redridge/open-source-machlib

Hopefully an open source equivalent of machlib.

open-source-machlib

The goal of this project is to create an open source equivalent of machlib: a library for inspecting Apple binary format files, particularly the iOS kernelcache. It will provide features to list library calls, system calls, kernel extensions, segments and sections and others. It will be a library that could then be used as a back-end for other tools.

Installing

Downloading the necessary dependecies.

make prepare

Building the sources, generating the library and a sample application. The library and the sample application will be located inside the bin directory

make

Changing the LIBRARY PATH.

Linux

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/path/to/bin

Macos

export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH:/path/to/bin

open-source-machlib's Issues

Symbol flags and bits

figure out what all the flags and bits of a symbol mean

Linux format warnings

Find a way to get rid of the warnings that appear when printing stuff due to the different ways that linux and macos handle uint64.

Ideally a set of os depending #DEFINEs should be placed in order to specify which format strings are to be used.

Memory leaks

Release memory

API arch

not every file will have a main entry point, dynamic linker -- figure out how can the API will behave

Capstone for ARM

Arm has 2 ISA, both of which can be used in a given binary.
Capstone can't handle this case and requires a switch form CS_MODE_ARM to CS_MODE_THUMB
and backwards at runtime.
Capstone doesnt provide any information about how much of the data has proccessed. (in order to switch and resume disasm.).