Mach-O文件

---

VMProtect 是新一代軟件盜版保護解決方案。VMProtect 是目前強大的反盜版解決方案之一，許多領先的軟件發(fā)行商都在使用它。VMProtect允許保護可執(zhí)行文件（EXE，SCR），動態(tài)鏈接庫（DLL，OCX，BPL）和驅動程序（SYS）。

VMProtect最新版下載

加密解密技術交流群（766135708）

常量，以配合Mach-O格式：

enum MacFormat {
	// Load Command Types
	LC_SEGMENT,
	LC_SYMTAB,
	LC_SYMSEG,
	LC_THREAD,
	LC_UNIXTHREAD,
	LC_LOADFVMLIB,
	LC_IDFVMLIB,
	LC_IDENT,
	LC_FVMFILE,
	LC_PREPAGE,
	LC_DYSYMTAB,
	LC_LOAD_DYLIB,
	LC_ID_DYLIB,
	LC_LOAD_DYLINKER,
	LC_PREBOUND_DYLIB,
	LC_ROUTINES,
	LC_SUB_FRAMEWORK,
	LC_SUB_UMBRELLA,
	LC_SUB_CLIENT,
	LC_SUB_LIBRARY,
	LC_TWOLEVEL_HINTS,
	LC_PREBIND_CKSUM,
	LC_LOAD_WEAK_DYLIB,
	LC_SEGMENT_64,
	LC_ROUTINES_64,
	LC_UUID,
	LC_RPATH,
	LC_CODE_SIGNATURE,
	LC_SEGMENT_SPLIT_INFO,
	LC_REEXPORT_DYLIB,
	LC_LAZY_LOAD_DYLIB,
	LC_ENCRYPTION_INFO,
	LC_DYLD_INFO,
	LC_DYLD_INFO_ONLY,
	LC_LOAD_UPWARD_DYLIB,
	LC_VERSION_MIN_MACOSX,
	// Section Types	
	SECTION_TYPE,
	SECTION_ATTRIBUTES,
	S_REGULAR,
	S_ZEROFILL,
	S_CSTRING_LITERALS,
	S_4BYTE_LITERALS,
	S_8BYTE_LITERALS,
	S_LITERAL_POINTERS,
	S_NON_LAZY_SYMBOL_POINTERS,
	S_LAZY_SYMBOL_POINTERS,
	S_SYMBOL_STUBS,
	S_MOD_INIT_FUNC_POINTERS,
	S_MOD_TERM_FUNC_POINTERS,
	S_COALESCED,
	S_GB_ZEROFILL,
	S_INTERPOSING,
	S_16BYTE_LITERALS,
	S_DTRACE_DOF,
	S_LAZY_DYLIB_SYMBOL_POINTERS,
	SECTION_ATTRIBUTES_USR,
	S_ATTR_PURE_INSTRUCTIONS,
	S_ATTR_NO_TOC,
	S_ATTR_STRIP_STATIC_SYMS,
	S_ATTR_NO_DEAD_STRIP,
	S_ATTR_LIVE_SUPPORT,
	S_ATTR_SELF_MODIFYING_CODE,
	S_ATTR_DEBUG,
	SECTION_ATTRIBUTES_SYS,
	S_ATTR_SOME_INSTRUCTIONS,
	S_ATTR_EXT_RELOC,
	S_ATTR_LOC_RELOC
};

一個處理Mach-O文件的課程：

class MacFile {
public:
	string name(); // returns the name of the file
	string format(); // returns the name of the "Mach-O" format
	uint64 size(); // returns the size of the file
	int count(); // returns the number of architectures in the list
	MacArchitecture item(int index); // returns an architecture with the given index
	uint64 seek(uint64 offset); // sets the file position
	uint64 tell(); // returns the file position
	int write(string buffer); // writes a buffer to the file
};

一個使用Mach-O架構的課程：

class MacArchitecture {
public:
	string name(); // returns the name of the architecture
	MacFile file(); // returns the parent file
	uint64 entryPoint(); // returns the starting address
	OperandSize cpuAddressSize(); // returns bit count of the architecture
	uint64 size(); // returns the size of the architecture
	MacSegments segments(); // returns the list of segments
	MacSections sections(); // returns the list of sections
	MacCommands commands(); // returns the list of load commands
	MacSymbols symbols(); // returns the list of symbols
	MacImports imports(); // returns the list of imported libraries
	MacExports exports(); // returns the list of exported functions
	MacFixups fixups(); // returns the list of fixups (relocations)
	MapFunctions mapFunctions(); // returns the list of functions available for protection
	IntelFunctions functions(); // returns the list of protected functions
	bool addressSeek(uint64 address); // sets the file position
	uint64 seek(uint64 offset); // sets the file position
	uint64 tell(); // returns the file position
	int write(string buffer); // writes a buffer to the file
};

一個用于處理Mach-O結構段列表的類：

class MacSegments {
public:
	MacSegment item(int index); // returns a segment with the given index
	int count(); // returns the number of segments in the list
	MacSegment itemByAddress(); // returns a segment at the given address
};

一個與Mach-O架構段合作的課程：

class MacSegment {
public:
	uint64 address(); // returns the address of the segment
	string name(); // returns the name of the segment
	uint64 size(); // returns the size of the segment
	int physicalOffset(); // returns the file position of the segment
	int physicalSize(); // returns the file size of the segment
	int flags(); // returns flags of the segment
	bool excludedFromPacking(); // returns the "Excluded from packing" property
};

一個處理Mach-O架構部分列表的類：

class MacSections {
public:
	MacSection item(int index); // returns a section with the given index
	int count(); // returns the number of sections in the list
	MacSection itemByAddress(uint64 address); // returns a section at the given address
};

一個與Mach-O架構部分合作的類：

class MacCommands {
public:
	MacCommand item(int index); // returns a command with the given index
	int count(); // returns the number of command in the list
	MacCommand itemByType(int type); // returns a command of the given type
};

一個用于處理Mach-O架構加載命令列表的類：

class MacCommand {
public:
	uint64 address(); // returns the address of the command
	int type(); // returns the type of the command
	string name(); // returns the name of the command
	int size(); // returns the size of the command
};

一個處理Mach-O架構符號列表的類：

class MacSymbols {
public:
	MacSymbol item(int index); // returns a symbol with the given index
	int count(); // returns the number of symbols in the list
};

一個使用馬赫-O架構符號的類：

class MacSymbol {
public:
	uint64 value(); // returns the value of the symbol
	string name(); // returns the name of the symbol
};

一個用于處理Mach-O架構的導入庫列表的類：

class MacImports {
public:
	MacImport item(int index); // returns an imported library with the given index
	int count(); // returns the number of imported libraries in the list
	MacImport itemByName(string name); // returns an imported library with the given name
};

一個與Mach-O架構的導入庫一起工作的類：

class MacImport {
public:
	string name(); // returns the name of the imported library
	MacImportFunction item(int index); // returns an imported function with the given index
	int count(); // returns the number of imported functions in the list
	void setName(string name); // sets the name of the imported library
};

一個使用Mach-O架構導入函數的類：

class MacImportFunction {
public:
	uint64 address(); // returns the memory address where the address of the imported function is stored
	string name(); // returns the name of the imported function
};

一個用于處理Mach-O架構的導出函數列表的類：

class MacExports {
public:
	string name(); // returns the name of the library
	MacExport item(); // returns an exported function with the given index
	int count(); // returns the number of exported functions in the list
	void clear(); // clears the list
	MacExport itemByAddress(uint64 address); // returns an exported function at the given address
	MacExport itemByName(string name); // returns an exported function with the given name
};

一個與Mach-O架構導出的函數一起工作的類：

class MacExport {
public:
	uint64 address(); // returns the address of the exported function
	string name(); // returns the name of the exported function
	string forwardedName(); // returns the name of the function the exported function is forwarded to
	void destroy(); // destroys the exported function
};

一個用于處理Mach-O架構的修復（重新定位）列表的類：

class MacFixups {
public:
	MacFixup item(int index); // returns an element with the given index
	int count(); // returns the number of elements in the list
	MacFixup itemByAddress(uint64 address); // returns an element at the given address
};

一個與Mach-O架構固定工作的類：

class MacFixup {
public:
	uint64 address(); // returns the address of the element
};