldCacheImageInfo<E>>( |
| 340 | self.images_offset.get(endian).into(), |
| 341 | self.images_count.get(endian) as usize, |
| 342 | ) |
| 343 | .read_error("Invalid dyld cache image size or alignment" ) |
| 344 | } |
| 345 | } |
| 346 | } |
| 347 | |
| 348 | impl<E: Endian> macho::DyldCacheImageInfo<E> { |
| 349 | /// The file system path of this image. |
| 350 | pub fn path<'data, R: ReadRef<'data>>(&self, endian: E, data: R) -> Result<&'data [u8]> { |
| 351 | let r_start: u64 = self.path_file_offset.get(endian).into(); |
| 352 | let r_end: u64 = data.len().read_error("Couldn't get data len()" )?; |
| 353 | dataResult<&[u8], ()>.read_bytes_at_until(range:r_start..r_end, delimiter:0) |
| 354 | .read_error("Couldn't read dyld cache image path" ) |
| 355 | } |
| 356 | |
| 357 | /// Find the file offset of the image by looking up its address in the mappings. |
| 358 | pub fn file_offset( |
| 359 | &self, |
| 360 | endian: E, |
| 361 | mappings: &[macho::DyldCacheMappingInfo<E>], |
| 362 | ) -> Result<u64> { |
| 363 | let address: u64 = self.address.get(endian); |
| 364 | address_to_file_offsetOption(address, endian, mappings) |
| 365 | .read_error("Invalid dyld cache image address" ) |
| 366 | } |
| 367 | } |
| 368 | |
| 369 | /// Find the file offset of the image by looking up its address in the mappings. |
| 370 | pub fn address_to_file_offset<E: Endian>( |
| 371 | address: u64, |
| 372 | endian: E, |
| 373 | mappings: &[macho::DyldCacheMappingInfo<E>], |
| 374 | ) -> Option<u64> { |
| 375 | for mapping: &DyldCacheMappingInfo in mappings { |
| 376 | let mapping_address: u64 = mapping.address.get(endian); |
| 377 | if address >= mapping_address |
| 378 | && address < mapping_address.wrapping_add(mapping.size.get(endian)) |
| 379 | { |
| 380 | return Some(address - mapping_address + mapping.file_offset.get(endian)); |
| 381 | } |
| 382 | } |
| 383 | None |
| 384 | } |
| 385 | |