目录

前言 1.1

Mach-O概览 1.2

背景知识 1.2.1

XNU 1.2.1.1

编译链接加载过程 1.2.1.2

PIC 1.2.1.3

Mach-O格式 1.3

Mach-O结构概述 1.3.1

Mach-O结构图 1.3.1.1

Mach-O结构详情 1.3.2

Header 1.3.2.1

magic 1.3.2.1.1

cputype和cpusubtype 1.3.2.1.2

filetype 1.3.2.1.3

flags 1.3.2.1.4

Load Commands 1.3.2.2

LC_UUID 1.3.2.2.1

LC_SEGMENT 1.3.2.2.2

LC_SEGMENT_64 1.3.2.2.3

LC_SYMTAB 1.3.2.2.4

LC_DYLD_CHAINED_FIXUPS 1.3.2.2.5

LC_DYLD_EXPORTS_TRIE 1.3.2.2.6

Segment 1.3.2.3

__TEXT 1.3.2.3.1

__text 1.3.2.3.1.1

__DATA 1.3.2.3.2

__la_symbol_ptr 1.3.2.3.2.1

__got 1.3.2.3.2.2

__IMPORT 1.3.2.3.3

__LINKEDIT 1.3.2.3.4

__OBJC 1.3.2.3.5

Section 1.3.2.4

symbol 1.3.2.4.1

string 1.3.2.4.2

FAT 1.3.3

举例 1.3.3.1

常见问题 1.3.3.2

工具 1.3.3.3

lipo 1.3.3.3.1

codesign 1.3.4

虚拟地址 1.3.5

大小限制 1.3.6

Mach-O工具 1.4

MachOView 1.4.1

举例 1.4.1.1

main_arm64 1.4.1.1.1

AwemeCore 1.4.1.1.2

zzzzHeiBaoLib.dylib 1.4.1.1.3

心得 1.4.1.2

自己编译 1.4.1.2.1

rabin2 1.4.2

用法 1.4.2.1

举例 1.4.2.2

AwemeCore 1.4.2.2.1

MaskPro.dylib 1.4.2.2.2

help 1.4.2.3

jtool2 1.4.3

用法 1.4.3.1

举例 1.4.3.2

AwemeCore 1.4.3.2.1

MaskPro.dylib 1.4.3.2.2

akd 1.4.3.2.3

help 1.4.3.3

otool 1.4.4

用法 1.4.4.1

举例 1.4.4.2

Aweme 1.4.4.2.1

AwemeCore 1.4.4.2.2

MaskPro.dylib 1.4.4.2.3

help 1.4.4.3

pagestuff 1.4.5

help 1.4.5.1

附录 1.5

Mach-O文档和资料 1.5.1

参考资料 1.5.2

前言

可执行文件格式：Mach-O

最新版本：v1.0.1

更新时间：20240325

简介

介绍Mac和iOS等Apple苹果系统的常见可执行文件格式：Mach-O；先是Mach-O概览；包括背景知识的XNU、PIC等；然后介绍Mach-O格式，包括结构概述和结构图，以及结构详情，包括Header、Load Commands和Segment的data；其中Header包括magic、cputype和cpusubtype、filetype、flags；Load Commands包括LC_UUID、LC_SEGMENT、LC_SEGMENT_64、LC_SYMTAB、LC_DYLD_CHAINED_FIXUPS、LC_DYLD_EXPORTS_TRIE等；Segment包括TEXT、DATA、IMPORT、LINKEDIT、__OBJC；以及各个Segment的section，比如symbol、strings等；然后是Mach-O格式的子项，包括FAT、codesign、虚拟地址、大小限制等；然后整理Mach-O的各种工具，包括MachOView、rabin2、jtool2、otool、pagestuff，以及每个工具的用法、举例、help语法等；

源码+浏览+下载

本书的各种源码、在线浏览地址、多种格式文件下载如下：

HonKit源码

crifan/exec_file_format_macho: 可执行文件格式：Mach-O

如何使用此HonKit源码去生成发布为电子书

详见：crifan/honkit_template: demo how to use crifan honkit template and demo

在线浏览

可执行文件格式：Mach-O book.crifan.org

可执行文件格式：Mach-O crifan.github.io

离线下载阅读

可执行文件格式：Mach-O PDF

可执行文件格式：Mach-O ePub

可执行文件格式：Mach-O Mobi

版权和用途说明

此电子书教程的全部内容，如无特别说明，均为本人原创。其中部分内容参考自网络，均已备注了出处。如发现有侵权，请通过邮箱联系我 admin 艾特 crifan.com，我会尽快删除。谢谢合作。

各种技术类教程，仅作为学习和研究使用。请勿用于任何非法用途。如有非法用途，均与本人无关。

鸣谢

感谢我的老婆陈雪的包容理解和悉心照料，才使得我crifan有更多精力去专注技术专研和整理归纳出这些电子书和技术教程，特此鸣谢。

其他

作者的其他电子书

本人crifan还写了其他150+本电子书教程，感兴趣可移步至：

crifan/crifan_ebook_readme: Crifan的电子书的使用说明

关于作者

关于作者更多介绍，详见：

关于CrifanLi李茂 – 在路上

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2024-03-25 10:19:18

Mach-O概览

Mach-O概览

Mach-O

Mach-O=Mach Object=Mach Object file format

是什么：Mac和iOS等Apple平台中的可执行文件格式

名词解释

Mach-O = Mach + O

Mach

iOS的内核是XNU

XNU由多个部分组成

其中一部分是Mach微内核microkernel

O=Object=对象

用到Mach-O的系统

Mach kernel

NeXTSTEP

macOS

iOS

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 17:35:49

背景知识

Mach-O背景知识

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-04 17:52:09

XNU

XNU

XUN

名称

XNU= X is Not Unix

概述

英文

XNU kernel is part of the Darwin operating system for use in macOS and iOS operating systems.

中文

XNU是：iOS（和tvOS、watchOS）的（操作系统）内核

XNU也是Darwin的一部分

Darwin是MacOS的操作系统内核

特点

XNU is a hybrid kernel combining the Mach kernel developed at Carnegie Mellon University with components from FreeBSD and a C++ API for writing drivers called IOKit. XNU runs on x86_64 for both single processor and multi-processor configurations.

（开源代码）源码

opensource.apple.com

Source Browser (apple.com)

Github

https://github.com/apple/darwin-xnu

apple/darwin-xnu: The Darwin Kernel (mirror)

XNU组成

2个主要部分

Mach：微内核=microkernel

实现了操作系统的核心部分

BSD：内核=kernel

BSD在Mach的基础上，实现了更高层的各种功能

代码组成=代码树

config - configurations for exported apis for supported architecture and platform

SETUP - Basic set of tools used for configuring the kernel, versioning and kextsymbol management.

EXTERNAL_HEADERS - Headers sourced from other projects to avoid dependency cycles when building. These headers should be regularly synced when source is updated.

libkern - C++ IOKit library code for handling of drivers and kexts.

libsa - kernel bootstrap code for startup

libsyscall - syscall library interface for userspace programs

libkdd - source for user library for parsing kernel data like kernel chunked data.

makedefs - top level rules and defines for kernel build.

osfmk - Mach kernel based subsystems

pexpert - Platform specific code like interrupt handling, atomics etc.

security - Mandatory Access Check policy interfaces and related implementation.

bsd - BSD subsystems code

tools - A set of utilities for testing, debugging and profiling kernel.

查看系统信息中会有XNU的版本等信息

iOS 15.1，iPhone8的信息

iPhone8-150:~ root# uname -a
Darwin iPhone8-150 21.0.0 Darwin Kernel Version 21.0.0: Sun Aug 15 20:55:55 PDT 2021; root:xnu-8019.12.5~1/RELEASE_ARM64_T8015 iPhone10,1 arm Darwin

xnu-8019.12.5~1/RELEASE_ARM64_T8015

xnu是：iOS的内核

版本是：8019.12.5

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-04 21:36:13

编译链接加载过程

编译链接加载过程

编译链接加载过程

概述

详解

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2024-03-25 09:49:27

PIC

PIC

PIC=Position-Independent Code=位置无关代码

详解

位置无关代码（PIC）是 PowerPC 环境中使用的代码生成技术的名称，该技术允许动态链接器在非固定虚拟内存地址加载代码区域。如果没有某种形式的与位置无关的代码生成，操作系统将需要将您想要共享的所有代码放置在虚拟内存中的固定地址，这将使操作系统的维护变得非常困难。例如，支持共享库和框架几乎是不可能的，因为每个库和框架都需要预先分配一个永远不会改变的地址。

Mach-O与位置无关的代码设计基于这样的观察：__DATA 段始终位于距 __TEXT 段恒定的偏移处。也就是说，动态加载器在加载任何Mach-O文件时，绝不会相对于其 __DATA 段移动文件的 __TEXT 段。因此，函数可以使用自己的当前地址加上固定偏移量来确定它希望访问的数据的位置。 Mach-O文件的所有段（不仅是 __TEXT 和 __DATA 段）相对于其他段的偏移量是固定的。

官网文档

Position-Independent Code

对比

Mach-O的PIC ~= ELF的GOT

区别：Mach-O 代码使用直接偏移引用数据，而 ELF 通过全局偏移表间接访问所有数据。

PIC

~= PIE = Position-Independent Executable

对应的Mach-O中有个flag是：MH_PIE

~= ASLR

ASLR

ASLR=Address Space Layout Randomization=地址空间布局随机化

参考：

去尝试给iOS的app去开启ASLR：

Linking->Generate Position-Dependent Executable

Apple Clang - Code Generation->Generate Position-Dependent Code

结果：

编译都会报错：

ld: -no_pie and -bitcode_bundle (Xcode setting ENABLE_BITCODE=YES) cannot be used together

Showing All Messages
-no_pie and -bitcode_bundle (Xcode setting ENABLE_BITCODE=YES) cannot be used together

看起来是和BITCODE的ENABLE_BITCODE=YES相冲突了。

所以暂时放弃深究。

后记：

上述的：

Position-Dependent Executable和Generate Position-Dependent Code

很明显是：要关闭ASLR=PIC=PIE的意思啊

所以感觉是：

ASLR=PIC=PIE：默认已开启

如果想要去关闭ALSR，才需要去更改设置，改为

Linking->Generate Position-Dependent Executable = YES

Apple Clang - Code Generation->Generate Position-Dependent Code = YES

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 16:44:05

Mach-O格式

Mach-O格式

Mach-O vs ELF

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 16:00:21

Mach-O结构概述

Mach-O结构概述

Mach-O基本结构

Header：文件类型、目标架构类型等

Load Commands：描述文件在虚拟内存中的逻辑结构、布局

(Raw segment) data：在Load commands中定义的Segment的原始数据

一个或多个segment=段

每个segment包含 一个或多个 section=节

每个section包含 （某种类型的）代码 或 数据

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 23:01:40

Mach-O结构图

Mach-O结构图

概览

普通单架构 vs FAT多架构

普通：单架构 = Mach-O文件

特殊：多架构=FAT=Universal通用文件

文字版

+---------------------+        /* header (fat_header: 0x8) */
|                     |
|     FAT HEADER      |
|                     |
+---------------------+        /* archs (fat_arch: 0x14) */
|     FAT ARCH #1     |
+---------------------+
|     FAT ARCH #2     |
+---------------------+
|         ...         |        /* other eventual fat archs... */
+---------------------+        /* Mach-Os section (variable size) */
|                     |
|                     |
|                     |
|                     |
|      MACH-O #1      |
|                     |
|                     |
|                     |
|                     |
|                     |
+---------------------+
|                     |
|                     |
|                     |
|                     |
|                     |
|      MACH-O #2      |
|                     |
|                     |
|                     |
|                     |
+---------------------+
|         ...         |        /* other eventual Mach-Os... */
+---------------------+

详解

带字段的Mach-O结构图

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 17:03:08

Mach-O结构详情

Mach-O结构详情

Mach-O详细定义

相关源码

Mach-O详细定义

相关源码

xnu源码

https://opensource.apple.com/tarballs/xnu/

EXTERNAL_HEADERS/mach-o/fat.h

EXTERNAL_HEADERS/mach-o/loader.h

举例

https://opensource.apple.com/source/xnu/xnu-2050.18.24/EXTERNAL_HEADERS/mach-o/loader.h

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 23:01:36

Header

Mach-O的Header

Mach-O的Header结构图

Header的详细定义

MachOView显示Mach-O的Header举例

说明

该文件是可执行文件

文件的构架是x86_64

number of Load commands表示有74个load commond

MH_TWOLEVEL二级名字空间

MH_PIE 随机地址空间

Mach-O Core Dump File Structure

内存映射 = 结构体偏移 = 结构体字段

mach_header定义

精简定义

struct mach_header {
  uint32_t      magic;
  cpu_type_t    cputype;
  cpu_subtype_t cpusubtype;
  uint32_t      filetype;
  uint32_t      ncmds;
  uint32_t      sizeofcmds;
  uint32_t      flags;
};

详细定义

源码定义：

/*
 * The 32-bit mach header appears at the very beginning of the object file for
 * 32-bit architectures.
 */
struct mach_header {
    uint32_t    magic;        /* mach magic number identifier */
    cpu_type_t    cputype;    /* cpu specifier */
    cpu_subtype_t    cpusubtype;    /* machine specifier */
    uint32_t    filetype;    /* type of file */
    uint32_t    ncmds;        /* number of load commands */
    uint32_t    sizeofcmds;    /* the size of all the load commands */
    uint32_t    flags;        /* flags */
};

/* Constant for the magic field of the mach_header (32-bit architectures) */
#define    MH_MAGIC    0xfeedface    /* the mach magic number */
#define MH_CIGAM    0xcefaedfe    /* NXSwapInt(MH_MAGIC) */

/*
 * The 64-bit mach header appears at the very beginning of object files for
 * 64-bit architectures.
 */
struct mach_header_64 {
    uint32_t    magic;        /* mach magic number identifier */
    cpu_type_t    cputype;    /* cpu specifier */
    cpu_subtype_t    cpusubtype;    /* machine specifier */
    uint32_t    filetype;    /* type of file */
    uint32_t    ncmds;        /* number of load commands */
    uint32_t    sizeofcmds;    /* the size of all the load commands */
    uint32_t    flags;        /* flags */
    uint32_t    reserved;    /* reserved */
};

/* Constant for the magic field of the mach_header_64 (64-bit architectures) */
#define MH_MAGIC_64 0xfeedfacf /* the 64-bit mach magic number */
#define MH_CIGAM_64 0xcffaedfe /* NXSwapInt(MH_MAGIC_64) */

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 16:41:22

magic

Mach-O的Header的magic

magic=魔数

源码定义：

/* Constant for the magic field of the mach_header (32-bit architectures) */
#define MH_MAGIC       0xfeedface      /* the mach magic number */
#define MH_CIGAM       0xcefaedfe      /* NXSwapInt(MH_MAGIC) */

/* Constant for the magic field of the mach_header_64 (64-bit architectures) */
#define MH_MAGIC_64 0xfeedfacf /* the 64-bit mach magic number */
#define MH_CIGAM_64 0xcffaedfe /* NXSwapInt(MH_MAGIC_64) */

->

magic

通用格式：0xcafebabe

（armv7等）32bit：0xfeedface

（arm64等）64bit：0xfeedfacf

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 15:52:31

cputype和cpusubtype

cputype和cpusubtype

CPU架构

armv7等32bit

cputype = 12, cpusubtype=9

arm64等64bit

cputype = 1677228, cpusubtype = 0

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 15:54:29

filetype

Mach-O的Header的filetype

常见文件类型filetype

Mach-O的filetype

文件类型概述：Executables, bundles, dylibs, kexts, cores等等

常见文件类型

MH_EXECUTE=可执行文件=executable=应用

文件：.app/xxx

MH_OBJECT

目标文件

文件：.o

静态库文件=静态链接库=static library：N个.o合并在一起

文件：.a

MH_DYLIB=动态链接库=dylib library：类似于Win中的DLL

文件：.dylib、.framework/xxx

MH_DYLINKER：动态链接编辑器

文件：/usr/lib/dyld

MH_DSYM：存储着二进制文件符号信息的文件

文件：.dSYM/Contents/Resources/DWARF/xxx

常用于分析APP的崩溃信息

调试信息保存在：dSYM文件

全部文件类型解释

全部文件类型解释

MH_OBJECT

The MH_OBJECT file type is the format used for intermediate object files. It is a very compact format containing all its sections in one segment. The compiler and assembler usually create one MH_OBJECT file for each source code file. By convention, the file name extension for this format is .o.

MH_EXECUTE

The MH_EXECUTE file type is the format used by standard executable programs.

MH_BUNDLE

The MH_BUNDLE file type is the type typically used by code that you load at runtime (typically called bundles or plug-ins). By convention, the file name extension for this format is .bundle.

MH_DYLIB

The MH_DYLIB file type is for dynamic shared libraries. It contains some additional tables to support multiple modules. By convention, the file name extension for this format is .dylib, except for the main shared library of a framework, which does not usually have a file name extension.

MH_PRELOAD

The MH_PRELOAD file type is an executable format used for special-purpose programs that are not loaded by the OS X kernel, such as programs burned into programmable ROM chips. Do not confuse this file type with the MH_PREBOUND flag, which is a flag that the static linker sets in the header structure to mark a prebound image.

MH_CORE

The MH_CORE file type is used to store core files, which are traditionally created when a program crashes. Core files store the entire address space of a process at the time it crashed. You can later run gdb on the core file to figure out why the crash occurred.

MH_DYLINKER

The MH_DYLINKER file type is the type of a dynamic linker shared library. This is the type of the dyld file.

MH_DSYM

The MH_DSYM file type designates files that store symbol information for a corresponding binary file.

filetype的定义

源码定义：

/*
 * The layout of the file depends on the filetype.  For all but the MH_OBJECT
 * file type the segments are padded out and aligned on a segment alignment
 * boundary for efficient demand pageing.  The MH_EXECUTE, MH_FVMLIB, MH_DYLIB,
 * MH_DYLINKER and MH_BUNDLE file types also have the headers included as part
 * of their first segment.
 *
 * The file type MH_OBJECT is a compact format intended as output of the
 * assembler and input (and possibly output) of the link editor (the .o
 * format).  All sections are in one unnamed segment with no segment padding.
 * This format is used as an executable format when the file is so small the
 * segment padding greatly increases its size.
 *
 * The file type MH_PRELOAD is an executable format intended for things that
 * are not executed under the kernel (proms, stand alones, kernels, etc).  The
 * format can be executed under the kernel but may demand paged it and not
 * preload it before execution.
 *
 * A core file is in MH_CORE format and can be any in an arbritray legal
 * Mach-O file.
 *
 * Constants for the filetype field of the mach_header
 */
#define    MH_OBJECT    0x1        /* relocatable object file */
#define    MH_EXECUTE    0x2        /* demand paged executable file */
#define    MH_FVMLIB    0x3        /* fixed VM shared library file */
#define    MH_CORE        0x4        /* core file */
#define    MH_PRELOAD    0x5        /* preloaded executable file */
#define    MH_DYLIB    0x6        /* dynamically bound shared library */
#define    MH_DYLINKER    0x7        /* dynamic link editor */
#define    MH_BUNDLE    0x8        /* dynamically bound bundle file */
#define    MH_DYLIB_STUB    0x9        /* shared library stub for static */
                    /*  linking only, no section contents */
#define    MH_DSYM        0xa        /* companion file with only debug */
                    /*  sections */
#define    MH_KEXT_BUNDLE    0xb        /* x86_64 kexts */

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 15:55:00

flags

Mach-O的Header的flags

flags含义解释

MH_NOUNDEFS

The object file contained no undefined references when it was built.

MH_INCRLINK

The object file is the output of an incremental link against a base file and cannot be linked again.

MH_DYLDLINK

The file is input for the dynamic linker and cannot be statically linked again.

MH_TWOLEVEL

The image is using two-level namespace bindings.

MH_BINDATLOAD

The dynamic linker should bind the undefined references when the file is loaded.

MH_PREBOUND

The file’s undefined references are prebound.

MH_PREBINDABLE

This file is not prebound but can have its prebinding redone. Used only when MH_PREBEOUND is not set.

MH_NOFIXPREBINDING

The dynamic linker doesn’t notify the prebinding agent about this executable.

MH_ALLMODSBOUND

Indicates that this binary binds to all two-level namespace modules of its dependent libraries. Used only when MH_PREBINDABLE and MH_TWOLEVEL are set.

MH_CANONICAL

This file has been canonicalized by unprebinding—clearing prebinding information from the file. See the redo_prebinding man page for details.

MH_SPLIT_SEGS

The file has its read-only and read-write segments split.

MH_FORCE_FLAT

The executable is forcing all images to use flat namespace bindings.

MH_SUBSECTIONS_VIA_SYMBOLS

The sections of the object file can be divided into individual blocks. These blocks are dead-stripped if they are not used by other code. See Linking for details.

MH_NOMULTIDEFS

This umbrella guarantees there are no multiple definitions of symbols in its subimages. As a result, the two-level namespace hints can always be used.

flags定义

源码定义：

/* Constants for the flags field of the mach_header */
#define    MH_NOUNDEFS    0x1        /* the object file has no undefined
                       references */
#define    MH_INCRLINK    0x2        /* the object file is the output of an
                       incremental link against a base file
                       and can't be link edited again */
#define MH_DYLDLINK    0x4        /* the object file is input for the
                       dynamic linker and can't be staticly
                       link edited again */
#define MH_BINDATLOAD    0x8        /* the object file's undefined
                       references are bound by the dynamic
                       linker when loaded. */
#define MH_PREBOUND    0x10        /* the file has its dynamic undefined
                       references prebound. */
#define MH_SPLIT_SEGS    0x20        /* the file has its read-only and
                       read-write segments split */
#define MH_LAZY_INIT    0x40        /* the shared library init routine is
                       to be run lazily via catching memory
                       faults to its writeable segments
                       (obsolete) */
#define MH_TWOLEVEL    0x80        /* the image is using two-level name
                       space bindings */
#define MH_FORCE_FLAT    0x100        /* the executable is forcing all images
                       to use flat name space bindings */
#define MH_NOMULTIDEFS    0x200        /* this umbrella guarantees no multiple
                       defintions of symbols in its
                       sub-images so the two-level namespace
                       hints can always be used. */
#define MH_NOFIXPREBINDING 0x400    /* do not have dyld notify the
                       prebinding agent about this
                       executable */
#define MH_PREBINDABLE  0x800           /* the binary is not prebound but can
                       have its prebinding redone. only used
                                           when MH_PREBOUND is not set. */
#define MH_ALLMODSBOUND 0x1000        /* indicates that this binary binds to
                                           all two-level namespace modules of
                       its dependent libraries. only used
                       when MH_PREBINDABLE and MH_TWOLEVEL
                       are both set. */
#define MH_SUBSECTIONS_VIA_SYMBOLS 0x2000/* safe to divide up the sections into
                        sub-sections via symbols for dead
                        code stripping */
#define MH_CANONICAL    0x4000        /* the binary has been canonicalized
                       via the unprebind operation */
#define MH_WEAK_DEFINES    0x8000        /* the final linked image contains
                       external weak symbols */
#define MH_BINDS_TO_WEAK 0x10000    /* the final linked image uses
                       weak symbols */

#define MH_ALLOW_STACK_EXECUTION 0x20000/* When this bit is set, all stacks
                       in the task will be given stack
                       execution privilege.  Only used in
                       MH_EXECUTE filetypes. */
#define MH_ROOT_SAFE 0x40000           /* When this bit is set, the binary
                      declares it is safe for use in
                      processes with uid zero */

#define MH_SETUID_SAFE 0x80000         /* When this bit is set, the binary
                      declares it is safe for use in
                      processes when issetugid() is true */

#define MH_NO_REEXPORTED_DYLIBS 0x100000 /* When this bit is set on a dylib,
                      the static linker does not need to
                      examine dependent dylibs to see
                      if any are re-exported */
#define    MH_PIE 0x200000            /* When this bit is set, the OS will
                       load the main executable at a
                       random address.  Only used in
                       MH_EXECUTE filetypes. */
#define    MH_DEAD_STRIPPABLE_DYLIB 0x400000 /* Only for use on dylibs.  When
                         linking against a dylib that
                         has this bit set, the static linker
                         will automatically not create a
                         LC_LOAD_DYLIB load command to the
                         dylib if no symbols are being
                         referenced from the dylib. */
#define MH_HAS_TLV_DESCRIPTORS 0x800000 /* Contains a section of type
                        S_THREAD_LOCAL_VARIABLES */

#define MH_NO_HEAP_EXECUTION 0x1000000    /* When this bit is set, the OS will
                       run the main executable with
                       a non-executable heap even on
                       platforms (e.g. i386) that don't
                       require it. Only used in MH_EXECUTE
                       filetypes. */

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 16:10:11

Load Commands

Load Commands

概述

位置：Load commands紧跟在Mach-O的Header之后

作用：Load commands指定了文件的布局结构和链接特征

有很多很多种Load commands

这些加载指令清晰地告诉加载器如何处理二进制数据，有些命令是由内核处理的，有些是由动态链接器处理的

Load Commands类型介绍

概述

LC_SEGMENT：被映射到内存的段

LC_SYMTAB：符号表

LC_DYSYMTAB：动态符号表

LC_LOAD_DYLIB：动态链接库

详解

LC_REQ_DYLD = 0x8000_0000

含义：After MacOS X 10.1 when a new load command is added that is required to be understood by the dynamic linker for the image to execute properly the LC_REQ_DYLD bit will be or'ed into the load command constant. If the dynamic linker sees such a load command it it does not understand will issue a "unknown load command required for execution" error and refuse to use the image. Other load commands without this bit that are not understood will simply be ignored.

LC_SEGMENT = 0x1

数据结构定义：segment_command

含义：segment of this file to be mapped

Defines a segment of this file to be mapped into the address space of the process that loads this file. It also includes all the sections contained by the segment.

LC_SYMTAB = 0x2

数据结构定义：symtab_command

含义：link-edit stab symbol table info

Specifies the symbol table for this file. This information is used by both static and dynamic linkers when linking the file, and also by debuggers to map symbols to the original source code files from which the symbols were generated.

LC_SYMSEG = 0x3

link-edit gdb symbol table info (obsolete)

LC_THREAD = 0x4

数据结构定义：thread_command

含义：thread

For an executable file, the LC_UNIXTHREAD command defines the initial thread state of the main thread of the process. LC_THREAD is similar to LC_UNIXTHREAD but does not cause the kernel to allocate a stack.

LC_UNIXTHREAD = 0x5

含义：unix thread (includes a stack)

LC_LOADFVMLIB = 0x6

load a specified fixed VM shared library

LC_IDFVMLIB = 0x7

object identification info (obsolete)

LC_IDENT = 0x8

object identification info (obsolete)

LC_FVMFILE = 0x9

fixed VM file inclusion (internal use)

LC_PREPAGE = 0xa

prepage command (internal use)

LC_DYSYMTAB = 0xb

数据结构定义：dysymtab_command

含义：dynamic link-edit symbol table info

Specifies additional symbol table information used by the dynamic linker.

LC_LOAD_DYLIB = 0xc

数据结构定义：dylib_command

含义：load a dynamically linked shared library

Defines the name of a dynamic shared library that this file links against.

LC_ID_DYLIB = 0xd

数据结构定义：dylib_command

含义：dynamically linked shared lib ident

Specifies the install name of a dynamic shared library.

LC_LOAD_DYLINKER = 0xe

数据结构定义：dylinker_command

含义：load a dynamic linker

Specifies the dynamic linker that the kernel executes to load this file.

LC_ID_DYLINKER = 0xf

数据结构定义：dylinker_command

含义：dynamic linker identification

Identifies this file as a dynamic linker.

LC_PREBOUND_DYLIB = 0x10

数据结构定义：prebound_dylib_command

含义：modules prebound for a dynamically linked shared library

For a shared library that this executable is linked prebound against, specifies the modules in the shared library that are used.

LC_ROUTINES = 0x11

数据结构定义：routines_command

含义：image routines

Contains the address of the shared library initialization routine (specified by the linker’s -init option).

LC_SUB_FRAMEWORK = 0x12

数据结构定义：sub_framework_command

含义：sub framework

Identifies this file as the implementation of a subframework of an umbrella framework. The name of the umbrella framework is stored in the string parameter.

LC_SUB_UMBRELLA = 0x13

数据结构定义：sub_umbrella_command

含义：sub umbrella

Specifies a file that is a subumbrella of this umbrella framework.

LC_SUB_CLIENT = 0x14

数据结构定义：sub_client_command

含义：sub client

A subframework can explicitly allow another framework or bundle to link against it by including an LC_SUB_CLIENT load command containing the name of the framework or a client name for a bundle.

LC_SUB_LIBRARY = 0x15

数据结构定义：sub_library_command

含义：sub library

Defines the attributes of the LC_SUB_LIBRARY load command. Identifies a sublibrary of this framework and marks this framework as an umbrella framework.

LC_TWOLEVEL_HINTS = 0x16

数据结构定义：twolevel_hints_command

含义：two-level namespace lookup hints

Contains the two-level namespace lookup hint table.

LC_PREBIND_CKSUM = 0x17

prebind checksum

LC_LOAD_WEAK_DYLIB = 0x18 | LC_REQ_DYLD = 0x80000018

load a dynamically linked shared library that is allowed to be missing (all symbols are weak imported)

LC_SEGMENT_64 = 0x19

数据结构定义：segment_command_64

含义：64-bit segment of this file to be mapped

Defines a 64-bit segment of this file to be mapped into the address space of the process that loads this file. It also includes all the sections contained by the segment.

LC_ROUTINES_64 = 0x1a

数据结构定义：routines_command_64

含义：64-bit image routines

Contains the address of the shared library 64-bit initialization routine (specified by the linker’s -init option).

LC_UUID = 0x1b

数据结构定义：uuid_command

含义：the uuid

Specifies the 128-bit UUID for an image or its corresponding dSYM file

LC_RPATH = 0x1c | LC_REQ_DYLD = 0x8000001c

run path additions

LC_CODE_SIGNATURE = 0x1d

local of code signature

LC_SEGMENT_SPLIT_INFO = 0x1e

local of info to split segments

LC_REEXPORT_DYLIB = 0x1f | LC_REQ_DYLD = 0x8000001f

load and re-export dylib

LC_LAZY_LOAD_DYLIB = 0x20

delay load of dylib until first use

LC_ENCRYPTION_INFO = 0x21

encrypted segment information

LC_DYLD_INFO = 0x22

compressed dyld information

LC_DYLD_INFO_ONLY = 0x22 | LC_REQ_DYLD = 0x80000022

compressed dyld information only

LC_LOAD_UPWARD_DYLIB = 0x23 | LC_REQ_DYLD = 0x80000023

load upward dylib

LC_VERSION_MIN_MACOSX = 0x24

build for MacOSX min OS version

LC_VERSION_MIN_IPHONEOS = 0x25

build for iPhoneOS min OS version

LC_FUNCTION_STARTS = 0x26

compressed table of function start addresses

LC_DYLD_ENVIRONMENT = 0x27

string for dyld to treat like environment variable

LC_MAIN = 0x28 | LC_REQ_DYLD = 0x80000028

replacement for LC_UNIXTHREAD

LC_DATA_IN_CODE = 0x29

table of non-instructions in __text

LC_SOURCE_VERSION = 0x2A

source version used to build binary

LC_DYLIB_CODE_SIGN_DRS = 0x2B

Code signing DRs copied from linked dylibs

LC_ENCRYPTION_INFO_64 = 0x2C

64-bit encrypted segment information

LC_LINKER_OPTION = 0x2D

linker options in MH_OBJECT files

LC_LINKER_OPTIMIZATION_HINT = 0x2E

optimization hints in MH_OBJECT files

LC_VERSION_MIN_TVOS = 0x2F

build for AppleTV min OS version

LC_VERSION_MIN_WATCHOS = 0x30

build for Watch min OS version

LC_NOTE = 0x31

arbitrary data included within a Mach-O file

LC_BUILD_VERSION = 0x32

build for platform min OS version

LC_DYLD_EXPORTS_TRIE = 0x33 | LC_REQ_DYLD = 0x80000033

used with LinkeditDataCommand, payload is trie

LC_DYLD_CHAINED_FIXUPS = 0x34 | LC_REQ_DYLD = 0x80000034

used with LinkeditDataCommand

LC_FILESET_ENTRY = 0x35 | LC_REQ_DYLD = 0x80000035

used with FilesetEntryCommand

Load Commands定义

源码定义

loader.h

xnu-2050.18.24

loader.h

xnu-7195.81.3

loader.h html

/*
 * The load commands directly follow the mach_header.  The total size of all
 * of the commands is given by the sizeofcmds field in the mach_header.  All
 * load commands must have as their first two fields cmd and cmdsize.  The cmd
 * field is filled in with a constant for that command type.  Each command type
 * has a structure specifically for it.  The cmdsize field is the size in bytes
 * of the particular load command structure plus anything that follows it that
 * is a part of the load command (i.e. section structures, strings, etc.).  To
 * advance to the next load command the cmdsize can be added to the offset or
 * pointer of the current load command.  The cmdsize for 32-bit architectures
 * MUST be a multiple of 4 bytes and for 64-bit architectures MUST be a multiple
 * of 8 bytes (these are forever the maximum alignment of any load commands).
 * The padded bytes must be zero.  All tables in the object file must also
 * follow these rules so the file can be memory mapped.  Otherwise the pointers
 * to these tables will not work well or at all on some machines.  With all
 * padding zeroed like objects will compare byte for byte.
 */
struct load_command {
    uint32_t cmd;        /* type of load command */
    uint32_t cmdsize;    /* total size of command in bytes */
};

/*
 * After MacOS X 10.1 when a new load command is added that is required to be
 * understood by the dynamic linker for the image to execute properly the
 * LC_REQ_DYLD bit will be or'ed into the load command constant.  If the dynamic
 * linker sees such a load command it it does not understand will issue a
 * "unknown load command required for execution" error and refuse to use the
 * image.  Other load commands without this bit that are not understood will
 * simply be ignored.
 */
#define LC_REQ_DYLD 0x80000000

/* Constants for the cmd field of all load commands, the type */
#define    LC_SEGMENT    0x1    /* segment of this file to be mapped */
#define    LC_SYMTAB    0x2    /* link-edit stab symbol table info */
#define    LC_SYMSEG    0x3    /* link-edit gdb symbol table info (obsolete) */
#define    LC_THREAD    0x4    /* thread */
#define    LC_UNIXTHREAD    0x5    /* unix thread (includes a stack) */
#define    LC_LOADFVMLIB    0x6    /* load a specified fixed VM shared library */
#define    LC_IDFVMLIB    0x7    /* fixed VM shared library identification */
#define    LC_IDENT    0x8    /* object identification info (obsolete) */
#define LC_FVMFILE    0x9    /* fixed VM file inclusion (internal use) */
#define LC_PREPAGE      0xa     /* prepage command (internal use) */
#define    LC_DYSYMTAB    0xb    /* dynamic link-edit symbol table info */
#define    LC_LOAD_DYLIB    0xc    /* load a dynamically linked shared library */
#define    LC_ID_DYLIB    0xd    /* dynamically linked shared lib ident */
#define LC_LOAD_DYLINKER 0xe    /* load a dynamic linker */
#define LC_ID_DYLINKER    0xf    /* dynamic linker identification */
#define    LC_PREBOUND_DYLIB 0x10    /* modules prebound for a dynamically */
                /*  linked shared library */
#define    LC_ROUTINES    0x11    /* image routines */
#define    LC_SUB_FRAMEWORK 0x12    /* sub framework */
#define    LC_SUB_UMBRELLA 0x13    /* sub umbrella */
#define    LC_SUB_CLIENT    0x14    /* sub client */
#define    LC_SUB_LIBRARY  0x15    /* sub library */
#define    LC_TWOLEVEL_HINTS 0x16    /* two-level namespace lookup hints */
#define    LC_PREBIND_CKSUM  0x17    /* prebind checksum */

/*
 * load a dynamically linked shared library that is allowed to be missing
 * (all symbols are weak imported).
 */
#define    LC_LOAD_WEAK_DYLIB (0x18 | LC_REQ_DYLD)

#define    LC_SEGMENT_64    0x19    /* 64-bit segment of this file to be
                   mapped */
#define    LC_ROUTINES_64    0x1a    /* 64-bit image routines */
#define LC_UUID        0x1b    /* the uuid */
#define LC_RPATH       (0x1c | LC_REQ_DYLD)    /* runpath additions */
#define LC_CODE_SIGNATURE 0x1d    /* local of code signature */
#define LC_SEGMENT_SPLIT_INFO 0x1e /* local of info to split segments */
#define LC_REEXPORT_DYLIB (0x1f | LC_REQ_DYLD) /* load and re-export dylib */
#define    LC_LAZY_LOAD_DYLIB 0x20    /* delay load of dylib until first use */
#define    LC_ENCRYPTION_INFO 0x21    /* encrypted segment information */
#define    LC_DYLD_INFO     0x22    /* compressed dyld information */
#define    LC_DYLD_INFO_ONLY (0x22|LC_REQ_DYLD)    /* compressed dyld information only */
#define    LC_LOAD_UPWARD_DYLIB (0x23 | LC_REQ_DYLD) /* load upward dylib */
#define LC_VERSION_MIN_MACOSX 0x24   /* build for MacOSX min OS version */
#define LC_VERSION_MIN_IPHONEOS 0x25 /* build for iPhoneOS min OS version */
#define LC_FUNCTION_STARTS 0x26 /* compressed table of function start addresses */
#define LC_DYLD_ENVIRONMENT 0x27 /* string for dyld to treat
                    like environment variable */
#define LC_MAIN (0x28|LC_REQ_DYLD) /* replacement for LC_UNIXTHREAD */
#define LC_DATA_IN_CODE 0x29 /* table of non-instructions in __text */
#define LC_SOURCE_VERSION 0x2A /* source version used to build binary */
#define LC_DYLIB_CODE_SIGN_DRS 0x2B /* Code signing DRs copied from linked dylibs */
#define    LC_ENCRYPTION_INFO_64 0x2C /* 64-bit encrypted segment information */
#define LC_LINKER_OPTION 0x2D /* linker options in MH_OBJECT files */
#define LC_LINKER_OPTIMIZATION_HINT 0x2E /* optimization hints in MH_OBJECT files */
#define LC_VERSION_MIN_TVOS 0x2F /* build for AppleTV min OS version */
#define LC_VERSION_MIN_WATCHOS 0x30 /* build for Watch min OS version */
#define LC_NOTE 0x31 /* arbitrary data included within a Mach-O file */
#define LC_BUILD_VERSION 0x32 /* build for platform min OS version */
#define LC_DYLD_EXPORTS_TRIE (0x33 | LC_REQ_DYLD) /* used with linkedit_data_command, payload is trie */
#define LC_DYLD_CHAINED_FIXUPS (0x34 | LC_REQ_DYLD) /* used with linkedit_data_command */
#define LC_FILESET_ENTRY      (0x35 | LC_REQ_DYLD) /* used with fileset_entry_command */

说明

iOS 15.0后新增的Load Command

LC_DYLD_CHAINED_FIXUPS

LC_DYLD_EXPORTS_TRIE

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 17:04:15

LC_UUID

LC_UUID

LC_UUID

是什么：Specifies the 128-bit UUID for an image or its corresponding dSYM file

作用：用来标识唯一APP

每个可执行程序都有一个uuid，这样根据不同的uuid能确定包。比如崩溃日志中就会包含uuid字段。表示是哪个包崩溃了

数据结构定义：uuid_command

uuid_command定义

struct uuid_command {
    uint32_t    cmd;        /* LC_UUID */
    uint32_t    cmdsize;    /* sizeof(struct uuid_command) */
    uint8_t    uuid[16];    /* the 128-bit uuid */
};

举例

MachOView查看到某LC_UUID

jtool2解析AwemeCore中jtool2 -l xxx/AwemeCore输出的

LC 09: LC_UUID                   UUID: F1FCF15A-6465-31F0-9300-5BA1B8F91017

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 11:37:56

LC_SEGMENT

LC_SEGMENT

LC_SEGMENT

含义：Defines a segment of this file to be mapped into the address space of the process that loads this file. It also includes all the sections contained by the segment.

数据结构定义：segment_command

segment_command定义

精简定义

struct segment_command {
  uint32_t  cmd;
  uint32_t  cmdsize;
  char      segname[16];
  uint32_t  vmaddr;
  uint32_t  vmsize;
  uint32_t  fileoff;
  uint32_t  filesize;
  vm_prot_t maxprot;
  vm_prot_t initprot;
  uint32_t  nsects;
  uint32_t  flags;
};

完整定义

/*
 * The segment load command indicates that a part of this file is to be
 * mapped into the task's address space.  The size of this segment in memory,
 * vmsize, maybe equal to or larger than the amount to map from this file,
 * filesize.  The file is mapped starting at fileoff to the beginning of
 * the segment in memory, vmaddr.  The rest of the memory of the segment,
 * if any, is allocated zero fill on demand.  The segment's maximum virtual
 * memory protection and initial virtual memory protection are specified
 * by the maxprot and initprot fields.  If the segment has sections then the
 * section structures directly follow the segment command and their size is
 * reflected in cmdsize.
 */
struct segment_command { /* for 32-bit architectures */
    uint32_t    cmd;        /* LC_SEGMENT */
    uint32_t    cmdsize;    /* includes sizeof section structs */
    char        segname[16];    /* segment name */
    uint32_t    vmaddr;        /* memory address of this segment */
    uint32_t    vmsize;        /* memory size of this segment */
    uint32_t    fileoff;    /* file offset of this segment */
    uint32_t    filesize;    /* amount to map from the file */
    vm_prot_t    maxprot;    /* maximum VM protection */
    vm_prot_t    initprot;    /* initial VM protection */
    uint32_t    nsects;        /* number of sections in segment */
    uint32_t    flags;        /* flags */
};

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 17:18:48

LC_SEGMENT_64

LC_SEGMENT_64

LC_SEGMENT_64

数据结构定义：segment_command_64

含义：Defines a 64-bit segment of this file to be mapped into the address space of the process that loads this file. It also includes all the sections contained by the segment.

segment_command_64定义

/*
 * The 64-bit segment load command indicates that a part of this file is to be
 * mapped into a 64-bit task's address space.  If the 64-bit segment has
 * sections then section_64 structures directly follow the 64-bit segment
 * command and their size is reflected in cmdsize.
 */
struct segment_command_64 { /* for 64-bit architectures */
    uint32_t    cmd;        /* LC_SEGMENT_64 */
    uint32_t    cmdsize;    /* includes sizeof section_64 structs */
    char        segname[16];    /* segment name */
    uint64_t    vmaddr;        /* memory address of this segment */
    uint64_t    vmsize;        /* memory size of this segment */
    uint64_t    fileoff;    /* file offset of this segment */
    uint64_t    filesize;    /* amount to map from the file */
    vm_prot_t    maxprot;    /* maximum VM protection */
    vm_prot_t    initprot;    /* initial VM protection */
    uint32_t    nsects;        /* number of sections in segment */
    uint32_t    flags;        /* flags */
};

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 17:18:58

LC_SYMTAB

LC_SYMTAB

LC_SYMTAB

数据结构定义：symtab_command

含义：Specifies the symbol table for this file. This information is used by both static and dynamic linkers when linking the file, and also by debuggers to map symbols to the original source code files from which the symbols were generated.

symtab_command定义

源码定义：

精简定义

struct symtab_command {
   uint32_t cmd;
   uint32_t cmdsize;
   uint32_t symoff;
   uint32_t nsyms;
   uint32_t stroff;
   uint32_t strsize;
};

详细定义

/*
 * The symtab_command contains the offsets and sizes of the link-edit 4.3BSD
 * "stab" style symbol table information as described in the header files
 * <nlist.h> and <stab.h>.
 * symtab_command 包含了符号表、字符串索引表 的偏移量和大小 。
 */
struct symtab_command {
    uint32_t    cmd;        /* LC_SYMTAB */
    uint32_t    cmdsize;    /* sizeof(struct symtab_command) */
    uint32_t    symoff;        /* symbol table offset */
    uint32_t    nsyms;        /* number of symbol table entries */
    uint32_t    stroff;        /* string table offset */
    uint32_t    strsize;    /* string table size in bytes */
};

举例

MachOView查看到某LC_SYMTAB的效果

说明

命令的大小是24 （十进制）

符号表在物理文件的偏移量是 77360448

符号表的大小 1069179

String表的物理文件偏移量是94479244

string表的大小是22093264

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 17:27:14

LC_DYLD_CHAINED_FIXUPS

LC_DYLD_CHAINED_FIXUPS

LC_DYLD_CHAINED_FIXUPS

说明： iOS 15.0+新出现的Load Command

含义

Chained fixups is a new way to store information that will be used by dyld. Replacing LC_DYLD_INFO(_ONLY), the chained fixups can save binary size and reduce launch time.

Traditionally, dyld, at launch time, needs to slide the fixed addresses with a random number, known as ASLR. This operation is called rebasing. Also, dyld needs to connect symbols from current binary with its linked dynamic libraries. This is called binding. Under the new format, both rebasing and binding have a new name, fixup, because they need to be "fixed up" before main function.

Chained fixups is enabled by default if the binary is built for device and targeted at iOS 14+. We can also manually enable it by passing -fixup_chains to ld. To disable it, use -no_fixup_chains.

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 17:13:14

LC_DYLD_EXPORTS_TRIE

LC_DYLD_EXPORTS_TRIE

LC_DYLD_EXPORTS_TRIE

说明： iOS 15.0+新出现的Load Command

含义

If the binary is targeted at iOS 14+ or is linked with -fixup_chains linker flag, the same information is stored in LC_DYLD_EXPORTS_TRIE load command instead. The detail of this change is discussed at Chained Fixups.

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 17:10:17

Segment

segment

Mach-O中包含1个或多个segment

一个segment中包含0或多个section

segment和sectoin的基本定义

常见segment

概述

最常用的segment：__PAGEZERO、__TEXT、__DATA、__LINKEDIT

举例

MachOView查看某Mach-O的效果

详解

__PAGEZERO

The static linker creates a __PAGEZERO segment as the first segment of an executable file. This segment is located at virtual memory location 0 and has no protection rights assigned, the combination of which causes accesses to NULL, a common C programming error, to immediately crash. The __PAGEZERO segment is the size of one full VM page for the current architecture (for Intel-based and PowerPC-based Macintosh computers, this is 4096 bytes or 0x1000 in hexadecimal). Because there is no data in the __PAGEZERO segment, it occupies no space in the file (the file size in the segment command is 0).

__TEXT

The __TEXT segment contains executable code and other read-only data. To allow the kernel to map it directly from the executable into sharable memory, the static linker sets this segment’s virtual memory permissions to disallow writing. When the segment is mapped into memory, it can be shared among all processes interested in its contents. (This is primarily used with frameworks, bundles, and shared libraries, but it is possible to run multiple copies of the same executable in OS X, and this applies in that case as well.) The read-only attribute also means that the pages that make up the __TEXT segment never need to be written back to disk. When the kernel needs to free up physical memory, it can simply discard one or more __TEXT pages and re-read them from disk when they are next needed.

__DATA

The __DATA segment contains writable data. The static linker sets the virtual memory permissions of this segment to allow both reading and writing. Because it is writable, the __DATA segment of a framework or other shared library is logically copied for each process linking with the library. When memory pages such as those making up the __DATA segment are readable and writable, the kernel marks them copy-on-write; therefore when a process writes to one of these pages, that process receives its own private copy of the page.

__OBJC

The __OBJC segment contains data used by the Objective-C language runtime support library.

__IMPORT

The __IMPORT segment contains symbol stubs and non-lazy pointers to symbols not defined in the executable. This segment is generated only for executables targeted for the IA-32 architecture.

__LINKEDIT

The __LINKEDIT segment contains raw data used by the dynamic linker, such as symbol, string, and relocation table entries.

主要segment的section

segment段

__TEXT段

Section节

__text: The compiled machine code for the executable

__const: The general constant data for the executable

__cstring: Literal string constants (quoted strings in source code)

__picsymbol_stub: Position-independent code stub routines used by the dynamic linker (dyld)

__DATA段

Section节

__data: Initialized global variables (for example int a = 1; or static int a = 1;)

__const: Constant data needing relocation (for example, char * const p = "foo";)

__bss: Uninitialized static variables (for example, static int a;)

__common: Uninitialized external globals (for example, int a; outside function blocks)

__dyld: A placeholder section, used by the dynamic linker

__la_symbol_ptr: Lazy symbol pointers. Symbol pointers for each undefined function called by the executable

__nl_symbol_ptr: Non lazy symbol pointers. Symbol pointers for each undefined data symbol referenced by the executable

举例

举例1

举例2

MachOView查看zzzzHeiBaoLib.dylib

举例3

# Sections:
# Address    Size        Segment    Section
0x100001DC0    0x00A38B42    __TEXT    __text
0x100A3A902    0x00001C9E    __TEXT    __stubs
0x100A3C5A0    0x0000204A    __TEXT    __stub_helper
0x100A3E5EC    0x000231B0    __TEXT    __gcc_except_tab
0x100A617A0    0x000178D0    __TEXT    __const
0x100A79070    0x0008A5DA    __TEXT    __cstring
0x100B0364A    0x0005F462    __TEXT    __objc_methname
0x100B62AAC    0x00008794    __TEXT    __objc_classname
0x100B6B240    0x0003B4EB    __TEXT    __objc_methtype
0x100BA672C    0x00001742    __TEXT    __ustring
0x100BA7E6E    0x00000172    __TEXT    __entitlements
0x100BA7FE0    0x0000037B    __TEXT    __dof_RACSignal
0x100BA835B    0x000002E8    __TEXT    __dof_RACCompou
0x100BA8644    0x00012964    __TEXT    __unwind_info
0x100BBAFA8    0x00000058    __TEXT    __eh_frame
0x100BBB000    0x00000008    __DATA    __nl_symbol_ptr
0x100BBB008    0x00000BD8    __DATA    __got
0x100BBBBE0    0x00002628    __DATA    __la_symbol_ptr
0x100BBE208    0x00000070    __DATA    __mod_init_func
0x100BBE280    0x0001CEE0    __DATA    __const
0x100BDB160    0x00039CA0    __DATA    __cfstring
0x100C14E00    0x00002B00    __DATA    __objc_classlist
0x100C17900    0x000000A0    __DATA    __objc_nlclslist
0x100C179A0    0x00000680    __DATA    __objc_catlist
0x100C18020    0x000000D0    __DATA    __objc_nlcatlist
0x100C180F0    0x00000638    __DATA    __objc_protolist
0x100C18728    0x00000008    __DATA    __objc_imageinfo
0x100C18730    0x001252F8    __DATA    __objc_const
0x100D3DA28    0x000150B0    __DATA    __objc_selrefs
0x100D52AD8    0x00000150    __DATA    __objc_protorefs
0x100D52C28    0x00002A38    __DATA    __objc_classrefs
0x100D55660    0x000019F8    __DATA    __objc_superrefs
0x100D57058    0x000085E8    __DATA    __objc_ivar
0x100D5F640    0x0001AE00    __DATA    __objc_data
0x100D7A440    0x0000CC70    __DATA    __data
0x100D870B0    0x00004698    __DATA    __bss
0x100D8B750    0x00001298    __DATA    __common

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 22:08:22

__TEXT

__TEXT

__TEXTsegment的section：

概述

图

文字

__TEXT,__text: The compiled machine code for the executable

__TEXT,__const: The general constant data for the executable

__TEXT,__cstring: Literal string constants (quoted strings in source code)

__TEXT,__picsymbol_stub: Position-independent code stub routines used by the dynamic linker (dyld).

详解

__TEXT,__text

Executable machine code

The compiler generally places only executable code in this section, no tables or data of any sort.

代码节，存放机器编译后的代码

__TEXT,__const

Initialized constant variables

The compiler places all nonrelocatable data declared const in this section. (The compiler typically places uninitialized constant variables in a zero-filled section.)

存储const修饰的常量

__TEXT,__cstring

Constant C strings

A C string is a sequence of non-null bytes that ends with a null byte ('\0'). The static linker coalesces constant C string values, removing duplicates, when building the final product.

代码运行中包含的字符串常量

比如

代码中定义#define kGeTuiPushAESKey @"DWE2#@e2!",那DWE2#@e2!会存在这个区里

__TEXT,__objc_classname

objc类名

__TEXT,__objc_methname

objc的方法名称

__TEXT,__objc_methtype

objc方法类型

__TEXT,__picsymbol_stub

Position-independent indirect symbol stubs

See in Mach-O Programming Topics for more information.

__TEXT,__stubs

用于辅助做动态链接代码（dyld）

__TEXT,__stub_helper

用于辅助做动态链接（dyld）

__TEXT,__symbol_stub

Indirect symbol stubs

详见：PIC

__TEXT,__literal4

4-byte literal values

The compiler places single-precision floating point constants in this section. The static linker coalesces these values, removing duplicates, when building the final product. With some architectures, it’s more efficient for the compiler to use immediate load instructions rather than adding to this section.

__TEXT,__literal8

8-byte literal values

The compiler places double-precision floating point constants in this section. The static linker coalesces these values, removing duplicates, when building the final product. With some architectures, it’s more efficient for the compiler to use immediate load instructions rather than adding to this section.

__TEXT,__gcc_except_tab

__TEXT,__dof_RACSignal

__TEXT,__dof_RACCompou

__TEXT,__unwind_info

__TEXT,__ustring

举例

MachOView查看

zzzzHeiBaoLib.dylib

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 22:09:17

__text

TEXT,text

section:__TEXT,__text

含义

Executable machine code

The compiler generally places only executable code in this section, no tables or data of any sort.

代码节，存放机器编译后的代码

举例

arm64的akd中的__TEXT,__text

jtool2

 jtool2 --pages ./akd
0x0-0xf4000 __TEXT    (999424 bytes)
    0x43d0-0xbbf24 __TEXT.__text    (752468 bytes)
...

->

整个TEXT代码段范围：0x0-0xf4000 __TEXT (999424 bytes) = 976KB

代码段内代码的二进制数据opcode的范围：0x43d0-0xbbf24 __TEXT.__text (752468 bytes) = 0xB7B54 = 约734.8KB

rabin2

rabin2 -S ./akd
...
0   0x000043d0  0xb7b54 0x1000043d0  0xb7b54 -r-x 0.__TEXT.__text

->

text代码段的

起始地址：0x000043d0

vaddr=虚拟地址：0x1000043d0

大小：0xb7b54

= 0xB7B54 = 752468

MachOView

代码段的代码信息

概述：Executable (ARM64_ALL)->Load Commands->LC_SEGMENT_64 (__TEXT)->Section64 Header (__text)

真正数据：Executable (ARM64_ALL)->Section64 (__TEXT, __text)

另外：Executable (ARM64_ALL)->Section64 (__TEXT, __text)->Assembly

MachOView还提供了，该二进制数据对应的反汇编结果Assembly（仅供参考）

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 21:59:32

__DATA

__DATA

__DATAsegment的section：

概述

图

文字

__DATA,__data: Initialized global variables (for example int a = 1; or static int a = 1;).

__DATA,__const: Constant data needing relocation (for example, char * const p = "foo";).

__DATA,__bss: Uninitialized static variables (for example, static int a;).

__DATA,__common: Uninitialized external globals (for example, int a; outside function blocks).

__DATA,__dyld: A placeholder section, used by the dynamic linker.

__DATA,__la_symbol_ptr: Lazy symbol pointers. Symbol pointers for each undefined function called by the executable.

__DATA,__nl_symbol_ptr: Non lazy symbol pointers. Symbol pointers for each undefined data symbol referenced by the executable.

详解

__DATA,__bss

Data for uninitialized static variables (for example, static int i;).

存储未初始化的静态量。比如：static NSThread *_networkRequestThread = nil;

其中这里面的size表示应用运行占用的内存，不是实际的占用空间。所以计算大小的时候应该去掉这部分数据。

__DATA,__common

Uninitialized imported symbol definitions (for example, int i;) located in the global scope (outside of a function declaration).

存储导出的全局的数据。类似于static，但是没有用static修饰

比如

KSCrash里面NSDictionary* g_registerOrders;, g_registerOrders就存储在__common里面

__DATA,__data

Initialized mutable variables, such as writable C strings and data arrays.

放了协议和一些固定了地址（已经初始化）的静态量

__DATA,__la_symbol_ptr

Lazy symbol pointers, which are indirect references to functions imported from a different file

详见：PIC

懒加载的函数指针地址。和__stubs和__stub_helper配合使用

__DATA,__nl_symbol_ptr

Non-lazy symbol pointers, which are indirect references to data items imported from a different file

详见：PIC

__DATA,__dyld

Placeholder section used by the dynamic linker.

__DATA,__cfstring

使用Core Foundation字符串

__DATA,__const

Initialized relocatable constant variables.

存储constant常量的数据。比如使用extern导出的const修饰的常量

__DATA,__mod_init_func

Module initialization functions. The C++ compiler places static constructors here.

模块初始化的方法

__DATA,__mod_term_func

Module termination functions.

__DATA,__objc_classlist

objc类列表,保存类信息，映射了__objc_data的地址

__DATA,__objc_data

objc的数据。用于保存类需要的数据。最主要的内容是映射__objc_const地址，用于找到类的相关数据

__DATA,__objc_nlclslist

Objective-C的+load函数列表，比__mod_init_func更早执行

__DATA,__objc_catlist

categories

__DATA,__objc_nlcatlist

Objective-C的categories的+load函数列表

__DATA,__objc_protolist

objc协议列表

__DATA,__objc_imageinfo

objc镜像信息

__DATA,__got

存储引用符号的实际地址，类似于动态符号表

__DATA,__objc_const

objc常量。保存objc_classdata结构体数据。用于映射类相关数据的地址，比如类名，方法名等

__DATA,__objc_selrefs

引用到的objc方法

__DATA,__objc_protorefs

引用到的objc协议

__DATA,__objc_classrefs

引用到的objc类

__DATA,__objc_superrefs

objc超类引用

__DATA,__objc_ivar

objc的ivar指针,存储属性

举例

MachOView查看

zzzzHeiBaoLib.dylib

某app

__DATA的segment commond

说明

命令类型是LC_SEGMENT_64

命令的大小1832

segment 命令的名称是__DATA

映射的内存地址是4360744960（十进制）

内存的大小12488704

文件的偏移量是65777664

需要映射的文件的大小10424320

最大内存保护权限：读写执行

初始内存权限：读写

这个端附属了22个 section，也就是说1832大小的segment_command包括了22个section命令的大小。

看的方法：offset代表文件的便宜量、Data表示内存地址中存储的值、description表示这段内存地址的名称的描述、value表示存储的值的可视描述。

后续的22个section

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 17:40:07

__la_symbol_ptr

DATA,la_symbol_ptr

举例

MachOView查看zzzzHeiBaoLib.dylib

分析：

其中很多函数，就是IDA中Imports的函数：

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 23:17:45

__got

DATA,got

GOT=Global Offset Table=全局符号偏移表

解释

iOS 开发中，动态库是个绕不开的话题，系统库基本上是动态库。它的一大优势是节约内存，可让多个程序映射同一份的动态库，实现代码共享。动态库本身也是一个 Mach-O 文件，也有数据段、代码段等。其中代码段可读可执行，数据段可读可写。

动态库共享的只是代码段部分，为了达到代码段共享的目的，其符号地址在生成时就不能写死，因为它映射到每个程序中虚拟内存空间中的位置可能不一样。对于数据段部分，由于各个程序会对其进行修改，因此每个程序会单独映射一份。

那么如何解决代码段共享的问题呢？聪明的人们，想出一种精妙的解决方式。通过添加一个中间层，到另一个表中去查找符号的地址。这个表就叫got=global offset table=全局符号偏移表，然后在运行时绑定地址信息，将地址填入到 got 中。这样代码段中的符号就与具体地址无关，只和 got 中的数据有关。这种方式就叫 PIC=Program Independent Code=地址无关代码

举例

MachOView查看

某程序

zzzzHeiBaoLib.dylib

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 23:17:18

__IMPORT

__IMPORT

__IMPORTsegment的section：

__IMPORT,__jump_table

Stubs for calls to functions in a dynamic library.

__IMPORT,__pointers

Non-lazy symbol pointers, which are direct references to functions imported from a different file.

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 16:28:34

__LINKEDIT

__LINKEDIT

用户层的完全链接后的Mach-O文件，最后一个segment是link edit

包含link edit信息

Symbol Table=符号表

String Table=字符串表

等等

用于：动态加载器dynamic loader去链接所依赖的库

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 17:16:38

__OBJC

__OBJC

segment:__OBJC

相关解释

Objective-C是一种Reflection反射型语言，可以在运行时获取和修改自身状态，其中的实现存在于libobjc.A.dylib库中，这些“运行时”能力源于objective-c类结构组织较为灵活，并提供了操作自身结构的接口，同时在生成的可执行文件(Mach-O)中存在__OBJC段，这些节中提供了足够的类构成信息，而Mac端gdb可以解析这些结构，而正由于objc提供了如此多的信息，因此也比c++在同等情况下逆向难度低一些。

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 17:15:43

Section

section节

section定义

源码定义：

/*
 * A segment is made up of zero or more sections.  Non-MH_OBJECT files have
 * all of their segments with the proper sections in each, and padded to the
 * specified segment alignment when produced by the link editor.  The first
 * segment of a MH_EXECUTE and MH_FVMLIB format file contains the mach_header
 * and load commands of the object file before its first section.  The zero
 * fill sections are always last in their segment (in all formats).  This
 * allows the zeroed segment padding to be mapped into memory where zero fill
 * sections might be. The gigabyte zero fill sections, those with the section
 * type S_GB_ZEROFILL, can only be in a segment with sections of this type.
 * These segments are then placed after all other segments.
 *
 * The MH_OBJECT format has all of its sections in one segment for
 * compactness.  There is no padding to a specified segment boundary and the
 * mach_header and load commands are not part of the segment.
 *
 * Sections with the same section name, sectname, going into the same segment,
 * segname, are combined by the link editor.  The resulting section is aligned
 * to the maximum alignment of the combined sections and is the new section's
 * alignment.  The combined sections are aligned to their original alignment in
 * the combined section.  Any padded bytes to get the specified alignment are
 * zeroed.
 *
 * The format of the relocation entries referenced by the reloff and nreloc
 * fields of the section structure for mach object files is described in the
 * header file <reloc.h>.
 */
struct section { /* for 32-bit architectures */
    char        sectname[16];    /* name of this section */
    char        segname[16];    /* segment this section goes in */
    uint32_t    addr;        /* memory address of this section */
    uint32_t    size;        /* size in bytes of this section */
    uint32_t    offset;        /* file offset of this section */
    uint32_t    align;        /* section alignment (power of 2) */
    uint32_t    reloff;        /* file offset of relocation entries */
    uint32_t    nreloc;        /* number of relocation entries */
    uint32_t    flags;        /* flags (section type and attributes)*/
    uint32_t    reserved1;    /* reserved (for offset or index) */
    uint32_t    reserved2;    /* reserved (for count or sizeof) */
};

struct section_64 { /* for 64-bit architectures */
    char        sectname[16];    /* name of this section */
    char        segname[16];    /* segment this section goes in */
    uint64_t    addr;        /* memory address of this section */
    uint64_t    size;        /* size in bytes of this section */
    uint32_t    offset;        /* file offset of this section */
    uint32_t    align;        /* section alignment (power of 2) */
    uint32_t    reloff;        /* file offset of relocation entries */
    uint32_t    nreloc;        /* number of relocation entries */
    uint32_t    flags;        /* flags (section type and attributes)*/
    uint32_t    reserved1;    /* reserved (for offset or index) */
    uint32_t    reserved2;    /* reserved (for count or sizeof) */
    uint32_t    reserved3;    /* reserved */
};

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 16:28:56

symbol

symbol

nlist定义

nlist_64定义

struct nlist_64 {
    union {
        uint32_t  n_strx; /* index into the string table */
    } n_un;
    uint8_t n_type;        /* type flag, see below */
    uint8_t n_sect;        /* section number or NO_SECT */
    uint16_t n_desc;       /* see <mach-o/stab.h> */
    uint64_t n_value;      /* value of this symbol (or stab offset) */
};
/*
 * Symbols with a index into the string table of zero (n_un.n_strx == 0) are
 * defined to have a null, "", name.  Therefore all string indexes to non null
 * names must not have a zero string index.  This is bit historical information
 * that has never been well documented.
 */

/*
 * The n_type field really contains four fields:
 *    unsigned char N_STAB:3,
 *              N_PEXT:1,
 *              N_TYPE:3,
 *              N_EXT:1;
 * which are used via the following masks.
 */
#define    N_STAB    0xe0  /* if any of these bits set, a symbolic debugging entry */
#define    N_PEXT    0x10  /* private external symbol bit */
#define    N_TYPE    0x0e  /* mask for the type bits */
#define    N_EXT    0x01  /* external symbol bit, set for external symbols */

举例

MachOView查看到的Symbol Table

说明

String表的偏移量是0xbbff8, 翻译后是[GMRYouHaoHuoReq getRequestURL]

地址是0x100003300

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 17:24:00

string

string

String Table

String表顺序列出了二进制mach-O文件的中的所有可见字符串。串之间通过0x00分隔。可以通过相对String表起始位置的偏移量随机访问String表中的字符串。符号表结构中的n_strx指定的就是String表中的偏移量。通过这个偏移量可以访问到符号对应的具体字符串

举例

MachOView查看到的某String Table

说明

String表的0xbbf8处是不是[GMRYouHaoHuoReq getRequestURL]，string表的地址是0x049C6D40 加上偏移量0x000BBFB1 ，等于0x54d633d

可以看出string表的0x54d633d地址出就是：[GMRYouHaoHuoReq getRequestURL]

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 17:27:05

FAT

FAT

FAT

名称

Fat Binary=胖二进制

=Fat File=胖二进制文件

=Universal Binary=通用二进制

含义：把多个架构的二进制（比如armv7、arm64等）合并在一起，成了个胖子，所以叫Fat Binary

一个由不同的编译架构后的Mach-O产物所合成的集合体

一个架构的Mach-O只能在相同架构的机器或者模拟器上用

为了支持不同架构需要一个集合体

文件大小

一般比单一架构的文件要大

但是由于多架构会共用一部分资源，所以往往比多个（常常是2个）的总大小要小

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-05 16:43:09

举例

FAT举例

用MachOView查看

RevealServer

用file查看

可以用file：查看Mach-O的文件类型

语法：file inputMacOFile

RevealServer

crifan@licrifandeMacBook-Pro  ~/dev/dev_tool/reverse_security/iOS/Tweak/Reveal2Loader/lemon4ex  file Reveal2Loader/Reveal2Loader/Package/Library/Frameworks/RevealServer.framework/RevealServer
Reveal2Loader/Reveal2Loader/Package/Library/Frameworks/RevealServer.framework/RevealServer: Mach-O universal binary with 5 architectures: [i386:Mach-O dynamically linked shared library i386] [x86_64] [arm_v7] [arm64] [arm64e]
Reveal2Loader/Reveal2Loader/Package/Library/Frameworks/RevealServer.framework/RevealServer (for architecture i386):    Mach-O dynamically linked shared library i386
Reveal2Loader/Reveal2Loader/Package/Library/Frameworks/RevealServer.framework/RevealServer (for architecture x86_64):    Mach-O 64-bit dynamically linked shared library x86_64
Reveal2Loader/Reveal2Loader/Package/Library/Frameworks/RevealServer.framework/RevealServer (for architecture armv7):    Mach-O dynamically linked shared library arm_v7
Reveal2Loader/Reveal2Loader/Package/Library/Frameworks/RevealServer.framework/RevealServer (for architecture arm64):    Mach-O 64-bit dynamically linked shared library arm64
Reveal2Loader/Reveal2Loader/Package/Library/Frameworks/RevealServer.framework/RevealServer (for architecture arm64e):    Mach-O 64-bit dynamically linked shared library arm64e

rsync

➜  ~ which rsync
/usr/bin/rsync
➜  ~ file /usr/bin/rsync
/usr/bin/rsync: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64e:Mach-O 64-bit executable arm64e]
/usr/bin/rsync (for architecture x86_64):    Mach-O 64-bit executable x86_64
/usr/bin/rsync (for architecture arm64e):    Mach-O 64-bit executable arm64e

adb

➜  platform-tools pwd
/Users/crifan/dev/dev_tool/android/AndroidSDK/platform-tools
➜  platform-tools ll
total 49520
...
-rwxr-xr-x@ 1 crifan  staff    13M  7 24 15:26 adb
...
➜  platform-tools file adb
adb: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64]
adb (for architecture x86_64):    Mach-O 64-bit executable x86_64
adb (for architecture arm64):    Mach-O 64-bit executable arm64

lldb

➜  ~ file /usr/bin/lldb
/usr/bin/lldb: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64e:Mach-O 64-bit executable arm64e]
/usr/bin/lldb (for architecture x86_64):    Mach-O 64-bit executable x86_64
/usr/bin/lldb (for architecture arm64e):    Mach-O 64-bit executable arm64e

debugserver

crifan@licrifandeMacBook-Pro  ~/dev/dev_root/iosReverse/AppleStore/fromiPhone8/Developer/usr/bin  ll
total 5240
-rw-r--r--  1 crifan  staff   832B  3  3 11:48 debugable_entitlement.xml
-rwxrwxr-x  1 crifan  staff   1.3M  8  8  2021 debugserver
-rwxr-xr-x  1 crifan  staff   1.3M  3  3 11:49 debugserver_debugable
 crifan@licrifandeMacBook-Pro  ~/dev/dev_root/iosReverse/AppleStore/fromiPhone8/Developer/usr/bin  file debugserver
debugserver: Mach-O universal binary with 2 architectures: [arm64:Mach-O 64-bit executable arm64] [arm64e:Mach-O 64-bit executable arm64e]
debugserver (for architecture arm64):    Mach-O 64-bit executable arm64
debugserver (for architecture arm64e):    Mach-O 64-bit executable arm64e

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 17:54:17

常见问题

FAT常见问题

Select an architecture setting the ARCH= environment variable

用jtool2导出Mask的dylib信息期间就遇到了FAT Binary：

➜  DynamicLibraries jtool2 -h MaskPro.dylib > MaskProDylib/MaskProDylib_jtool2_h_header.txt
Fat binary, little-endian, 2 architectures: armv7, arm64
Select an architecture setting the ARCH= environment variable

即，一个Dylib中，包含了多种架构，此处是armv7和arm64

此处要指定具体架构，才能继续用jtool2查看信息：

➜  DynamicLibraries export ARCH=arm64
➜  DynamicLibraries jtool2 -h MaskPro.dylib > MaskProDylib/MaskProDylib_jtool2_h_header.txt

类似的，后续去用MachOView查看信息，也能看到是：FAT Binary

ARMV7

ARM64

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-05 16:43:30

工具

FAT工具

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-05 16:43:41

lipo

lipo

lipo：常用于多架构Mach-O文件的处理

查看架构信息

lipo -info inputMacOFile

导出某种特定架构

lipo inputMachOFile -thin ArchType -output OutputFile

合并多种架构

lipo inputMachOFile1 inputMachOFile2 -output OutputFile

举例

瘦身=导出单个架构

导出arm64架构

lipo -thin arm64 debugserver_orig -output debugserver_arm64

其中，arm64是从file中查看到包含的多个架构中的其中一个：

crifan@licrifandeMacBook-Pro  ~/dev/dev_root/iosReverse/AppleStore/dynamicDebug/debugserver_lldb  file fromiPhone11/debugserver_orig
fromiPhone11/debugserver_orig: Mach-O universal binary with 2 architectures: [arm64:Mach-O 64-bit executable arm64] [arm64e:Mach-O 64-bit executable arm64e]
fromiPhone11/debugserver_orig (for architecture arm64):    Mach-O 64-bit executable arm64
fromiPhone11/debugserver_orig (for architecture arm64e):    Mach-O 64-bit executable arm64e

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 21:11:36

codesign

codesign

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-05 23:13:30

虚拟地址

虚拟地址

关于虚拟地址

Mach-O中相关定义：segment段和section节中的部分定义

segment_command_64中有对应字段

vmaddr

VM Address=虚拟内存地址

当程序被加载到内存中后，对应的（虚拟）内存地址

注：现代CPU都支持（映射后的）虚拟内存

vmsize

虚拟内存中的程序大小

目前所见过的所有情况中，此值都是和文件大小一样

section_64

addr

虚拟内存地址

不是我们从硬盘中读取的偏移量地址

size

大小，单位是字节

适用于虚拟内存地址和文件偏移量

offset

（磁盘中的）文件内的偏移量

一般来说：

有2个偏移量=地址

虚拟内存=vm

文件=file

对应分别常被简称为

vmoff

fileoff

举例

最开始的起始地址

fileoff = 0x0

vmoff= 0x100000000

程序常被映射到虚拟内存地址0x100000000

进一步说：

其实有3个常见地址相关名词

VA=Virtual Address=虚拟地址

==VM Address=虚拟内存地址

RVA=Relative Virtual Address=相对的虚拟地址

相对于谁：ImageBase=二进制镜像文件的基地址

File Offset=文件内偏移量

file_off = (address - seg.address) + seg.offset

举例

Virtual Address = 0x00401000

ImageBase = 0x00400000

RVA = 0x00001000

MachOView中能看到：

2种显示模式

RAW=原始地址=虚拟地址

RVA=相对虚拟地址 = 类似于VA的概念

比如：baseAddress=基地址=VM Address=虚拟内存基地址：0x100000000

File Offset地址：0xA0460 -> 变成了 RVA地址：0x1000A0460

举例

akd

RAW

RVA

IDA中的地址是：加了基地址后的RVA地址

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 22:03:18

大小限制

Mach-O大小限制

Apple会对iOS的app的大小做一定的限制，防止太大，影响用户下载（的体验）。

iOS的app的大小限制历史

若下载大小超过限制，将无法使用蜂窝网络下载App（iOS 13之前），会收到文件容量太大的提示，需通过 Wi-Fi 网络下载。如下，为苹果历年来对 App 下载大小限制的变化情况：

2008 年 7 月，搭载了 App Store 的 iPhone 3G 正式发售，下载限制仅为 10 MB

2010 年 2 月，苹果将 iPhone 3G 的下载限制从 10 MB 提升到 20 MB

2012 年 3 月，iOS 5.1 正式版后，下载限制从 20 MB 提升到 50 MB

2013 年 9 月，iOS 7 正式版后，下载限制从 50 MB 提升至 100 MB

2017 年 9 月，iOS 11 正式版后，下载限制从 100 MB 提升至 150 MB

2019 年 5 月，下载限制从 150 MB 提升至 200 MB

2019 年 9 月，iOS 13 正式版后，若下载大小超过 200 MB，用户可选择是否使用蜂窝网络下载

如今，App 下载大小超出 200 MB 时 ，会出现两种情况：

iOS 13 以下的用户，无法通过蜂窝数据下载 App

iOS 13 及以上的用户，需要手动设置才可以使用蜂窝网络下载 App

Mach-O可执行文件大小限制

苹果对可执行文件大小亦有明确限制，超过该限制会导致 App 审核被拒：

ERROR: ERROR ITMS-90122: "Invalid ExecutaBe Size. The size of your app's executaBe file 'News.app/News' is 68534272 bytes for architecture 'arm64', which exceeds the maximum allowed size of 60 MB."

具体限制如下：

iOS <7.0：二进制文件中所有的__TEXT段总和不得超过80 MB

iOS 7.x~iOS 8.x：二进制文件中，每个特定架构中的__TEXT段不得超过60 MB

iOS >9.0：二进制文件中所有的__TEXT段总和不得超过500 MB

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 22:16:47

Mach-O工具

Mach-O工具

此处整理查看解析Mach-O文件信息的常用工具。

MachOView

rabin2

jtool2

otool

pagestuff

其他

optool

介绍：optool is a tool which interfaces with MachO binaries in order to insert/remove load commands, strip code signatures, resign, and remove aslr

主页

https://github.com/alexzielenski/optool

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 15:57:22

MachOView

MachOView

MachOView

是什么：查看和编辑x86/ARM的Mach-O二进制文件的工具

Visual Mach-O file browser that allows exploring and in-place editing Intel and ARM binaries.

用途：常用来查看iOS的app的二进制文件的信息

截图

资料

最早好像是在sourceforge

MachOView download | SourceForge.net

https://sourceforge.net/projects/machoview/

后来有人fork到GitHub

gdbinit/MachOView: MachOView fork

https://github.com/gdbinit/MachOView

现在有国人fork后继续维护

fangshufeng/MachOView: 分析Macho必备工具

https://github.com/fangshufeng/MachOView

下载和安装MachOView

下载

从fangshufeng/MachOView: 分析Macho必备工具，进入此时最新版Release 2.6.1去下载

MachOView-2.6.1.dmg

安装

下载后，双击dmg，打开窗口，把其中的MachOView.app拷贝到应用程序即可：

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 15:38:16

举例

MachOView用法举例

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 15:30:06

main_arm64

main_arm64

用MachOView去查看这个main_arm64: Mach-O 64-bit executable arm64

Mach64 Header

内容：

Mach64 Header

MH_MAGIC_64

CPU_TYPE_ARM64

CPU_SUBTYPE_ARM64_ALL

MH_EXECUTE

Number for Load Commands: 17

Flags

MH_NOUNDEFS

MH_DYLDLINK

MH_TWOLEVEL

MH_PIC

Reserved: 0

Load Commands

LC_SEGMENT_64 (__PAGEZERO)

LC_SEGMENT_64 (__TEXT)

__TEXT,__text

__TEXT,__stubs

__TEXT,__stub_helper

__TEXT,__cstring

__TEXT,__unwind_info

LC_SEGMENT_64 (__DATA_CONST)

__DATA_CONST,__got

LC_SEGMENT_64 (__DATA)

__DATA,__la_symbol_ptr

__DATA,__data

__DATA,__common

LC_SEGMENT_64 (__LINKEDIT)

LC_DYLD_INFO_ONLY

LC_SYMTAB

LC_DYSYMTAB

LC_LOAD_DYLINKER

LC_UUID

??? (unsupported)

LC_SOURCE_VERSION

LC_MAIN

估计就是 入口函数 入口地址 = 一般叫做 main函数的 地方了

LC_LOAD_DYLIB (libSystem.B.dylib)

LC_FUNCTION_STARTS

好像是：需要启动运行的函数的列表？

LC_DATA_IN_CODE

LC_CODE_SIGNATURE

Sections

Section64 (__TEXT,__text)

Assembly

Section64 (__TEXT,__stubs)

Symbol Stubs

好像是：

stub=表示 桩 ，地基

表示，代码运行前，要打地基 = 做好准备

所以此处表示：所引用的外部的函数

此处分别是：

___strcpy_chk

_free

_malloc

_printf

Section64 (__TEXT,__stub_helper)

Assembly

Section64 (__TEXT,__cstring)

C String Literals

Section64 (__TEXT,__unwind_info)

Section64 (__DATA_CONST,__got)

Non-Lazy Symbol Pointers

Section64 (__DATA,__la_symbol_ptr)

Lazy Symbol Pointers

Section64 (__DATA,__data)

Dynamic Loader Info

Rebase Info

Opcodes

Actions

Binding Info

Opcodes

Actions

Lazy Binding Info

Opcodes

Actions

Export Info

Opcodes

Actions

对应原先代码中的，全局变量：

// demo Data segment
const char* gAuthor = "crifan"; // demo const string, place where?
char* gFullName = "CrifanLi"; // demo non-const string, place where?
int gInputArgsCount; // demo uninitialized data
int gCurDate = 20230419;  // demo initialized data

好像还额外去导出了这些全局变量？

Function Starts

Functions

Symbol Table

Symbols

Data in Code Entries

Dynamic Symbol Table

Indirect Symbols

String Table

Strings Parse

Code Signature

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 23:12:32

AwemeCore

MachOView用法举例：AwemeCore

Mach64 Header

Symbol Table

Symbols

String Table

Strings Parse

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 23:23:00

zzzzHeiBaoLib.dylib

MachOView用法举例：zzzzHeiBaoLib.dylib

正在分析

__DATA,__mode_init_func

__TEXT,__stubs

__TEXT,__objc_methname

Dynamic Loader Info

Export Info

Actions

Dynamic Symbol Table

Indirect Symbols

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 23:22:35

心得

MachOView使用心得

一些心得：

如果二进制太大，或者本身防护做的比较好，则：MachOView完全加载出来二进制信息

往往耗时很久

也往往会直接崩溃，无法继续使用

比如抖音的二进制加载到最后，就被崩溃。

只能在崩溃之前，及时查看（大）部分已解析出的信息

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 15:38:26

自己编译

自己编译

需求：想要自己编译gdbinit的MachOView

步骤

下载代码：

git clone https://github.com/gdbinit/MachOView.git

双击machoview.xcodeproj用XCode打开

即可自己编译

常见报错

unable to find sdk ‘macosx10.9'

解决办法

TARGETS->Build Settings->Architecture->Base SDK，从macosx 10.9(SDK not found)改为：macOS

MachOView/FatLayout.mm:9:10: 'string' file not found

解决办法

TARGETS->Build Settings->Deployment->macOS Deployment Target，从macOS10.7改为和你当前macOS版本一致或最接近的版本

此处系统是macOS 11.6，但此处选项macOS 11.6，所以选了最接近的macOS 11.5

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 15:37:07

rabin2

rabin2

下载和安装

从官网radare，找到下载地址来源，比如

Releases · radareorg/radare2

下载对应的版本，比如我此处的：

Mac

Intel Chip

radare2-x64-5.7.8.pkg

然后去安装pkg包，安装后，即可有/usr/local/bin/rabin2

之前某次安装后的版本：

➜  ~ rabin2 --version
rabin2: illegal option -- -
rabin2 4.3.1 134 @ darwin-x86-64 git.4.3.1
commit: 815529f204bede6a232fce8b3ac88a905c6943c6 build: 2020-03-06__16:31:10

资料

Radare2官网资料

Introduction - The Official Radare2 Book

Rabin2 - The Official Radare2 Book

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-04 23:22:41

用法

rabin2用法

-I: File Identification

rabin2 -I binaryFile

-e: Entrypoint

rabin2 -e binaryFile

-i: Imports

rabin2 -i binaryFile

-E: Exports

rabin2 -E binaryFile

-s: Symbols

rabin2 -s binaryFile

-l: Libraries

rabin2 -l binaryFile

-z: Strings

rabin2 -z binaryFile

S: Program Sections

rabin2 -S binaryFile

心得

很多的参数，都可以加上r，表示（输出内容是一致的，但是格式不同）以radare格式输出

举例：

rabin2 -I
rabin2 -Ir

rabin2 -s
rabin2 -sr

rabin2 -z
rabin2 -zr

rabin2 -S
rabin2 -Sr

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-05 16:33:26

举例

rabin2用法举例

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-05 16:47:02

AwemeCore

rabin2用法举例：AwemeCore

用rabin2查看抖音AwemeCore二进制的信息：

概述：

(1) File Identification
rabin2 -I AwemeCore

(2) Entrypoint
rabin2 -e AwemeCore

(3) Imports
rabin2 -i AwemeCore

(4) Exports
rabin2 -E AwemeCore > AwemeCore_rabin2_E.txt

(5) Symbols
rabin2 -s AwemeCore > AwemeCore_rabin2_s.txt
rabin2 -sr AwemeCore > AwemeCore_rabin2_sr.txt

(6) Libraries
rabin2 -l AwemeCore > AwemeCore_rabin2_l.txt

(7) Strings
rabin2 -z AwemeCore > AwemeCore_rabin2_z.txt
rabin2 -zr AwemeCore > AwemeCore_rabin2_zr.txt

(8) Program Sections
rabin2 -S AwemeCore > AwemeCore_rabin2_S_section.txt
rabin2 -Sr AwemeCore > AwemeCore_rabin2_Sr_section.txt

详解：

-I: File Identification

➜  AwemeCore rabin2 -I ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore
arch     arm
baddr    0x0
binsz    240666608
bintype  mach0
bits     64
canary   true
class    MACH064
crypto   false
endian   little
havecode true
laddr    0x0
lang     swift
linenum  false
lsyms    false
machine  all
maxopsz  16
minopsz  1
nx       false
os       ios
pcalign  0
pic      false
relocs   false
sanitiz  false
static   false
stripped true
subsys   darwin
va       true

-Ir

➜  AwemeCore rabin2 -Ir ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore
e cfg.bigendian=false
e asm.bits=64
e asm.dwarf=true
e bin.lang=swift
e file.type=mach0
e asm.os=ios
e asm.arch=arm
e asm.pcalign=0

-e： Entrypoint

➜  AwemeCore rabin2 -e ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore
[Entrypoints]
vaddr=0x00023448 paddr=0x00023448 haddr=-1 type=program

1 entrypoints

-er

➜  AwemeCore rabin2 -er ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore
fs symbols
"f entry0 1 0x00023448"
"f entry0_haddr 1 0xffffffffffffffff"
"s entry0"

-i: Imports

➜  AwemeCore rabin2 -i ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore > AwemeCore_rabin2_i.txt

输出内容：

[Imports]
nth  vaddr      bind type           lib name
――――――――――――――――――――――――――――――――――――――――――――
0    0x11476a38 NONE FUNC               sym.imp.Foundation.NSNotFound.getter : Swift.Int
1    0x11476a44 NONE FUNC               sym.imp.static Foundation.CharacterSet.whitespacesAndNewlines.getter : Foundation.CharacterSet
2    0x11476a50 NONE FUNC               sym.imp.type metadata accessor for Foundation.CharacterSet
3    0x11476a5c NONE FUNC               sym.imp.static Foundation.Notification._unconditionallyBridgeFromObjectiveC(Swift.Optional<__C.NSNotification>) -> Foundation.Notification
4    0x11476a68 NONE FUNC               sym.imp.Foundation.Notification.object.getter : Swift.Optional<Any>
5    0x11476a74 NONE FUNC               sym.imp.Foundation.Notification.userInfo.getter : Swift.Optional<Swift.Dictionary<Swift.AnyHashable, Any>>
6    0x11476a80 NONE FUNC               sym.imp.type metadata accessor for Foundation.Notification
7    0x11476a8c NONE FUNC               sym.imp.Foundation._convertErrorToNSError(Swift.Error) -> __C.NSError
8    0x11476a98 NONE FUNC               sym.imp.Foundation._convertNSErrorToError(Swift.Optional<__C.NSError>) -> Swift.Error
9    0x11476aa4 NONE FUNC               sym.imp.type metadata accessor for Foundation.NSFastEnumerationIterator
10   0x00000000 NONE FUNC               sym.imp.protocol conformance descriptor for Foundation.NSFastEnumerationIterator : Swift.IteratorProtocol in Foundation
11   0x11476ab0 NONE FUNC               sym.imp.Foundation.URL.absoluteString.getter : Swift.String
12   0x11476abc NONE FUNC               sym.imp.Foundation.URL._bridgeToObjectiveC() -> __C.NSURL
13   0x11476ac8 NONE FUNC               sym.imp.static Foundation.URL._unconditionallyBridgeFromObjectiveC(Swift.Optional<__C.NSURL>) -> Foundation.URL
14   0x11476ad4 NONE FUNC               sym.imp.Foundation.URL.scheme.getter : Swift.Optional<Swift.String>
15   0x11476ae0 NONE FUNC               sym.imp.Foundation.URL.init(string: __shared Swift.String) -> Swift.Optional<Foundation.URL>
16   0x11476aec NONE FUNC               sym.imp.type metadata accessor for Foundation.URL
17   0x00000000 NONE FUNC               sym.imp.nominal type descriptor for Foundation.URL
18   0x11476af8 NONE FUNC               sym.imp.Foundation.Data._copyContents(initializing: Swift.UnsafeMutableBufferPointer<Swift.UInt8>) -> (Foundation.Data.Iterator, Swift.Int)
19   0x11476b04 NONE FUNC               sym.imp.Foundation.Data._bridgeToObjectiveC() -> __C.NSData
20   0x11476b10 NONE FUNC               sym.imp.static Foundation.Data._unconditionallyBridgeFromObjectiveC(Swift.Optional<__C.NSData>) -> Foundation.Data
21   0x11476b1c NONE FUNC               sym.imp.type metadata accessor for Foundation.Data.Iterator
22   0x00000000 NONE FUNC               sym.imp.type metadata for Foundation.Data
23   0x11476b28 NONE FUNC               sym.imp.static Foundation.Date.distantPast.getter : Foundation.Date
24   0x11476b34 NONE FUNC               sym.imp.Foundation.Date.timeIntervalSince(Foundation.Date) -> Swift.Double
25   0x11476b40 NONE FUNC               sym.imp.Foundation.Date._bridgeToObjectiveC() -> __C.NSDate
26   0x11476b4c NONE FUNC               sym.imp.static Foundation.Date.> infix(Foundation.Date, Foundation.Date) -> Swift.Bool
27   0x11476b58 NONE FUNC               sym.imp.Foundation.Date.init(timeIntervalSinceNow: Swift.Double) -> Foundation.Date
28   0x11476b64 NONE FUNC               sym.imp.Foundation.Date.init() -> Foundation.Date
29   0x11476b70 NONE FUNC               sym.imp.type metadata accessor for Foundation.Date
30   0x00000000 NONE FUNC               sym.imp.nominal type descriptor for Foundation.Date
31   0x11476b7c NONE FUNC               sym.imp.Foundation.UUID.uuidString.getter : Swift.String
32   0x11476b88 NONE FUNC               sym.imp.type metadata accessor for Foundation.UUID
33   0x11476b94 NONE FUNC               sym.imp.Foundation.IndexPath._bridgeToObjectiveC() -> __C.NSIndexPath
34   0x11476ba0 NONE FUNC               sym.imp.static Foundation.IndexPath._unconditionallyBridgeFromObjectiveC(Swift.Optional<__C.NSIndexPath>) -> Foundation.IndexPath
35   0x11476bac NONE FUNC               sym.imp.(extension in UIKit):Foundation.IndexPath.init(row: Swift.Int, section: Swift.Int) -> Foundation.IndexPath
36   0x11476bb8 NONE FUNC               sym.imp.(extension in UIKit):Foundation.IndexPath.row.getter : Swift.Int
37   0x11476bc4 NONE FUNC               sym.imp.(extension in UIKit):Foundation.IndexPath.init(item: Swift.Int, section: Swift.Int) -> Foundation.IndexPath
38   0x11476bd0 NONE FUNC               sym.imp.(extension in UIKit):Foundation.IndexPath.item.getter : Swift.Int
39   0x11476bdc NONE FUNC               sym.imp.(extension in UIKit):Foundation.IndexPath.section.getter : Swift.Int
40   0x11476be8 NONE FUNC               sym.imp.type metadata accessor for Foundation.IndexPath
41   0x00000000 NONE FUNC               sym.imp.nominal type descriptor for Foundation.IndexPath
...
4922 0x1147ea84 NONE FUNC               vImageConverter_CreateWithCGImageFormat
4923 0x1147ea90 NONE FUNC               vImageConverter_Release
4924 0x1147ea9c NONE FUNC               vImageCreateCGImageFromBuffer
4925 0x1147eaa8 NONE FUNC               vImageHorizontalReflect_ARGB8888
4926 0x1147eab4 NONE FUNC               vImageMatrixMultiply_ARGB8888
4927 0x1147eac0 NONE FUNC               vImageMatrixMultiply_ARGB8888ToPlanar8
4928 0x1147eacc NONE FUNC               vImagePermuteChannels_ARGB8888
4929 0x1147ead8 NONE FUNC               vImagePremultiplyData_RGBA8888
4930 0x1147eae4 NONE FUNC               vImageRotate90_ARGB8888
4931 0x1147eaf0 NONE FUNC               vImageRotate90_Planar16U
4932 0x1147eafc NONE FUNC               vImageRotate90_Planar8
4933 0x1147eb08 NONE FUNC               vImageScale_ARGB8888
4934 0x1147eb14 NONE FUNC               vImageScale_Planar16U
4935 0x1147eb20 NONE FUNC               vImageScale_Planar8
4936 0x1147eb2c NONE FUNC               vImageTentConvolve_ARGB8888
4937 0x1147eb38 NONE FUNC               vImageUnpremultiplyData_ARGB8888
4938 0x1147eb44 NONE FUNC               vImageUnpremultiplyData_RGBA8888
4939 0x1147eb50 NONE FUNC               vImageVerticalReflect_ARGB8888
4940 0x1147eb5c NONE FUNC               vasprintf
4941 0x1147eb68 NONE FUNC               vfprintf
4942 0x1147eb74 NONE FUNC               vm_allocate
4943 0x1147eb80 NONE FUNC               vm_deallocate
4944 0x00000000 NONE FUNC               vm_kernel_page_size
4945 0x1147eb8c NONE FUNC               vm_map_page_query
4946 0x00000000 NONE FUNC               vm_page_mask
4947 0x00000000 NONE FUNC               vm_page_size
4948 0x1147eb98 NONE FUNC               vm_protect
4949 0x1147eba4 NONE FUNC               vm_read
4950 0x1147ebb0 NONE FUNC               vm_read_overwrite
4951 0x1147ebbc NONE FUNC               vm_region_64
4952 0x1147ebc8 NONE FUNC               vm_region_recurse_64
4953 0x1147ebd4 NONE FUNC               vm_remap
4954 0x1147ebe0 NONE FUNC               vprintf
4955 0x1147ebec NONE FUNC               vsnprintf
4956 0x1147ebf8 NONE FUNC               vsprintf
4957 0x1147ec04 NONE FUNC               vvexpf
4958 0x1147ec10 NONE FUNC               vvsqrt
4959 0x00000000 NONE FUNC               wait
4960 0x1147ec1c NONE FUNC               wcscat
4961 0x1147ec28 NONE FUNC               wcschr
4962 0x1147ec34 NONE FUNC               wcscmp
4963 0x1147ec40 NONE FUNC               wcscpy
4964 0x1147ec4c NONE FUNC               wcsftime
4965 0x1147ec58 NONE FUNC               wcslen
4966 0x1147ec64 NONE FUNC               wcsncat
4967 0x1147ec70 NONE FUNC               wcsncpy
4968 0x1147ec7c NONE FUNC               wcstok
4969 0x1147ec88 NONE FUNC               wcstombs
4970 0x1147ec94 NONE FUNC               wmemcmp
4971 0x1147eca0 NONE FUNC               wmemcpy
4972 0x1147ecac NONE FUNC               write
4973 0x1147ecb8 NONE FUNC               writev
4974 0x1147ecc4 NONE FUNC               xmlAddChild
4975 0x1147ecd0 NONE FUNC               xmlBufferContent
4976 0x1147ecdc NONE FUNC               xmlBufferCreate
4977 0x1147ece8 NONE FUNC               xmlBufferFree
4978 0x1147ecf4 NONE FUNC               xmlBufferLength
4979 0x1147ed00 NONE FUNC               xmlCheckVersion
4980 0x1147ed0c NONE FUNC               xmlCleanupParser
4981 0x1147ed18 NONE FUNC               xmlCopyNode
4982 0x1147ed24 NONE FUNC               xmlCreatePushParserCtxt
4983 0x1147ed30 NONE FUNC               xmlDocDumpMemory
4984 0x1147ed3c NONE FUNC               xmlDocGetRootElement
4985 0x1147ed48 NONE FUNC               xmlDocSetRootElement
4986 0x1147ed54 NONE FUNC               xmlFirstElementChild
4987 0x00000000 NONE FUNC               xmlFree
4988 0x1147ed60 NONE FUNC               xmlFreeDoc
4989 0x1147ed6c NONE FUNC               xmlFreeNode
4990 0x1147ed78 NONE FUNC               xmlFreeNs
4991 0x1147ed84 NONE FUNC               xmlFreeNsList
4992 0x1147ed90 NONE FUNC               xmlFreeParserCtxt
4993 0x1147ed9c NONE FUNC               xmlGetProp
4994 0x1147eda8 NONE FUNC               xmlHasNsProp
4995 0x1147edb4 NONE FUNC               xmlHasProp
4996 0x1147edc0 NONE FUNC               xmlInitParser
4997 0x1147edcc NONE FUNC               xmlNewDoc
4998 0x1147edd8 NONE FUNC               xmlNewNode
4999 0x1147ede4 NONE FUNC               xmlNewNs
5000 0x1147edf0 NONE FUNC               xmlNewNsProp
5001 0x1147edfc NONE FUNC               xmlNewProp
5002 0x1147ee08 NONE FUNC               xmlNewText
5003 0x1147ee14 NONE FUNC               xmlNextElementSibling
5004 0x1147ee20 NONE FUNC               xmlNodeDump
5005 0x1147ee2c NONE FUNC               xmlNodeGetContent
5006 0x1147ee38 NONE FUNC               xmlNodeListGetString
5007 0x1147ee44 NONE FUNC               xmlNodeSetContent
5008 0x1147ee50 NONE FUNC               xmlNodeSetName
5009 0x1147ee5c NONE FUNC               xmlParseChunk
5010 0x1147ee68 NONE FUNC               xmlReadMemory
5011 0x1147ee74 NONE FUNC               xmlSearchNs
5012 0x1147ee80 NONE FUNC               xmlSearchNsByHref
5013 0x1147ee8c NONE FUNC               xmlSetNs
5014 0x1147ee98 NONE FUNC               xmlSetTreeDoc
5015 0x1147eea4 NONE FUNC               xmlStrEqual
5016 0x1147eeb0 NONE FUNC               xmlStrcmp
5017 0x1147eebc NONE FUNC               xmlStrdup
5018 0x1147eec8 NONE FUNC               xmlStrlen
5019 0x1147eed4 NONE FUNC               xmlStrsub
5020 0x1147eee0 NONE FUNC               xmlUnlinkNode
5021 0x1147eeec NONE FUNC               xmlXPathEval
5022 0x1147eef8 NONE FUNC               xmlXPathFreeContext
5023 0x1147ef04 NONE FUNC               xmlXPathFreeObject
5024 0x1147ef10 NONE FUNC               xmlXPathNewContext
5025 0x1147ef1c NONE FUNC               xmlXPathRegisterNs
5026 0x1147ef28 NONE FUNC               zlibCompileFlags
5027 0x1147ef34 NONE FUNC               zlibVersion
5028 0x00000000 NONE FUNC               dyld_stub_binder

结果分析

对比1：内容很像是nm输出的结果

rabin2 -i

5024 0x1147ef10 NONE FUNC               xmlXPathNewContext
5025 0x1147ef1c NONE FUNC               xmlXPathRegisterNs
5026 0x1147ef28 NONE FUNC               zlibCompileFlags
5027 0x1147ef34 NONE FUNC               zlibVersion
5028 0x00000000 NONE FUNC               dyld_stub_binder

nm

U _xmlXPathNewContext
U _xmlXPathRegisterNs
U _zlibCompileFlags
U _zlibVersion
U dyld_stub_binder

对比2：rabin2比nm的更加易懂

rabin2 -i

0    0x11476a38 NONE FUNC               sym.imp.Foundation.NSNotFound.getter : Swift.Int
1    0x11476a44 NONE FUNC               sym.imp.static Foundation.CharacterSet.whitespacesAndNewlines.getter : Foundation.CharacterSet
2    0x11476a50 NONE FUNC               sym.imp.type metadata accessor for Foundation.CharacterSet
3    0x11476a5c NONE FUNC               sym.imp.static Foundation.Notification._unconditionallyBridgeFromObjectiveC(Swift.Optional<__C.NSNotification>) -> Foundation.Notification
4    0x11476a68 NONE FUNC               sym.imp.Foundation.Notification.object.getter : Swift.Optional<Any>
5    0x11476a74 NONE FUNC               sym.imp.Foundation.Notification.userInfo.getter : Swift.Optional<Swift.Dictionary<Swift.AnyHashable, Any>>
6    0x11476a80 NONE FUNC               sym.imp.type metadata accessor for Foundation.Notification
7    0x11476a8c NONE FUNC               sym.imp.Foundation._convertErrorToNSError(Swift.Error) -> __C.NSError
8    0x11476a98 NONE FUNC               sym.imp.Foundation._convertNSErrorToError(Swift.Optional<__C.NSError>) -> Swift.Error
9    0x11476aa4 NONE FUNC               sym.imp.type metadata accessor for Foundation.NSFastEnumerationIterator

nm

U _$s10Foundation10NSNotFoundSivg
U _$s10Foundation12CharacterSetV22whitespacesAndNewlinesACvgZ
U _$s10Foundation12CharacterSetVMa
U _$s10Foundation12NotificationV36_unconditionallyBridgeFromObjectiveCyACSo14NSNotificationCSgFZ
U _$s10Foundation12NotificationV6objectypSgvg
U _$s10Foundation12NotificationV8userInfoSDys11AnyHashableVypGSgvg
U _$s10Foundation12NotificationVMa
U _$s10Foundation22_convertErrorToNSErrorySo0E0Cs0C0_pF
U _$s10Foundation22_convertNSErrorToErrorys0E0_pSo0C0CSgF
U _$s10Foundation25NSFastEnumerationIteratorVMa

-E: Exports

➜  AwemeCore rabin2 -E ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore > AwemeCore_rabin2_E.txt

[Exports]

nth  paddr       vaddr      bind   type size lib name
―――――――――――――――――――――――――――――――――――――――――――――――――――――
2840  0x00b8e0b8 0x00b8e0b8 GLOBAL FUNC 0        _OBJC_METACLASS_$_AWEFriendsActivityWidgetConfigurationIntentResponse
2841  0x00b8e0e0 0x00b8e0e0 GLOBAL FUNC 0        _OBJC_METACLASS_$_AWEFriendsActivityWidgetLandingPageResolutionResult
2842  0x00b8e130 0x00b8e130 GLOBAL FUNC 0        _OBJC_METACLASS_$_AWEFriendsWidgetsColorSchemeResolutionResult
2843  0x00b8e068 0x00b8e068 GLOBAL FUNC 0        _OBJC_CLASS_$_AWEFriendsActivityWidgetConfigurationIntent
2844  0x00b8e090 0x00b8e090 GLOBAL FUNC 0        _OBJC_CLASS_$_AWEFriendsActivityWidgetConfigurationIntentResponse
2845  0x00b8e108 0x00b8e108 GLOBAL FUNC 0        _OBJC_CLASS_$_AWEFriendsActivityWidgetLandingPageResolutionResult
2846  0x00b8e158 0x00b8e158 GLOBAL FUNC 0        _OBJC_CLASS_$_AWEFriendsWidgetsColorSchemeResolutionResult
2847  0x0c46ffcc 0x10e0ffcc GLOBAL FUNC 0        _awemeMain

-s: Symbols

➜  AwemeCore rabin2 -s ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore > AwemeCore_rabin2_s.txt

[Symbols]

nth     paddr       vaddr      bind   type size lib name
――――――――――――――――――――――――――――――――――――――――――――――――――――――――
0        0x05614542 0x05614542 LOCAL  FUNC 0        radr://5614542
1        0x0cad6a38 0x11476a38 LOCAL  FUNC 0        Foundation.NSNotFound.getter : Swift.Int
2        0x0cad6a44 0x11476a44 LOCAL  FUNC 0        static Foundation.CharacterSet.whitespacesAndNewlines.getter : Foundation.CharacterSet
3        0x0cad6a50 0x11476a50 LOCAL  FUNC 0        type metadata accessor for Foundation.CharacterSet
...
2836     0x0cadef1c 0x1147ef1c LOCAL  FUNC 0        imp.xmlXPathRegisterNs
2837     0x0cadef28 0x1147ef28 LOCAL  FUNC 0        imp.zlibCompileFlags
2838     0x0cadef34 0x1147ef34 LOCAL  FUNC 0        imp.zlibVersion
2839     0x00b8e040 0x00b8e040 GLOBAL FUNC 0        imp._OBJC_METACLASS_$_AWEFriendsActivityWidgetConfigurationIntent
2840     0x00b8e0b8 0x00b8e0b8 GLOBAL FUNC 0        _OBJC_METACLASS_$_AWEFriendsActivityWidgetConfigurationIntentResponse
2841     0x00b8e0e0 0x00b8e0e0 GLOBAL FUNC 0        _OBJC_METACLASS_$_AWEFriendsActivityWidgetLandingPageResolutionResult
2842     0x00b8e130 0x00b8e130 GLOBAL FUNC 0        _OBJC_METACLASS_$_AWEFriendsWidgetsColorSchemeResolutionResult
2843     0x00b8e068 0x00b8e068 GLOBAL FUNC 0        _OBJC_CLASS_$_AWEFriendsActivityWidgetConfigurationIntent
2844     0x00b8e090 0x00b8e090 GLOBAL FUNC 0        _OBJC_CLASS_$_AWEFriendsActivityWidgetConfigurationIntentResponse
2845     0x00b8e108 0x00b8e108 GLOBAL FUNC 0        _OBJC_CLASS_$_AWEFriendsActivityWidgetLandingPageResolutionResult
2846     0x00b8e158 0x00b8e158 GLOBAL FUNC 0        _OBJC_CLASS_$_AWEFriendsWidgetsColorSchemeResolutionResult
2847     0x0c46ffcc 0x10e0ffcc GLOBAL FUNC 0        _awemeMain
2848     0x05924000 0x05924000 LOCAL  FUNC 0        func.05924000
2849     0x05924290 0x05924290 LOCAL  FUNC 0        func.05924290
...
1873257  0x11476844 0x11476844 LOCAL  FUNC 0        func.11476844
1873258  0x11476888 0x11476888 LOCAL  FUNC 0        func.11476888
1873259  0x114768cc 0x114768cc LOCAL  FUNC 0        func.114768cc
1873260  0x11476910 0x11476910 LOCAL  FUNC 0        func.11476910
1873261  0x11476948 0x11476948 LOCAL  FUNC 0        func.11476948
1873262  0x11476970 0x11476970 LOCAL  FUNC 0        func.11476970

-sr

➜  AwemeCore rabin2 -sr ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore > AwemeCore_rabin2_sr.txt

fs symbols
"f sym.radr:__5614542 0 0x05614542"
fs imports
"f sym.Foundation.NSNotFound.getter_:_Swift.Int 0 0x11476a38"
"f sym.static_Foundation.CharacterSet.whitespacesAndNewlines.getter_:_Foundation.CharacterSet 0 0x11476a44"
"f sym.type_metadata_accessor_for_Foundation.CharacterSet 0 0x11476a50"
"f sym.static_Foundation.Notification._unconditionallyBridgeFromObjectiveC_Swift.Optional___C.NSNotification______Foundation.Notific 0 0x11476a5c"
"f sym.Foundation.Notification.object.getter_:_Swift.Optional_Any 0 0x11476a68"
"f sym.Foundation.Notification.userInfo.getter_:_Swift.Optional_Swift.Dictionary_Swift.AnyHashable__Any 0 0x11476a74"
"f sym.type_metadata_accessor_for_Foundation.Notification 0 0x11476a80"
"f sym.Foundation._convertErrorToNSError_Swift.Error_______C.NSError 0 0x11476a8c"
"f sym.Foundation._convertNSErrorToError_Swift.Optional___C.NSError______Swift.Error 0 0x11476a98"
...
"f sym.func.11476888 0 0x11476888"
"f sym.func.114768cc 0 0x114768cc"
"f sym.func.11476910 0 0x11476910"
"f sym.func.11476948 0 0x11476948"
"f sym.func.11476970 0 0x11476970"

-l: Libraries

➜  AwemeCore rabin2 -l ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore > AwemeCore_rabin2_l.txt

[Linked libraries]
/usr/lib/libcompression.dylib
@rpath/BDLRepairer.framework/BDLRepairer
/usr/lib/libc++.1.dylib
/System/Library/Frameworks/AdServices.framework/AdServices
/System/Library/Frameworks/AppTrackingTransparency.framework/AppTrackingTransparency
/System/Library/Frameworks/AuthenticationServices.framework/AuthenticationServices
/System/Library/Frameworks/CoreHaptics.framework/CoreHaptics
/System/Library/Frameworks/CoreTelephony.framework/CoreTelephony
/System/Library/Frameworks/MetalKit.framework/MetalKit
/System/Library/Frameworks/MetalPerformanceShaders.framework/MetalPerformanceShaders
/System/Library/Frameworks/MetricKit.framework/MetricKit
/System/Library/Frameworks/StoreKit.framework/StoreKit
@rpath/VolcEngineRTC.framework/VolcEngineRTC
@rpath/byteaudio.framework/byteaudio
/usr/lib/libbz2.1.0.dylib
/usr/lib/libc++abi.dylib
/usr/lib/libiconv.2.dylib
/usr/lib/libicucore.A.dylib
/usr/lib/liblzma.5.dylib
/usr/lib/libSystem.B.dylib
/usr/lib/libresolv.9.dylib
/usr/lib/libsqlite3.dylib
/usr/lib/libxml2.2.dylib
/usr/lib/libz.1.dylib
/System/Library/Frameworks/ARKit.framework/ARKit
/System/Library/Frameworks/AVFoundation.framework/AVFoundation
/System/Library/Frameworks/AVKit.framework/AVKit
/System/Library/Frameworks/Accelerate.framework/Accelerate
/System/Library/Frameworks/AdSupport.framework/AdSupport
/System/Library/Frameworks/AddressBook.framework/AddressBook
/System/Library/Frameworks/AssetsLibrary.framework/AssetsLibrary
/System/Library/Frameworks/AudioToolbox.framework/AudioToolbox
/System/Library/Frameworks/CFNetwork.framework/CFNetwork
/System/Library/Frameworks/Contacts.framework/Contacts
/System/Library/Frameworks/ContactsUI.framework/ContactsUI
/System/Library/Frameworks/CoreAudio.framework/CoreAudio
/System/Library/Frameworks/CoreAudioKit.framework/CoreAudioKit
/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation
/System/Library/Frameworks/CoreGraphics.framework/CoreGraphics
/System/Library/Frameworks/CoreImage.framework/CoreImage
/System/Library/Frameworks/CoreLocation.framework/CoreLocation
/System/Library/Frameworks/CoreML.framework/CoreML
/System/Library/Frameworks/CoreMedia.framework/CoreMedia
/System/Library/Frameworks/CoreMotion.framework/CoreMotion
/System/Library/Frameworks/MobileCoreServices.framework/MobileCoreServices
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlight
/System/Library/Frameworks/CoreText.framework/CoreText
/System/Library/Frameworks/CoreVideo.framework/CoreVideo
/System/Library/Frameworks/EventKit.framework/EventKit
/System/Library/Frameworks/Foundation.framework/Foundation
/System/Library/Frameworks/GLKit.framework/GLKit
/System/Library/Frameworks/GameplayKit.framework/GameplayKit
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
/System/Library/Frameworks/ImageIO.framework/ImageIO
/System/Library/Frameworks/Intents.framework/Intents
/System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore
/System/Library/Frameworks/LocalAuthentication.framework/LocalAuthentication
/System/Library/Frameworks/MapKit.framework/MapKit
/System/Library/Frameworks/MediaAccessibility.framework/MediaAccessibility
/System/Library/Frameworks/MediaPlayer.framework/MediaPlayer
/System/Library/Frameworks/MediaToolbox.framework/MediaToolbox
/System/Library/Frameworks/MessageUI.framework/MessageUI
/System/Library/Frameworks/Metal.framework/Metal
/System/Library/Frameworks/NetworkExtension.framework/NetworkExtension
/System/Library/Frameworks/OpenAL.framework/OpenAL
/System/Library/Frameworks/OpenGLES.framework/OpenGLES
/System/Library/Frameworks/Photos.framework/Photos
/System/Library/Frameworks/PhotosUI.framework/PhotosUI
/System/Library/Frameworks/QuartzCore.framework/QuartzCore
/System/Library/Frameworks/ReplayKit.framework/ReplayKit
/System/Library/Frameworks/SafariServices.framework/SafariServices
/System/Library/Frameworks/Security.framework/Security
/System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration
/System/Library/Frameworks/UIKit.framework/UIKit
/System/Library/Frameworks/VideoToolbox.framework/VideoToolbox
/System/Library/Frameworks/WebKit.framework/WebKit
/System/Library/Frameworks/iAd.framework/iAd
/System/Library/Frameworks/QuickLook.framework/QuickLook
/usr/lib/libobjc.A.dylib
/System/Library/Frameworks/Combine.framework/Combine
/System/Library/Frameworks/GroupActivities.framework/GroupActivities
/System/Library/Frameworks/IOSurface.framework/IOSurface
/System/Library/Frameworks/UserNotifications.framework/UserNotifications
/System/Library/Frameworks/WidgetKit.framework/WidgetKit
/usr/lib/swift/libswiftCoreMIDI.dylib
/usr/lib/swift/libswiftDataDetection.dylib
/usr/lib/swift/libswiftFileProvider.dylib
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib
/usr/lib/swift/libswiftWebKit.dylib
/usr/lib/swift/libswift_Concurrency.dylib
@rpath/libswiftAVFoundation.dylib
@rpath/libswiftCore.dylib
@rpath/libswiftCoreAudio.dylib
@rpath/libswiftCoreData.dylib
@rpath/libswiftCoreFoundation.dylib
@rpath/libswiftCoreGraphics.dylib
@rpath/libswiftCoreImage.dylib
@rpath/libswiftCoreLocation.dylib
@rpath/libswiftCoreMedia.dylib
@rpath/libswiftDarwin.dylib
@rpath/libswiftDispatch.dylib
@rpath/libswiftFoundation.dylib
@rpath/libswiftIntents.dylib
@rpath/libswiftMapKit.dylib
@rpath/libswiftMetal.dylib
@rpath/libswiftNetwork.dylib
@rpath/libswiftObjectiveC.dylib
@rpath/libswiftPhotos.dylib
@rpath/libswiftQuartzCore.dylib
@rpath/libswiftUIKit.dylib
@rpath/libswiftos.dylib
@rpath/libswiftsimd.dylib

112 libraries

-z: Strings

-z参数含义

The -z option is used to list readable strings found in the .rodata section of ELF binaries, or the .text section of PE files.

➜  AwemeCore rabin2 -z ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore > AwemeCore_rabin2_z.txt

[Strings]
nth    paddr      vaddr      len  size section                      type    string
――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――
0      0x00013e7f 0x00013e7f 5    6    1.__TEXT.__const             ascii   7\rW?<
1      0x00013e89 0x00013e89 4    5    1.__TEXT.__const             ascii   \a)FA
2      0x00013eb0 0x00013eb0 19   20   1.__TEXT.__const             ascii   AWECommentSwiftImpl
3      0x00013ed0 0x00013ed0 24   25   1.__TEXT.__const             ascii   ActionViewLayoutDelegate
4      0x00013f20 0x00013f20 10   11   1.__TEXT.__const             ascii   ActionView
5      0x00013f48 0x00013f48 4    20   1.__TEXT.__const             utf32le D:\v\n
6      0x000140f0 0x000140f0 19   20   1.__TEXT.__const             ascii   AWECommentColorMode
7      0x00014124 0x00014124 13   14   1.__TEXT.__const             ascii   AWECommentTab
8      0x00014160 0x00014160 24   25   1.__TEXT.__const             ascii   AWEModernFeedEventSource
9      0x000141a0 0x000141a0 24   25   1.__TEXT.__const             ascii   AWEAwemeModelCommentType
10     0x000141e0 0x000141e0 21   22   1.__TEXT.__const             ascii   AWEUserFollowerStatus
11     0x00014220 0x00014220 19   20   1.__TEXT.__const             ascii   AWEUserFollowStatus
12     0x00014260 0x00014260 23   24   1.__TEXT.__const             ascii   AWECommentCellSceneType
13     0x000142a0 0x000142a0 20   21   1.__TEXT.__const             ascii   AWECommentReplyStyle
14     0x000142e0 0x000142e0 19   20   1.__TEXT.__const             ascii   AWECommentPostState
15     0x00014320 0x00014320 17   18   1.__TEXT.__const             ascii   AWECommentTagType
16     0x00014354 0x00014354 11   12   1.__TEXT.__const             ascii   ActionStyle
17     0x0001437c 0x0001437c 10   11   1.__TEXT.__const             ascii   ActionType
18     0x000143b0 0x000143b0 27   28   1.__TEXT.__const             ascii   AWECommentBaseListViewModel
19     0x00014430 0x00014430 4    5    1.__TEXT.__const             ascii   Weak
20     0x000144e2 0x000144e2 11   12   1.__TEXT.__const             ascii   stIndexPath
21     0x00014510 0x00014510 19   20   1.__TEXT.__const             ascii   AWECommentSwiftImpl
22     0x00014530 0x00014530 8    9    1.__TEXT.__const             ascii   BaseCell
23     0x00014560 0x00014560 4    20   1.__TEXT.__const             utf32le A\nKÎ blocks=Basic Latin,Latin-1 Supplement
24     0x00014be0 0x00014be0 24   25   1.__TEXT.__const             ascii   BaseListSectionViewModel
25     0x00014c70 0x00014c70 11   12   1.__TEXT.__const             ascii   CommentCell
26     0x00014c80 0x00014c80 19   20   1.__TEXT.__const             ascii   AWECommentSwiftImpl
27     0x00014cc0 0x00014cc0 5    24   1.__TEXT.__const             utf32le 2\fęĥ& blocks=Basic Latin,Latin Extended-A
28     0x00014e20 0x00014e20 35   36   1.__TEXT.__const             ascii   CommentContainerInnerViewController
29     0x00015030 0x00015030 31   32   1.__TEXT.__const             ascii   CommentContainerInnerViewHolder
30     0x000150d0 0x000150d0 24   25   1.__TEXT.__const             ascii   CommentContainerProtocol
31     0x00015120 0x00015120 19   20   1.__TEXT.__const             ascii   AWECommentSwiftImpl
32     0x00015140 0x00015140 30   31   1.__TEXT.__const             ascii   CommentContainerViewController
33     0x00015184 0x00015184 4    20   1.__TEXT.__const             utf32le 2\n<¡ blocks=Basic Latin,Latin-1 Supplement
34     0x000156a0 0x000156a0 25   26   1.__TEXT.__const             ascii   CommentContainerViewModel
...
39595  0x00f17294 0x00f17294 23   24   89.__DATA.__objc_classname   ascii   AWEVideoMergeTransParam
39596  0x00f172ac 0x00f172ac 35   36   89.__DATA.__objc_classname   ascii   AWEVideoNewPublishCircleTagItemCell
39597  0x00f172d0 0x00f172d0 38   39   89.__DATA.__objc_classname   ascii   AWEVideoNewPublishTagRecommendItemCell
39598  0x00f172f7 0x00f172f7 43   44   89.__DATA.__objc_classname   ascii   AWEVideoNewPublishTagRecommendTableViewCell
39599  0x00f17323 0x00f17323 12   13   89.__DATA.__objc_classname   ascii   LVAudioFrame
39600  0x00f17330 0x00f17330 11   12   89.__DATA.__objc_classname   ascii   Performance
39601  0x00f1733c 0x00f1733c 12   13   89.__DATA.__objc_classname   ascii   VoiceChanger
39602  0x00f17349 0x00f17349 32   33   89.__DATA.__objc_classname   ascii   AWEVideoNewPublishViewController
...
119537 0x0d7521ea 0x120f21ea 4    5    111.__LTC_DATA._C_cstring    ascii   \t\bC!
119538 0x0d752209 0x120f2209 7    9    111.__LTC_DATA._C_cstring    utf8    ٺITjpS4 blocks=Arabic,Basic Latin
119539 0x0d752246 0x120f2246 7    9    111.__LTC_DATA._C_cstring    utf8    ǌ~O{P\fc blocks=Latin Extended-B,Basic Latin
119540 0x0d752252 0x120f2252 5    7    111.__LTC_DATA._C_cstring    utf8    ЀFyr' blocks=Cyrillic,Basic Latin
119541 0x0d75226f 0x120f226f 5    6    111.__LTC_DATA._C_cstring    ascii   RS\rcJ
119542 0x0d752292 0x120f2292 4    5    111.__LTC_DATA._C_cstring    ascii   o3PR
119543 0x0d7522da 0x120f22da 4    4    111.__LTC_DATA._C_cstring    ascii   bvx$

-zr

➜  AwemeCore rabin2 -zr ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore > AwemeCore_rabin2_zr.txt

fs strings
f str.7__W 6 0x00013e7f
Cs 6 @ 0x00013e7f
f str.FA 5 0x00013e89
Cs 5 @ 0x00013e89
f str.AWECommentSwiftImpl 20 0x00013eb0
Cs 20 @ 0x00013eb0
f str.ActionViewLayoutDelegate 25 0x00013ed0
Cs 25 @ 0x00013ed0
f str.ActionView 11 0x00013f20
Cs 11 @ 0x00013f20
f str.D: 20 0x00013f48
Cs 20 @ 0x00013f48
f str.AWECommentColorMode 20 0x000140f0
Cs 20 @ 0x000140f0
f str.AWECommentTab 14 0x00014124
Cs 14 @ 0x00014124
f str.AWEModernFeedEventSource 25 0x00014160
Cs 25 @ 0x00014160
f str.AWEAwemeModelCommentType 25 0x000141a0
Cs 25 @ 0x000141a0
f str.AWEUserFollowerStatus 22 0x000141e0
Cs 22 @ 0x000141e0
f str.AWEUserFollowStatus 20 0x00014220
Cs 20 @ 0x00014220
f str.AWECommentCellSceneType 24 0x00014260
...
f str.ITjpS4 9 0x120f2209
Cs 9 @ 0x120f2209
f str.O_P__c 9 0x120f2246
Cs 9 @ 0x120f2246
f str.Fyr 7 0x120f2252
Cs 7 @ 0x120f2252
f str.RS__cJ 6 0x120f226f
Cs 6 @ 0x120f226f
f str.o3PR 5 0x120f2292
Cs 5 @ 0x120f2292
f str.bvx 4 0x120f22da
Cs 4 @ 0x120f22da

-S: Program Sections

➜  AwemeCore rabin2 -S ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore > AwemeCore_rabin2_S_section.txt

[Sections]

nth paddr            size vaddr           vsize perm name
―――――――――――――――――――――――――――――――――――――――――――――――――――――――――
0   0x0000b9b0     0x84c0 0x0000b9b0     0x84c0 -r-x 0.__TEXT.__stub_helper
1   0x00013e70     0x4020 0x00013e70     0x4020 -r-x 1.__TEXT.__const
2   0x00017e90     0x2ef8 0x00017e90     0x2ef8 -r-x 2.__TEXT.__swift5_typeref
3   0x0001ad88     0x2988 0x0001ad88     0x2988 -r-x 3.__TEXT.__swift5_fieldmd
4   0x0001d710      0x338 0x0001d710      0x338 -r-x 4.__TEXT.__swift5_proto
5   0x0001da48      0x28c 0x0001da48      0x28c -r-x 5.__TEXT.__swift5_types
6   0x0001dcd4        0x0 0x0001dcd4        0x0 -r-x 6.__TEXT.__cstring
7   0x0001dcd4        0x0 0x0001dcd4        0x0 -r-x 7.__TEXT.__objc_methname
8   0x0001dcd4        0x0 0x0001dcd4        0x0 -r-x 8.__TEXT.__objc_classname
9   0x0001dcd4        0x0 0x0001dcd4        0x0 -r-x 9.__TEXT.__objc_methtype
10  0x0001dcd4       0x68 0x0001dcd4       0x68 -r-x 10.__TEXT.__gcc_except_tab
11  0x0001dd40     0x362c 0x0001dd40     0x362c -r-x 11.__TEXT.__swift5_reflstr
12  0x0002136c      0x1b8 0x0002136c      0x1b8 -r-x 12.__TEXT.__swift5_builtin
13  0x00021524      0x2b8 0x00021524      0x2b8 -r-x 13.__TEXT.__swift5_assocty
14  0x000217dc     0x1c0c 0x000217dc     0x1c0c -r-x 14.__TEXT.__swift5_capture
15  0x000233e8       0x60 0x000233e8       0x60 -r-x 15.__TEXT.__swift5_protos
16  0x00023448        0x0 0x00023448        0x0 -r-x 16.__TEXT.__ustring
17  0x00023448        0x0 0x00023448        0x0 -r-x 17.__TEXT.__text
18  0x00023448   0x2a4b70 0x00023448   0x2a4b70 -r-x 18.__TEXT.__unwind_info
19  0x002c7fb8    0x38040 0x002c7fb8    0x38040 -r-x 19.__TEXT.__eh_frame
20  0x00300000       0x1b 0x00300000       0x1b -r-x 20.__TEXT.__oslogstring
21  0x00304000     0x3120 0x00304000     0x3120 -rw- 21.__DATA.__got
22  0x00307120     0x58b0 0x00307120     0x58b0 -rw- 22.__DATA.__la_symbol_ptr
23  0x0030c9d0     0x3d28 0x0030c9d0     0x3d28 -rw- 23.__DATA.__mod_init_func
24  0x00310700    0x11068 0x00310700    0x11068 -rw- 24.__DATA.__const
25  0x00321768      0xa60 0x00321768      0xa60 -rw- 25.__DATA.__cfstring
26  0x003221c8    0x47a08 0x003221c8    0x47a08 -rw- 26.__DATA.__objc_classlist
27  0x00369bd0      0x678 0x00369bd0      0x678 -rw- 27.__DATA.__objc_nlclslist
28  0x0036a248     0x37f0 0x0036a248     0x37f0 -rw- 28.__DATA.__objc_catlist
29  0x0036da38      0x120 0x0036da38      0x120 -rw- 29.__DATA.__objc_nlcatlist
30  0x0036db58    0x11af8 0x0036db58    0x11af8 -rw- 30.__DATA.__objc_protolist
31  0x0037f650        0x8 0x0037f650        0x8 -rw- 31.__DATA.__objc_imageinfo
32  0x0037f658   0x5c2148 0x0037f658   0x5c2148 -rw- 32.__DATA.__objc_const
33  0x009417a0        0x8 0x009417a0        0x8 -rw- 33.__DATA.__objc_selrefs
34  0x009417a8     0x6700 0x009417a8     0x6700 -rw- 34.__DATA.__objc_protorefs
35  0x00947ea8    0x40350 0x00947ea8    0x40350 -rw- 35.__DATA.__objc_classrefs
36  0x009881f8    0x23548 0x009881f8    0x23548 -rw- 36.__DATA.__objc_superrefs
37  0x009ab740     0x1388 0x009ab740     0x1388 -rw- 37.__DATA.__objc_ivar
38  0x009acac8   0x3a9058 0x009acac8   0x3a9058 -rw- 38.__DATA.__objc_data
39  0x00d55b20     0x4f10 0x00d55b20     0x4f10 -rw- 39.__DATA.__data
40  0x00d5aa30       0xf8 0x00d5aa30       0xf8 -rw- 40.__DATA.__HTSLifeCycle
41  0x00d5ab28       0x18 0x00d5ab28       0x18 -rw- 41.__DATA.__objc_stublist
42  0x00d5ab40       0x18 0x00d5ab40       0x18 -rw- 42.__DATA.RewardedADJSB
43  0x00d5ab58      0x1c8 0x00d5ab58      0x1c8 -rw- 43.__DATA.HGTimorLaunch
44  0x00d5ad20       0x68 0x00d5ad20       0x68 -rw- 44.__DATA.HGTimorLoad
45  0x00d5ad88      0x2f8 0x00d5ad88      0x2f8 -rw- 45.__DATA.TimorLaunch
46  0x00d5b080       0xc0 0x00d5b080       0xc0 -rw- 46.__DATA.TimorLoad
47  0x00d5b140       0xf0 0x00d5b140       0xf0 -rw- 47.__DATA.RSDHCampaign
48  0x00d5b230      0x280 0x00d5b230      0x280 -rw- 48.__DATA.XBMExternal
49  0x00d5b4b0       0xc0 0x00d5b4b0       0xc0 -rw- 49.__DATA.LazyRegHeader
50  0x00d5b570       0x10 0x00d5b570       0x10 -rw- 50.__DATA.AWELynxBridge
51  0x00d5b580       0x30 0x00d5b580       0x30 -rw- 51.__DATA.PremainCode
52  0x00d5b5b0     0x4f60 0x00d5b5b0     0x4f60 -rw- 52.__DATA.LazyRegData
53  0x00d60510      0xe80 0x00d60510      0xe80 -rw- 53.__DATA.__GAIA__SECTION
54  0x00d61390      0x120 0x00d61390      0x120 -rw- 54.__DATA.XBMDefault
55  0x00d614b0       0xc8 0x00d614b0       0xc8 -rw- 55.__DATA.HMDModule
56  0x00d61578       0x18 0x00d61578       0x18 -rw- 56.__DATA.HMDLocalModule
57  0x00d61590      0x180 0x00d61590      0x180 -rw- 57.__DATA.IESLiveBridge
58  0x00d61710      0xa28 0x00d61710      0xa28 -rw- 58.__DATA.__bd_timsdk
59  0x00d62138       0xf0 0x00d62138       0xf0 -rw- 59.__DATA.IESLiveTemplate
60  0x00d62228       0xe0 0x00d62228       0xe0 -rw- 60.__DATA.__LIVESEI
61  0x00d62308      0x360 0x00d62308      0x360 -rw- 61.__DATA.__LIVESCHEMA
62  0x00d62668       0x60 0x00d62668       0x60 -rw- 62.__DATA.__LSCHEMEMODEL
63  0x00d626c8       0x10 0x00d626c8       0x10 -rw- 63.__DATA.__ENTERROOMSEC
64  0x00d626d8       0xd0 0x00d626d8       0xd0 -rw- 64.__DATA.__VSUSERCARD
65  0x00d627a8       0x50 0x00d627a8       0x50 -rw- 65.__DATA.__PUZZLEMETHOD
66  0x00d627f8       0x10 0x00d627f8       0x10 -rw- 66.__DATA.IESSLynxBridge
67  0x00d62808       0x50 0x00d62808       0x50 -rw- 67.__DATA.RxAnnotation
68  0x00d62858     0x4850 0x00d62858     0x4850 -rw- 68.__DATA.__objc_clsrefs
69  0x00d670a8      0x6c0 0x00d670a8      0x6c0 -rw- 69.__DATA.__thread_vars
70  0x00d67768      0x2c0 0x00d67768      0x2c0 -rw- 70.__DATA.IESECSettingReg
71  0x00d67a28       0xb8 0x00d67a28       0xb8 -rw- 71.__DATA.__swift_hooks
72  0x00d67ae0       0xb8 0x00d67ae0       0xb8 -rw- 72.__DATA.__swift51_hooks
73  0x00d67b98      0x670 0x00d67b98      0x670 -rw- 73.__DATA.__HTSService
74  0x00d68208       0xf0 0x00d68208       0xf0 -rw- 74.__DATA.__HTSDyServImpl
75  0x00d682f8      0x620 0x00d682f8      0x620 -rw- 75.__DATA.__HTSMsgAsc
76  0x00d68918      0x450 0x00d68918      0x450 -rw- 76.__DATA.AWERunModernFeed
77  0x00d68d68      0x230 0x00d68d68      0x230 -rw- 77.__DATA.AWERunShare
78  0x00d68f98       0x90 0x00d68f98       0x90 -rw- 78.__DATA.__HTSDyServ
79  0x00d69028       0x80 0x00d69028       0x80 -rw- 79.__DATA.__HTSMsg
80  0x00d690a8     0xc058 0x00d690a8     0xc058 -rw- 80.__DATA.RxInjector
81  0x00d75100      0x118 0x00d75100      0x118 -rw- 81.__DATA.RxAppService
82  0x00d75218       0x30 0x00d75218       0x30 -rw- 82.__DATA.__HTSNoti
83  0x00d75248       0x80 0x00d75248       0x80 -rw- 83.__DATA.AWERunShareSVC
84  0x00d752c8     0x19a0 0x00d752c8     0x19a0 -rw- 84.__DATA.StudioConfigMock
85  0x00d76c68       0xc0 0x00d76c68       0xc0 -rw- 85.__DATA.XBMInternal
86  0x00d76d30     0xd537 0x00d76d30     0xd537 -rw- 86.__DATA.__cstring
87  0x00d84267    0x6f09b 0x00d84267    0x6f09b -rw- 87.__DATA.__objc_methname
88  0x00df3302    0x1dd08 0x00df3302    0x1dd08 -rw- 88.__DATA.__objc_methtype
89  0x00e1100a   0x13affc 0x00e1100a   0x13affc -rw- 89.__DATA.__objc_classname
90  0x00f4c008    0x34840 0x00f4c008    0x34840 -rw- 90.__DATA.__thread_bss
91  0x00000000        0x0 0x00f80860   0x2d6fe0 -rw- 91.__DATA._D_tconst
92  0x00000000        0x0 0x01257840   0x3c3558 -rw- 92.__DATA._D_dconst
93  0x00000000        0x0 0x0161c000   0x1225fc -rw- 93.__DATA._D_ddata
94  0x00000000        0x0 0x0173e600   0x499b00 -rw- 94.__DATA._D_cfstring
95  0x00000000        0x0 0x01bd8100  0x1c10870 -rw- 95.__DATA._D_objc_const
96  0x00000000        0x0 0x037e8970    0xaaee4 -rw- 96.__DATA._D_objc_ivar
97  0x00000000        0x0 0x03893858   0x2054c8 -rw- 97.__DATA._D_objc_selrefs
98  0x00000000        0x0 0x03a98d20   0x4b5df0 -rw- 98.__DATA._D_gcc_except_ta
99  0x00000000        0x0 0x03f4eb10   0x896683 -rw- 99.__DATA._D_cstring
100 0x00000000        0x0 0x047e5194    0x7795a -rw- 100.__DATA._D_ustring
101 0x00000000        0x0 0x0485caee   0xae06ba -rw- 101.__DATA._D_objc_methname
102 0x00000000        0x0 0x0533d1a8   0x1ca962 -rw- 102.__DATA._D_objc_methtype
103 0x00000000        0x0 0x05507c00   0x17fc48 -rw- 103.__DATA.__common
104 0x00000000        0x0 0x05687900   0x29b0ec -rw- 104.__DATA.__bss
105 0x00f84000  0xbb52a38 0x05924000  0xbb52a38 -r-x 105.__BD_TEXT.__text
106 0x0cad6a38     0x8508 0x11476a38     0x8508 -r-x 106.__BD_TEXT.__stubs
107 0x0cae0000      0x208 0x11480000      0x208 -r-- 107.__LTC_DATA.__meta
108 0x0cae0208       0x10 0x11480208       0x10 -r-- 108.__LTC_DATA.__deco
109 0x0cae0218   0x6d4b3f 0x11480218   0x6d4b3f -r-- 109.__LTC_DATA._C_objc_const
110 0x0d1b4d57    0x19d88 0x11b54d57    0x19d88 -r-- 110.__LTC_DATA._C_objc_ivar
111 0x0d1ceadf   0x5837ff 0x11b6eadf   0x5837ff -r-- 111.__LTC_DATA._C_cstring
112 0x0d7522de   0x23c64f 0x120f22de   0x23c64f -r-- 112.__LTC_DATA._C_tconst
113 0x0d98e92d   0x24ca15 0x1232e92d   0x24ca15 -r-- 113.__LTC_DATA._C_gcc_except_ta
114 0x0dbdb342    0xe1298 0x1257b342    0xe1298 -r-- 114.__LTC_DATA.__fix

-Sr

➜  AwemeCore rabin2 -Sr ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore > AwemeCore_rabin2_Sr_section.txt

fs sections
"f section.0.__TEXT.__stub_helper 1 0x0000b9b0"
"f section.1.__TEXT.__const 1 0x00013e70"
"f section.2.__TEXT.__swift5_typeref 1 0x00017e90"
"f section.3.__TEXT.__swift5_fieldmd 1 0x0001ad88"
"f section.4.__TEXT.__swift5_proto 1 0x0001d710"
"f section.5.__TEXT.__swift5_types 1 0x0001da48"
"f section.6.__TEXT.__cstring 1 0x0001dcd4"
"f section.7.__TEXT.__objc_methname 1 0x0001dcd4"
"f section.8.__TEXT.__objc_classname 1 0x0001dcd4"
"f section.9.__TEXT.__objc_methtype 1 0x0001dcd4"
"f section.10.__TEXT.__gcc_except_tab 1 0x0001dcd4"
"f section.11.__TEXT.__swift5_reflstr 1 0x0001dd40"
"f section.12.__TEXT.__swift5_builtin 1 0x0002136c"
"f section.13.__TEXT.__swift5_assocty 1 0x00021524"
"f section.14.__TEXT.__swift5_capture 1 0x000217dc"
"f section.15.__TEXT.__swift5_protos 1 0x000233e8"
"f section.16.__TEXT.__ustring 1 0x00023448"
"f section.17.__TEXT.__text 1 0x00023448"
"f section.18.__TEXT.__unwind_info 1 0x00023448"
"f section.19.__TEXT.__eh_frame 1 0x002c7fb8"
"f section.20.__TEXT.__oslogstring 1 0x00300000"
"f section.21.__DATA.__got 1 0x00304000"
"f section.22.__DATA.__la_symbol_ptr 1 0x00307120"
"f section.23.__DATA.__mod_init_func 1 0x0030c9d0"
"f section.24.__DATA.__const 1 0x00310700"
"f section.25.__DATA.__cfstring 1 0x00321768"
"f section.26.__DATA.__objc_classlist 1 0x003221c8"
"f section.27.__DATA.__objc_nlclslist 1 0x00369bd0"
"f section.28.__DATA.__objc_catlist 1 0x0036a248"
"f section.29.__DATA.__objc_nlcatlist 1 0x0036da38"
"f section.30.__DATA.__objc_protolist 1 0x0036db58"
"f section.31.__DATA.__objc_imageinfo 1 0x0037f650"
"f section.32.__DATA.__objc_const 1 0x0037f658"
"f section.33.__DATA.__objc_selrefs 1 0x009417a0"
"f section.34.__DATA.__objc_protorefs 1 0x009417a8"
"f section.35.__DATA.__objc_classrefs 1 0x00947ea8"
"f section.36.__DATA.__objc_superrefs 1 0x009881f8"
"f section.37.__DATA.__objc_ivar 1 0x009ab740"
"f section.38.__DATA.__objc_data 1 0x009acac8"
"f section.39.__DATA.__data 1 0x00d55b20"
"f section.40.__DATA.__HTSLifeCycle 1 0x00d5aa30"
"f section.41.__DATA.__objc_stublist 1 0x00d5ab28"
"f section.42.__DATA.RewardedADJSB 1 0x00d5ab40"
"f section.43.__DATA.HGTimorLaunch 1 0x00d5ab58"
"f section.44.__DATA.HGTimorLoad 1 0x00d5ad20"
"f section.45.__DATA.TimorLaunch 1 0x00d5ad88"
"f section.46.__DATA.TimorLoad 1 0x00d5b080"
"f section.47.__DATA.RSDHCampaign 1 0x00d5b140"
"f section.48.__DATA.XBMExternal 1 0x00d5b230"
"f section.49.__DATA.LazyRegHeader 1 0x00d5b4b0"
"f section.50.__DATA.AWELynxBridge 1 0x00d5b570"
"f section.51.__DATA.PremainCode 1 0x00d5b580"
"f section.52.__DATA.LazyRegData 1 0x00d5b5b0"
"f section.53.__DATA.__GAIA__SECTION 1 0x00d60510"
"f section.54.__DATA.XBMDefault 1 0x00d61390"
"f section.55.__DATA.HMDModule 1 0x00d614b0"
"f section.56.__DATA.HMDLocalModule 1 0x00d61578"
"f section.57.__DATA.IESLiveBridge 1 0x00d61590"
"f section.58.__DATA.__bd_timsdk 1 0x00d61710"
"f section.59.__DATA.IESLiveTemplate 1 0x00d62138"
"f section.60.__DATA.__LIVESEI 1 0x00d62228"
"f section.61.__DATA.__LIVESCHEMA 1 0x00d62308"
"f section.62.__DATA.__LSCHEMEMODEL 1 0x00d62668"
"f section.63.__DATA.__ENTERROOMSEC 1 0x00d626c8"
"f section.64.__DATA.__VSUSERCARD 1 0x00d626d8"
"f section.65.__DATA.__PUZZLEMETHOD 1 0x00d627a8"
"f section.66.__DATA.IESSLynxBridge 1 0x00d627f8"
"f section.67.__DATA.RxAnnotation 1 0x00d62808"
"f section.68.__DATA.__objc_clsrefs 1 0x00d62858"
"f section.69.__DATA.__thread_vars 1 0x00d670a8"
"f section.70.__DATA.IESECSettingReg 1 0x00d67768"
"f section.71.__DATA.__swift_hooks 1 0x00d67a28"
"f section.72.__DATA.__swift51_hooks 1 0x00d67ae0"
"f section.73.__DATA.__HTSService 1 0x00d67b98"
"f section.74.__DATA.__HTSDyServImpl 1 0x00d68208"
"f section.75.__DATA.__HTSMsgAsc 1 0x00d682f8"
"f section.76.__DATA.AWERunModernFeed 1 0x00d68918"
"f section.77.__DATA.AWERunShare 1 0x00d68d68"
"f section.78.__DATA.__HTSDyServ 1 0x00d68f98"
"f section.79.__DATA.__HTSMsg 1 0x00d69028"
"f section.80.__DATA.RxInjector 1 0x00d690a8"
"f section.81.__DATA.RxAppService 1 0x00d75100"
"f section.82.__DATA.__HTSNoti 1 0x00d75218"
"f section.83.__DATA.AWERunShareSVC 1 0x00d75248"
"f section.84.__DATA.StudioConfigMock 1 0x00d752c8"
"f section.85.__DATA.XBMInternal 1 0x00d76c68"
"f section.86.__DATA.__cstring 1 0x00d76d30"
"f section.87.__DATA.__objc_methname 1 0x00d84267"
"f section.88.__DATA.__objc_methtype 1 0x00df3302"
"f section.89.__DATA.__objc_classname 1 0x00e1100a"
"f section.90.__DATA.__thread_bss 1 0x00f4c008"
"f section.91.__DATA._D_tconst 1 0x00f80860"
"f section.92.__DATA._D_dconst 1 0x01257840"
"f section.93.__DATA._D_ddata 1 0x0161c000"
"f section.94.__DATA._D_cfstring 1 0x0173e600"
"f section.95.__DATA._D_objc_const 1 0x01bd8100"
"f section.96.__DATA._D_objc_ivar 1 0x037e8970"
"f section.97.__DATA._D_objc_selrefs 1 0x03893858"
"f section.98.__DATA._D_gcc_except_ta 1 0x03a98d20"
"f section.99.__DATA._D_cstring 1 0x03f4eb10"
"f section.100.__DATA._D_ustring 1 0x047e5194"
"f section.101.__DATA._D_objc_methname 1 0x0485caee"
"f section.102.__DATA._D_objc_methtype 1 0x0533d1a8"
"f section.103.__DATA.__common 1 0x05507c00"
"f section.104.__DATA.__bss 1 0x05687900"
"f section.105.__BD_TEXT.__text 1 0x05924000"
"f section.106.__BD_TEXT.__stubs 1 0x11476a38"
"f section.107.__LTC_DATA.__meta 1 0x11480000"
"f section.108.__LTC_DATA.__deco 1 0x11480208"
"f section.109.__LTC_DATA._C_objc_const 1 0x11480218"
"f section.110.__LTC_DATA._C_objc_ivar 1 0x11b54d57"
"f section.111.__LTC_DATA._C_cstring 1 0x11b6eadf"
"f section.112.__LTC_DATA._C_tconst 1 0x120f22de"
"f section.113.__LTC_DATA._C_gcc_except_ta 1 0x1232e92d"
"f section.114.__LTC_DATA.__fix 1 0x1257b342"

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 23:18:59

MaskPro.dylib

rabin2用法举例：MaskPro.dylib

-I

➜  DynamicLibraries rabin2 -I MaskPro.dylib > MaskProDylib/MaskProDylib_rabin2_I_identification.txt

输出：

arch     arm
baddr    0x0
binsz    311296
bintype  mach0
bits     32
canary   true
class    MACH0
crypto   false
endian   little
havecode true
laddr    0x0
lang     objc with blocks
linenum  false
lsyms    false
machine  v7
maxopsz  4
minopsz  4
nx       false
os       ios
pcalign  4
pic      false
relocs   false
sanitiz  false
static   false
stripped true
subsys   darwin
va       true

-i

➜  DynamicLibraries rabin2 -i MaskPro.dylib > MaskProDylib/MaskProDylib_rabin2_i_imports.txt

输出：

[Imports]
nth vaddr      bind type           lib name
―――――――――――――――――――――――――――――――――――――――――――
0   0x0003b124 NONE FUNC               CC_MD5
1   0x0003b134 NONE FUNC               MGCopyAnswer
2   0x0003b144 NONE FUNC               MSHookFunction
3   0x0003b154 NONE FUNC               MSHookMessageEx
4   0x0003b164 NONE FUNC               NSClassFromString
5   0x00000000 NONE FUNC               NSFileSystemFreeSize
6   0x0003b174 NONE FUNC               NSHomeDirectory
7   0x00000000 NONE OBJC_CLASS         ASIdentifierManager
8   0x00000000 NONE OBJC_CLASS         NSBundle
9   0x00000000 NONE OBJC_CLASS         NSData
10  0x00000000 NONE OBJC_CLASS         NSDate
11  0x00000000 NONE OBJC_CLASS         NSDateFormatter
12  0x00000000 NONE OBJC_CLASS         NSDictionary
13  0x00000000 NONE OBJC_CLASS         NSFileManager
14  0x00000000 NONE OBJC_CLASS         NSJSONSerialization
15  0x00000000 NONE OBJC_CLASS         NSMutableData
16  0x00000000 NONE OBJC_CLASS         NSMutableDictionary
17  0x00000000 NONE OBJC_CLASS         NSMutableString
18  0x00000000 NONE OBJC_CLASS         NSMutableURLRequest
19  0x00000000 NONE OBJC_CLASS         NSNumber
20  0x00000000 NONE OBJC_CLASS         NSObject
21  0x00000000 NONE OBJC_CLASS         NSString
22  0x00000000 NONE OBJC_CLASS         NSTimeZone
23  0x00000000 NONE OBJC_CLASS         NSURL
24  0x00000000 NONE OBJC_CLASS         NSURLConnection
25  0x00000000 NONE OBJC_CLASS         NSURLRequest
26  0x00000000 NONE OBJC_CLASS         NSURLSession
27  0x00000000 NONE OBJC_CLASS         NSURLSessionConfiguration
28  0x00000000 NONE OBJC_CLASS         UIDevice
29  0x00000000 NONE OBJC_METACLASS     NSObject
30  0x0003b184 NONE FUNC               _Block_object_assign
31  0x0003b194 NONE FUNC               _Block_object_dispose
32  0x00000000 NONE FUNC               _NSConcreteGlobalBlock
33  0x00000000 NONE FUNC               _NSConcreteStackBlock
34  0x0003b1a4 NONE FUNC               _Unwind_SjLj_Register
35  0x0003b1b4 NONE FUNC               _Unwind_SjLj_Resume
36  0x0003b1c4 NONE FUNC               _Unwind_SjLj_Unregister
37  0x00000000 NONE FUNC               __CFConstantStringClassReference
38  0x0003b1d4 NONE FUNC               __assert_rtn
39  0x00000000 NONE FUNC               __gxx_personality_sj0
40  0x00000000 NONE FUNC               __objc_personality_v0
41  0x0003b1e4 NONE FUNC               __stack_chk_fail
42  0x00000000 NONE FUNC               __stack_chk_guard
43  0x0003b1f4 NONE FUNC               _dyld_get_image_vmaddr_slide
44  0x00000000 NONE FUNC               _objc_empty_cache
45  0x0003b204 NONE FUNC               dispatch_async
46  0x0003b214 NONE FUNC               dispatch_get_global_queue
47  0x0003b224 NONE FUNC               dispatch_semaphore_create
48  0x0003b234 NONE FUNC               dispatch_semaphore_signal
49  0x0003b244 NONE FUNC               dispatch_semaphore_wait
50  0x0003b254 NONE FUNC               dispatch_time
51  0x0003b264 NONE FUNC               dlclose
52  0x0003b274 NONE FUNC               dlopen
53  0x0003b284 NONE FUNC               dlsym
54  0x0003b294 NONE FUNC               exit
55  0x0003b2a4 NONE FUNC               free
56  0x0003b2b4 NONE FUNC               getpid
57  0x0003b2c4 NONE FUNC               ioctl
58  0x0003b2d4 NONE FUNC               isatty
59  0x0003b2e4 NONE FUNC               malloc
60  0x0003b2f4 NONE FUNC               memset
61  0x0003b304 NONE FUNC               objc_autorelease
62  0x0003b314 NONE FUNC               objc_autoreleaseReturnValue
63  0x0003b324 NONE FUNC               objc_getClass
64  0x0003b334 NONE FUNC               objc_msgSend
65  0x0003b344 NONE FUNC               objc_release
66  0x0003b354 NONE FUNC               objc_retain
67  0x0003b364 NONE FUNC               objc_retainAutorelease
68  0x0003b374 NONE FUNC               objc_retainAutoreleasedReturnValue
69  0x0003b384 NONE FUNC               perror
70  0x0003b394 NONE FUNC               pthread_create
71  0x0003b3a4 NONE FUNC               sleep
72  0x0003b3b4 NONE FUNC               strstr
73  0x0003b3c4 NONE FUNC               syscall
74  0x0003b3d4 NONE FUNC               sysctl
75  0x0003b3e4 NONE FUNC               uname
76  0x00000000 NONE FUNC               dyld_stub_binder

-E

➜  DynamicLibraries rabin2 -E MaskPro.dylib > MaskProDylib/MaskProDylib_rabin2_E_exports.txt

输出：

[Exports]

nth paddr       vaddr      bind   type size lib name
――――――――――――――――――――――――――――――――――――――――――――――――――――
0    0x0004089c 0x0003c89c GLOBAL FUNC 0        _OBJC_CLASS_$_NbGzxsksqtAxgN
1    0x0004084c 0x0003c84c GLOBAL FUNC 0        _OBJC_CLASS_$_NxNXRxsbBxexSx
2    0x00040874 0x0003c874 GLOBAL FUNC 0        _OBJC_CLASS_$_daAxbxbayGwxtxdcca
3    0x000408c4 0x0003c8c4 GLOBAL FUNC 0        _OBJC_CLASS_$_xrxleWZnuCXPEx
4    0x000408ec 0x0003c8ec GLOBAL FUNC 0        _OBJC_CLASS_$_xxWxKxrETCxJpx
5    0x00040888 0x0003c888 GLOBAL FUNC 0        _OBJC_METACLASS_$_NbGzxsksqtAxgN
6    0x00040838 0x0003c838 GLOBAL FUNC 0        _OBJC_METACLASS_$_NxNXRxsbBxexSx
7    0x00040860 0x0003c860 GLOBAL FUNC 0        _OBJC_METACLASS_$_daAxbxbayGwxtxdcca
8    0x000408b0 0x0003c8b0 GLOBAL FUNC 0        _OBJC_METACLASS_$_xrxleWZnuCXPEx
9    0x000408d8 0x0003c8d8 GLOBAL FUNC 0        _OBJC_METACLASS_$_xxWxKxrETCxJpx
10   0x00043420 0x0003f420 GLOBAL FUNC 0        _g_slide
11   0x00043564 0x0003f564 GLOBAL FUNC 0        _x
12   0x00043568 0x0003f568 GLOBAL FUNC 0        _x.146
13   0x0004356c 0x0003f56c GLOBAL FUNC 0        _x.148
...
119  0x00043444 0x0003f444 GLOBAL FUNC 0        _y.380
120  0x00043448 0x0003f448 GLOBAL FUNC 0        _y.382

-l

➜  DynamicLibraries rabin2 -l MaskPro.dylib > MaskProDylib/MaskProDylib_rabin2_l_libraries.txt

输出：

[Linked libraries]
/System/Library/Frameworks/AdSupport.framework/AdSupport
/usr/lib/libMobileGestalt.dylib
/System/Library/Frameworks/UIKit.framework/UIKit
/System/Library/Frameworks/Foundation.framework/Foundation
/Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate
/usr/lib/libobjc.A.dylib
/usr/lib/libc++.1.dylib
/usr/lib/libSystem.B.dylib
/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation

9 libraries

-z

➜  DynamicLibraries rabin2 -z MaskPro.dylib > MaskProDylib/MaskProDylib_rabin2_z_strings.txt

输出：

[Strings]
nth paddr      vaddr      len size section                   type  string
―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――
0   0x0003b634 0x0003b634 13  14   3.__TEXT.__objc_methname  ascii currentDevice
1   0x0003b642 0x0003b642 4   5    3.__TEXT.__objc_methname  ascii name
2   0x0003b647 0x0003b647 13  14   3.__TEXT.__objc_methname  ascii systemVersion
3   0x0003b655 0x0003b655 10  11   3.__TEXT.__objc_methname  ascii systemName
4   0x0003b660 0x0003b660 14  15   3.__TEXT.__objc_methname  ascii xJWlxsPxxExAux
5   0x0003b66f 0x0003b66f 19  20   3.__TEXT.__objc_methname  ascii identifierForVendor
6   0x0003b683 0x0003b683 10  11   3.__TEXT.__objc_methname  ascii UUIDString
7   0x0003b68e 0x0003b68e 13  14   3.__TEXT.__objc_methname  ascii sharedManager
8   0x0003b69c 0x0003b69c 21  22   3.__TEXT.__objc_methname  ascii advertisingIdentifier
9   0x0003b6b2 0x0003b6b2 29  30   3.__TEXT.__objc_methname  ascii dictionaryWithObjectsAndKeys:
10  0x0003b6d0 0x0003b6d0 14  15   3.__TEXT.__objc_methname  ascii URLWithString:
11  0x0003b6df 0x0003b6df 39  40   3.__TEXT.__objc_methname  ascii stringWithContentsOfURL:encoding:error:
12  0x0003b707 0x0003b707 10  11   3.__TEXT.__objc_methname  ascii hasPrefix:
13  0x0003b712 0x0003b712 24  25   3.__TEXT.__objc_methname  ascii deleteCharactersInRange:
14  0x0003b72b 0x0003b72b 6   7    3.__TEXT.__objc_methname  ascii length
15  0x0003b732 0x0003b732 17  18   3.__TEXT.__objc_methname  ascii substringToIndex:
16  0x0003b744 0x0003b744 18  19   3.__TEXT.__objc_methname  ascii dataUsingEncoding:
17  0x0003b757 0x0003b757 33  34   3.__TEXT.__objc_methname  ascii JSONObjectWithData:options:error:
18  0x0003b779 0x0003b779 24  25   3.__TEXT.__objc_methname  ascii objectForKeyedSubscript:
19  0x0003b792 0x0003b792 27  28   3.__TEXT.__objc_methname  ascii stringWithCString:encoding:
20  0x0003b7ae 0x0003b7ae 16  17   3.__TEXT.__objc_methname  ascii isEqualToString:
21  0x0003b7bf 0x0003b7bf 14  15   3.__TEXT.__objc_methname  ascii eKGEGSRRxxxPxt
22  0x0003b7ce 0x0003b7ce 14  15   3.__TEXT.__objc_methname  ascii PHcNExxxUJIxxH
23  0x0003b7dd 0x0003b7dd 14  15   3.__TEXT.__objc_methname  ascii graGqxxPtxaoBY
24  0x0003b7ec 0x0003b7ec 14  15   3.__TEXT.__objc_methname  ascii xHvTCxxxxxXVxm
25  0x0003b7fb 0x0003b7fb 15  16   3.__TEXT.__objc_methname  ascii bundleWithPath:
26  0x0003b80b 0x0003b80b 4   5    3.__TEXT.__objc_methname  ascii load
27  0x0003b810 0x0003b810 18  19   3.__TEXT.__objc_methname  ascii numberWithInteger:
28  0x0003b823 0x0003b823 63  64   3.__TEXT.__objc_methname  ascii setAppWirelessDataOption:forBundleIdentifier:completionHandler:
29  0x0003b863 0x0003b863 14  15   3.__TEXT.__objc_methname  ascii numberWithInt:
30  0x0003b872 0x0003b872 64  65   3.__TEXT.__objc_methname  ascii setAppCellularDataEnabled:forBundleIdentifier:completionHandler:
31  0x0003b8b3 0x0003b8b3 14  15   3.__TEXT.__objc_methname  ascii sharedInstance
32  0x0003b8c2 0x0003b8c2 40  41   3.__TEXT.__objc_methname  ascii setUsagePoliciesForBundle:cellular:wifi:
33  0x0003b8eb 0x0003b8eb 40  41   3.__TEXT.__objc_methname  ascii resolveNetworkProblmeForAppWithBundleId:
34  0x0003b914 0x0003b914 4   5    3.__TEXT.__objc_methname  ascii date
35  0x0003b919 0x0003b919 5   6    3.__TEXT.__objc_methname  ascii alloc
36  0x0003b91f 0x0003b91f 4   5    3.__TEXT.__objc_methname  ascii init
37  0x0003b924 0x0003b924 17  18   3.__TEXT.__objc_methname  ascii timeZoneWithName:
38  0x0003b936 0x0003b936 12  13   3.__TEXT.__objc_methname  ascii setTimeZone:
39  0x0003b943 0x0003b943 14  15   3.__TEXT.__objc_methname  ascii setDateFormat:
40  0x0003b952 0x0003b952 15  16   3.__TEXT.__objc_methname  ascii stringFromDate:
41  0x0003b962 0x0003b962 14  15   3.__TEXT.__objc_methname  ascii defaultManager
42  0x0003b971 0x0003b971 36  37   3.__TEXT.__objc_methname  ascii attributesOfFileSystemForPath:error:
43  0x0003b996 0x0003b996 13  14   3.__TEXT.__objc_methname  ascii objectForKey:
44  0x0003b9a4 0x0003b9a4 11  12   3.__TEXT.__objc_methname  ascii stringValue
45  0x0003b9b0 0x0003b9b0 40  41   3.__TEXT.__objc_methname  ascii initWithURL:cachePolicy:timeoutInterval:
46  0x0003b9d9 0x0003b9d9 47  48   3.__TEXT.__objc_methname  ascii sendSynchronousRequest:returningResponse:error:
47  0x0003ba09 0x0003ba09 28  29   3.__TEXT.__objc_methname  ascii componentsSeparatedByString:
48  0x0003ba26 0x0003ba26 5   6    3.__TEXT.__objc_methname  ascii count
49  0x0003ba2c 0x0003ba2c 25  26   3.__TEXT.__objc_methname  ascii objectAtIndexedSubscript:
50  0x0003ba46 0x0003ba46 12  13   3.__TEXT.__objc_methname  ascii integerValue
51  0x0003ba53 0x0003ba53 18  19   3.__TEXT.__objc_methname  ascii isValidJSONObject:
52  0x0003ba66 0x0003ba66 33  34   3.__TEXT.__objc_methname  ascii dataWithJSONObject:options:error:
53  0x0003ba88 0x0003ba88 22  23   3.__TEXT.__objc_methname  ascii initWithData:encoding:
54  0x0003ba9f 0x0003ba9f 7   8    3.__TEXT.__objc_methname  ascii setURL:
55  0x0003baa7 0x0003baa7 19  20   3.__TEXT.__objc_methname  ascii setTimeoutInterval:
56  0x0003babb 0x0003babb 14  15   3.__TEXT.__objc_methname  ascii setHTTPMethod:
57  0x0003baca 0x0003baca 28  29   3.__TEXT.__objc_methname  ascii setValue:forHTTPHeaderField:
58  0x0003bae7 0x0003bae7 17  18   3.__TEXT.__objc_methname  ascii fileExistsAtPath:
59  0x0003baf9 0x0003baf9 29  30   3.__TEXT.__objc_methname  ascii ephemeralSessionConfiguration
60  0x0003bb17 0x0003bb17 36  37   3.__TEXT.__objc_methname  ascii dictionaryWithObjects:forKeys:count:
61  0x0003bb3c 0x0003bb3c 29  30   3.__TEXT.__objc_methname  ascii setConnectionProxyDictionary:
62  0x0003bb5a 0x0003bb5a 25  26   3.__TEXT.__objc_methname  ascii sessionWithConfiguration:
63  0x0003bb74 0x0003bb74 13  14   3.__TEXT.__objc_methname  ascii sharedSession
64  0x0003bb82 0x0003bb82 10  11   3.__TEXT.__objc_methname  ascii statusCode
65  0x0003bb8d 0x0003bb8d 38  39   3.__TEXT.__objc_methname  ascii dataTaskWithRequest:completionHandler:
66  0x0003bbb4 0x0003bbb4 6   7    3.__TEXT.__objc_methname  ascii resume
67  0x0003bbbb 0x0003bbbb 17  18   3.__TEXT.__objc_methname  ascii stringWithFormat:
68  0x0003bbcd 0x0003bbcd 12  13   3.__TEXT.__objc_methname  ascii setHTTPBody:
69  0x0003bbda 0x0003bbda 29  30   3.__TEXT.__objc_methname  ascii fileExistsAtPath:isDirectory:
70  0x0003bbf8 0x0003bbf8 23  24   3.__TEXT.__objc_methname  ascii dataWithContentsOfFile:
71  0x0003bc10 0x0003bc10 5   6    3.__TEXT.__objc_methname  ascii bytes
72  0x0003bc16 0x0003bc16 19  20   3.__TEXT.__objc_methname  ascii stringWithCapacity:
73  0x0003bc2a 0x0003bc2a 13  14   3.__TEXT.__objc_methname  ascii appendFormat:
74  0x0003bc38 0x0003bc38 14  15   3.__TEXT.__objc_methname  ascii exASdcLNKxJfAM
75  0x0003bc47 0x0003bc47 14  15   3.__TEXT.__objc_methname  ascii xKxcixmmxdxPxZ
76  0x0003bc56 0x0003bc56 15  16   3.__TEXT.__objc_methname  ascii xKxcixmmxdxPxZ:
77  0x0003bc66 0x0003bc66 15  16   3.__TEXT.__objc_methname  ascii MxJgqzxvqFtQxV:
78  0x0003bc76 0x0003bc76 37  38   3.__TEXT.__objc_methname  ascii dVxAxlNLgYxxYh:compareVersionNumberB:
79  0x0003bc9c 0x0003bc9c 15  16   3.__TEXT.__objc_methname  ascii xxfxuGtxxxtRxx:
80  0x0003bcac 0x0003bcac 15  16   3.__TEXT.__objc_methname  ascii OxxXdjxnoanKzL:
81  0x0003bcbc 0x0003bcbc 15  16   3.__TEXT.__objc_methname  ascii NZufxnxxcFkCxb:
82  0x0003bccc 0x0003bccc 16  17   3.__TEXT.__objc_methname  ascii fcVwxqxhwdnpxa::
83  0x0003bcdd 0x0003bcdd 18  19   3.__TEXT.__objc_methname  ascii emxqoxrXzxPUvx::::
84  0x0003bcf0 0x0003bcf0 15  16   3.__TEXT.__objc_methname  ascii xxxxtpHhXMwfjx:
85  0x0003bd00 0x0003bd00 49  50   3.__TEXT.__objc_methname  ascii initWithBytesNoCopy:length:encoding:freeWhenDone:
86  0x0003bd32 0x0003bd32 17  18   3.__TEXT.__objc_methname  ascii characterAtIndex:
87  0x0003bd44 0x0003bd44 15  16   3.__TEXT.__objc_methname  ascii xMRExdxMxkhxxx:
88  0x0003bd54 0x0003bd54 19  20   3.__TEXT.__objc_methname  ascii appendBytes:length:
89  0x0003bd68 0x0003bd68 15  16   3.__TEXT.__objc_methname  ascii LUxxxfWDhvpGxJ:
90  0x0003bd78 0x0003bd78 15  16   3.__TEXT.__objc_methname  ascii fexkIvlCfxhxsy:
91  0x0003bd88 0x0003bd88 14  15   3.__TEXT.__objc_methname  ascii MjOhDBJSUcxxxu
92  0x0003bd97 0x0003bd97 14  15   3.__TEXT.__objc_methname  ascii gxcyxmxxxIxNux
93  0x0003bda6 0x0003bda6 14  15   3.__TEXT.__objc_methname  ascii OxlpxkxxFLzEnr
94  0x0003bdb5 0x0003bdb5 14  15   3.__TEXT.__objc_methname  ascii fDjCxxvxTjxWeL
95  0x0003bdc4 0x0003bdc4 14  15   3.__TEXT.__objc_methname  ascii xouxVIvlOloYFX
96  0x0003bdd3 0x0003bdd3 14  15   3.__TEXT.__objc_methname  ascii xtxNTxxxsxVGxk
97  0x0003bde2 0x0003bde2 10  11   3.__TEXT.__objc_methname  ascii floatValue
98  0x0003bded 0x0003bded 10  11   3.__TEXT.__objc_methname  ascii mainBundle
99  0x0003bdf8 0x0003bdf8 16  17   3.__TEXT.__objc_methname  ascii bundleIdentifier
100 0x0003be09 0x0003be09 15  16   3.__TEXT.__objc_methname  ascii jailBrokenMask:
101 0x0003be19 0x0003be19 8   9    3.__TEXT.__objc_methname  ascii loadView
102 0x0003be22 0x0003be22 12  13   3.__TEXT.__objc_methname  ascii currentTitle
103 0x0003be2f 0x0003be2f 21  22   3.__TEXT.__objc_methname  ascii dataWithBytes:length:
104 0x0003be45 0x0003be45 10  11   3.__TEXT.__objc_methname  ascii UTF8String
105 0x0003be50 0x0003be50 43  44   3.__TEXT.__objc_methname  ascii requestWithURL:cachePolicy:timeoutInterval:
0   0x0003be7d 0x0003be7d 45  46   4.__TEXT.__cstring        ascii v16@?0@"NSData"4@"NSURLResponse"8@"NSError"12
1   0x0003beab 0x0003beab 5   6    4.__TEXT.__cstring        ascii v4@?0
0   0x0003beb1 0x0003beb1 14  15   5.__TEXT.__objc_classname ascii NxNXRxsbBxexSx
1   0x0003bec0 0x0003bec0 18  19   5.__TEXT.__objc_classname ascii daAxbxbayGwxtxdcca
2   0x0003bed3 0x0003bed3 14  15   5.__TEXT.__objc_classname ascii NbGzxsksqtAxgN
3   0x0003bee2 0x0003bee2 14  15   5.__TEXT.__objc_classname ascii xrxleWZnuCXPEx
4   0x0003bef1 0x0003bef1 14  15   5.__TEXT.__objc_classname ascii xxWxKxrETCxJpx
0   0x0003bf00 0x0003bf00 6   7    6.__TEXT.__objc_methtype  ascii @8@0:4
1   0x0003bf07 0x0003bf07 9   10   6.__TEXT.__objc_methtype  ascii v12@0:4@8
2   0x0003bf11 0x0003bf11 15  16   6.__TEXT.__objc_methtype  ascii v20@0:4@8@12@16
3   0x0003bf21 0x0003bf21 15  16   6.__TEXT.__objc_methtype  ascii v20@0:4@8c12c16
4   0x0003bf31 0x0003bf31 9   10   6.__TEXT.__objc_methtype  ascii @12@0:4@8
5   0x0003bf3b 0x0003bf3b 12  13   6.__TEXT.__objc_methtype  ascii i16@0:4@8@12
6   0x0003bf48 0x0003bf48 13  14   6.__TEXT.__objc_methtype  ascii @16@0:4@8^i12
7   0x0003bf56 0x0003bf56 19  20   6.__TEXT.__objc_methtype  ascii @24@0:4@8@12^i16i20
8   0x0003bf6a 0x0003bf6a 9   10   6.__TEXT.__objc_methtype  ascii i12@0:4c8

-s

➜  DynamicLibraries rabin2 -s MaskPro.dylib > MaskProDylib/MaskProDylib_rabin2_s_symbols.txt

输出：

[Symbols]

nth paddr       vaddr      bind   type size lib name
――――――――――――――――――――――――――――――――――――――――――――――――――――
0    0x0004089c 0x0003c89c GLOBAL FUNC 0        _OBJC_CLASS_$_NbGzxsksqtAxgN
1    0x0004084c 0x0003c84c GLOBAL FUNC 0        _OBJC_CLASS_$_NxNXRxsbBxexSx
2    0x00040874 0x0003c874 GLOBAL FUNC 0        _OBJC_CLASS_$_daAxbxbayGwxtxdcca
3    0x000408c4 0x0003c8c4 GLOBAL FUNC 0        _OBJC_CLASS_$_xrxleWZnuCXPEx
4    0x000408ec 0x0003c8ec GLOBAL FUNC 0        _OBJC_CLASS_$_xxWxKxrETCxJpx
5    0x00040888 0x0003c888 GLOBAL FUNC 0        _OBJC_METACLASS_$_NbGzxsksqtAxgN
6    0x00040838 0x0003c838 GLOBAL FUNC 0        _OBJC_METACLASS_$_NxNXRxsbBxexSx
7    0x00040860 0x0003c860 GLOBAL FUNC 0        _OBJC_METACLASS_$_daAxbxbayGwxtxdcca
8    0x000408b0 0x0003c8b0 GLOBAL FUNC 0        _OBJC_METACLASS_$_xrxleWZnuCXPEx
9    0x000408d8 0x0003c8d8 GLOBAL FUNC 0        _OBJC_METACLASS_$_xxWxKxrETCxJpx
10   0x00043420 0x0003f420 GLOBAL FUNC 0        _g_slide
11   0x00043564 0x0003f564 GLOBAL FUNC 0        _x
12   0x00043568 0x0003f568 GLOBAL FUNC 0        _x.146
13   0x0004356c 0x0003f56c GLOBAL FUNC 0        _x.148
...
120  0x00043448 0x0003f448 GLOBAL FUNC 0        _y.382
121  0x00004000 0x05614542 LOCAL  FUNC 0        radr://5614542
122  0x0003f124 0x0003b124 LOCAL  FUNC 0        imp.CC_MD5
123  0x0003f134 0x0003b134 LOCAL  FUNC 0        imp.MGCopyAnswer
124  0x0003f144 0x0003b144 LOCAL  FUNC 0        imp.MSHookFunction
125  0x0003f154 0x0003b154 LOCAL  FUNC 0        imp.MSHookMessageEx
126  0x0003f164 0x0003b164 LOCAL  FUNC 0        imp.NSClassFromString
127  0x0003f174 0x0003b174 LOCAL  FUNC 0        imp.NSHomeDirectory
128  0x0003f184 0x0003b184 LOCAL  FUNC 0        imp._Block_object_assign
129  0x0003f194 0x0003b194 LOCAL  FUNC 0        imp._Block_object_dispose
130  0x0003f1a4 0x0003b1a4 LOCAL  FUNC 0        imp._Unwind_SjLj_Register
131  0x0003f1b4 0x0003b1b4 LOCAL  FUNC 0        imp._Unwind_SjLj_Resume
132  0x0003f1c4 0x0003b1c4 LOCAL  FUNC 0        imp._Unwind_SjLj_Unregister
133  0x0003f1d4 0x0003b1d4 LOCAL  FUNC 0        imp.__assert_rtn
134  0x0003f1e4 0x0003b1e4 LOCAL  FUNC 0        imp.__stack_chk_fail
135  0x0003f1f4 0x0003b1f4 LOCAL  FUNC 0        imp._dyld_get_image_vmaddr_slide
136  0x0003f204 0x0003b204 LOCAL  FUNC 0        imp.dispatch_async
137  0x0003f214 0x0003b214 LOCAL  FUNC 0        imp.dispatch_get_global_queue
138  0x0003f224 0x0003b224 LOCAL  FUNC 0        imp.dispatch_semaphore_create
139  0x0003f234 0x0003b234 LOCAL  FUNC 0        imp.dispatch_semaphore_signal
140  0x0003f244 0x0003b244 LOCAL  FUNC 0        imp.dispatch_semaphore_wait
141  0x0003f254 0x0003b254 LOCAL  FUNC 0        imp.dispatch_time
142  0x0003f264 0x0003b264 LOCAL  FUNC 0        imp.dlclose
143  0x0003f274 0x0003b274 LOCAL  FUNC 0        imp.dlopen
144  0x0003f284 0x0003b284 LOCAL  FUNC 0        imp.dlsym
145  0x0003f294 0x0003b294 LOCAL  FUNC 0        imp.exit
146  0x0003f2a4 0x0003b2a4 LOCAL  FUNC 0        imp.free
147  0x0003f2b4 0x0003b2b4 LOCAL  FUNC 0        imp.getpid
148  0x0003f2c4 0x0003b2c4 LOCAL  FUNC 0        imp.ioctl
149  0x0003f2d4 0x0003b2d4 LOCAL  FUNC 0        imp.isatty
150  0x0003f2e4 0x0003b2e4 LOCAL  FUNC 0        imp.malloc
151  0x0003f2f4 0x0003b2f4 LOCAL  FUNC 0        imp.memset
152  0x0003f304 0x0003b304 LOCAL  FUNC 0        imp.objc_autorelease
153  0x0003f314 0x0003b314 LOCAL  FUNC 0        imp.objc_autoreleaseReturnValue
154  0x0003f324 0x0003b324 LOCAL  FUNC 0        imp.objc_getClass
155  0x0003f334 0x0003b334 LOCAL  FUNC 0        imp.objc_msgSend
156  0x0003f344 0x0003b344 LOCAL  FUNC 0        imp.objc_release
157  0x0003f354 0x0003b354 LOCAL  FUNC 0        imp.objc_retain
158  0x0003f364 0x0003b364 LOCAL  FUNC 0        imp.objc_retainAutorelease
159  0x0003f374 0x0003b374 LOCAL  FUNC 0        imp.objc_retainAutoreleasedReturnValue
160  0x0003f384 0x0003b384 LOCAL  FUNC 0        imp.perror
161  0x0003f394 0x0003b394 LOCAL  FUNC 0        imp.pthread_create
162  0x0003f3a4 0x0003b3a4 LOCAL  FUNC 0        imp.sleep
163  0x0003f3b4 0x0003b3b4 LOCAL  FUNC 0        imp.strstr
164  0x0003f3c4 0x0003b3c4 LOCAL  FUNC 0        imp.syscall
165  0x0003f3d4 0x0003b3d4 LOCAL  FUNC 0        imp.sysctl
166  0x0003f3e4 0x0003b3e4 LOCAL  FUNC 0        imp.uname
167  0x00004160 0x00004160 LOCAL  FUNC 0        func.00004161
168  0x00005b10 0x00005b10 LOCAL  FUNC 0        func.00005b11
...
223  0x00039220 0x00039220 LOCAL  FUNC 0        func.00039221
224  0x0003939e 0x0003939e LOCAL  FUNC 0        func.0003939f
225  0x000394dc 0x000394dc LOCAL  FUNC 0        func.000394dd

-S

➜  DynamicLibraries rabin2 -S MaskPro.dylib > MaskProDylib/MaskProDylib_rabin2_S_sections.txt

输出：

[Sections]

nth paddr          size vaddr         vsize perm name
―――――――――――――――――――――――――――――――――――――――――――――――――――――
0   0x00004160  0x36fc4 0x00004160  0x36fc4 -r-x 0.__TEXT.__text
1   0x0003b124    0x2d0 0x0003b124    0x2d0 -r-x 1.__TEXT.__picsymbolstub4
2   0x0003b3f4    0x240 0x0003b3f4    0x240 -r-x 2.__TEXT.__stub_helper
3   0x0003b634    0x848 0x0003b634    0x848 -r-x 3.__TEXT.__objc_methname
4   0x0003be7c     0x35 0x0003be7c     0x35 -r-x 4.__TEXT.__cstring
5   0x0003beb1     0x4f 0x0003beb1     0x4f -r-x 5.__TEXT.__objc_classname
6   0x0003bf00     0x74 0x0003bf00     0x74 -r-x 6.__TEXT.__objc_methtype
7   0x0003bf74     0x8c 0x0003bf74     0x8c -r-x 7.__TEXT.__gcc_except_tab
8   0x0003c000    0x1d0 0x0003c000    0x1d0 -rw- 8.__DATA.__nl_symbol_ptr
9   0x0003c1d0     0xb4 0x0003c1d0     0xb4 -rw- 9.__DATA.__la_symbol_ptr
10  0x0003c284      0x4 0x0003c284      0x4 -rw- 10.__DATA.__mod_init_func
11  0x0003c288     0x84 0x0003c288     0x84 -rw- 11.__DATA.__const
12  0x0003c30c     0x10 0x0003c30c     0x10 -rw- 12.__DATA.__cfstring
13  0x0003c31c     0x14 0x0003c31c     0x14 -rw- 13.__DATA.__objc_classlist
14  0x0003c330      0x8 0x0003c330      0x8 -rw- 14.__DATA.__objc_imageinfo
15  0x0003c338    0x328 0x0003c338    0x328 -rw- 15.__DATA.__objc_const
16  0x0003c660    0x170 0x0003c660    0x170 -rw- 16.__DATA.__objc_selrefs
17  0x0003c7d0     0x68 0x0003c7d0     0x68 -rw- 17.__DATA.__objc_classrefs
18  0x0003c838     0xc8 0x0003c838     0xc8 -rw- 18.__DATA.__objc_data
19  0x0003c900   0x2a24 0x0003c900   0x2a24 -rw- 19.__DATA.__data
20  0x00000000      0x0 0x0003f324     0xfc -rw- 20.__DATA.__bss
21  0x00000000      0x0 0x0003f420    0x1bc -rw- 21.__DATA.__common
22  0x00040000      0x1 0x00040000      0x1 -rw- 22.__LLVM.__bundle

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-05 16:29:02

help

rabin2的help语法

➜  ~ rabin2 --help
rabin2: illegal option -- -
Usage: rabin2 [-AcdeEghHiIjlLMqrRsSUvVxzZ] [-@ at] [-a arch] [-b bits] [-B addr]
              [-C F:C:D] [-f str] [-m addr] [-n str] [-N m:M] [-P[-P] pdb]
              [-o str] [-O str] [-k query] [-D lang symname] file
 -@ [addr]       show section, symbol or import at addr
 -A              list sub-binaries and their arch-bits pairs
 -a [arch]       set arch (x86, arm, .. or <arch>_<bits>)
 -b [bits]       set bits (32, 64 ...)
 -B [addr]       override base address (pie bins)
 -c              list classes
 -cc             list classes in header format
 -C [fmt:C:D]    create [elf,mach0,pe] with Code and Data hexpairs (see -a)
 -d              show debug/dwarf information
 -D lang name    demangle symbol name (-D all for bin.demangle=true)
 -e              entrypoint
 -ee             constructor/destructor entrypoints
 -E              globally exportable symbols
 -f [str]        select sub-bin named str
 -F [binfmt]     force to use that bin plugin (ignore header check)
 -g              same as -SMZIHVResizcld -SS -SSS -ee (show all info)
 -G [addr]       load address . offset to header
 -h              this help message
 -H              header fields
 -i              imports (symbols imported from libraries)
 -I              binary info
 -j              output in json
 -k [sdb-query]  run sdb query. for example: '*'
 -K [algo]       calculate checksums (md5, sha1, ..)
 -l              linked libraries
 -L [plugin]     list supported bin plugins or plugin details
 -m [addr]       show source line at addr
 -M              main (show address of main symbol)
 -n [str]        show section, symbol or import named str
 -N [min:max]    force min:max number of chars per string (see -z and -zz)
 -o [str]        output file/folder for write operations (out by default)
 -O [str]        write/extract operations (-O help)
 -p              show physical addresses
 -P              show debug/pdb information
 -PP             download pdb file for binary
 -q              be quiet, just show fewer data
 -qq             show less info (no offset/size for -z for ex.)
 -Q              show load address used by dlopen (non-aslr libs)
 -r              radare output
 -R              relocations
 -s              symbols
 -S              sections
 -SS             segments
 -SSS            sections mapping to segments
 -t              display file hashes
 -T              display file signature
 -u              unfiltered (no rename duplicated symbols/sections)
 -U              resoUrces
 -v              display version and quit
 -V              Show binary version information
 -w              display try/catch blocks
 -x              extract bins contained in file
 -X [fmt] [f] .. package in fat or zip the given files and bins contained in file
 -z              strings (from data section)
 -zz             strings (from raw bins [e bin.rawstr=1])
 -zzz            dump raw strings to stdout (for huge files)
 -Z              guess size of binary program
Environment:
 RABIN2_LANG:      e bin.lang         # assume lang for demangling
 RABIN2_NOPLUGINS: # do not load shared plugins (speedup loading)
 RABIN2_DEMANGLE=0:e bin.demangle     # do not demangle symbols
 RABIN2_MAXSTRBUF: e bin.maxstrbuf    # specify maximum buffer size
 RABIN2_STRFILTER: e bin.str.filter   #  r2 -qc 'e bin.str.filter=??' -
 RABIN2_STRPURGE:  e bin.str.purge    # try to purge false positives
 RABIN2_DEBASE64:  e bin.debase64     # try to debase64 all strings
 RABIN2_DMNGLRCMD: e bin.demanglercmd # try to purge false positives
 RABIN2_PDBSERVER: e pdb.server       # use alternative PDB server
 RABIN2_SYMSTORE:  e pdb.symstore     # path to downstream symbol store
 RABIN2_PREFIX:    e bin.prefix       # prefix symbols/sections/relocs with a specific string
 R2_CONFIG:        # sdb config file

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-04 22:55:49

jtool2

jtool2

jtool2

旧版叫：jtool

类似于otool的，解析查看Mach-O文件格式信息

区别：添加了许多Mach-O相关的命令

jtool/jtool2比otool功能更完善

支持多种运行平台

OS X=Mac

iOS

Linux

功能

in-binary search functionality

symbol injection

built-in disassembler functionality with (limited but constantly improving) emulation capabilities, which already outdo fancy commercial GUI disassemblers.

Color terminal output, enabled by JCOLOR=1

资料

官网

JTool2 - Taking the O out of otool - squared

http://www.newosxbook.com/tools/jtool.html

安装jtool2

Mac中安装jtool2：

Intel的CPU的Mac = Intel Mac

方式1：brew

brew install --cask jtool2

方式2：官网下载二进制

从JTool2官网下载jtool2.tgz

解压得到：jtool2（和disarm）

提示：可以把路径加到启动脚本的PATH中（再source），使得命令行中可以使用

（M1/M2等）M系列CPU的Mac = Apple Silicon Mac

brew tap excitedplus1s/repo/jtool2
brew install --no-quarantine excitedplus1s/repo/jtool2

常见问题

killed

问题：Mac M2 Max + macOS Ventura 13.2.1中，用brew安装的原始版本=官网版本的jtool2，运行崩溃Killed

➜  ~ which jtool2
/usr/local/bin/jtool2
➜  ~ jtool2 --version
[1]    69975 killed     jtool2 --version
➜  ~ jtool2 --help
[1]    70025 killed     jtool2 --help

原因：签名问题

找崩溃日志，找到原因了

默认    17:41:55.432539+0800    kernel    Checking in with amfid for DER jtool2.arm64e
默认    17:41:55.433342+0800    kernel    AMFI: /Users/crifan/dev/dev_tool/reverse_security/iOS/jtool2/jtool2_old/jtool2 doesn't have DER entitlements and will not work in a future release
默认    17:41:55.433439+0800    kernel    AMFI: '/Users/crifan/dev/dev_tool/reverse_security/iOS/jtool2/jtool2_old/jtool2' has no CMS blob?
默认    17:41:55.433454+0800    kernel    AMFI: '/Users/crifan/dev/dev_tool/reverse_security/iOS/jtool2/jtool2_old/jtool2': Unrecoverable CT signature issue, bailing out.
默认    17:41:55.433480+0800    kernel    AMFI: Releasing transmuted blob for jtool2.arm64e - <private> 94x
默认    17:41:55.433516+0800    kernel    proc 77535: load code signature error 4 for file "jtool2"
默认    17:41:55.434075+0800    kernel    exec_mach_imgact: not running binary "jtool2" built against preview arm64e ABI
默认    17:41:55.434268+0800    kernel    ASP: Security policy would not allow process: 77535, /Users/crifan/dev/dev_tool/reverse_security/iOS/jtool2/jtool2_old/jtool2

解决办法：换装另外的版本：

https://github.com/excitedplus1s/jtool2

brew tap excitedplus1s/repo/jtool2
brew install --no-quarantine excitedplus1s/repo/jtool2

即可正常使用jtool2

➜  jtool2 which jtool2
/usr/local/bin/jtool2
➜  jtool2 jtool2 --version
This is 2.1-The Resurgence compiled on Dec 21 2020 21:09:04

jtool2相关资料

官网

JTool2 - Taking the O out of otool - squared (newosxbook.com)

常见命令的常见用法举例

官网JTool2 - Taking the O out of otool - squared (newosxbook.com)中就有语法介绍：

* Otool Compatible options
* dyldinfo Compatible options
* Advanced options:
    * -pages (get layout)
    * -a (lookup address)
    * -S
* Code Singing options
    * --sig
    * --ent
    * --sign
* Objective-C
* Darn Cool Options

对应的别人的中文翻译：

【OSG】jtool - Taking the O out of otool(1)-iOS安全-看雪论坛-安全社区|安全招聘|bbs.pediy.com

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 23:20:43

用法

jtool2用法

-h：查看基本头文件header信息

jtool2 -h yourBinary

-l：列出段

jtool2 -l yourBinary

-L：查看使用了哪些共享库Library

jtool2 -L yourBinary

-S：列出符号表Symbol == nm

jtool2 -S yourBinary

--analyze：分析analyze -》 导出类和函数名等

jtool2 --analyze yourBinary

--pages：显示layout

jtool2 --pages yourBinary

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 15:42:05

举例

jtool2用法举例

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-05 16:48:12

AwemeCore

jtool2用法举例：AwemeCore

-h：查看header头信息

➜  AwemeCore jtool2 -h v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore
Magic:    64-bit MachO (Little Endian)
Type:    dylib
CPU:    ARM64 (ARMv8)
Cmds:    133
Size:    18720
Flags:    0x910085

-l: list列出段

jtool2 -l v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore

输出内容：

➜  AwemeCore jtool2 -l ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore
LC 00: LC_SEGMENT_64              Mem: 0x000000000-0x304000    __TEXT
    Mem: 0x00000b9b0-0x000013e70        __TEXT.__stub_helper    (Normal)
    Mem: 0x000013e70-0x000017e90        __TEXT.__const
    Mem: 0x000017e90-0x00001ad88        __TEXT.__swift5_typeref
    Mem: 0x00001ad88-0x00001d710        __TEXT.__swift5_fieldmd
    Mem: 0x00001d710-0x00001da48        __TEXT.__swift5_proto
    Mem: 0x00001da48-0x00001dcd4        __TEXT.__swift5_types
    Mem: 0x00001dcd4-0x00001dcd4        __TEXT.__cstring    (C-String Literals)
    Mem: 0x00001dcd4-0x00001dcd4        __TEXT.__objc_methname    (C-String Literals)
    Mem: 0x00001dcd4-0x00001dcd4        __TEXT.__objc_classname    (C-String Literals)
    Mem: 0x00001dcd4-0x00001dcd4        __TEXT.__objc_methtype    (C-String Literals)
    Mem: 0x00001dcd4-0x00001dd3c        __TEXT.__gcc_except_tab
    Mem: 0x00001dd40-0x00002136c        __TEXT.__swift5_reflstr
    Mem: 0x00002136c-0x000021524        __TEXT.__swift5_builtin
    Mem: 0x000021524-0x0000217dc        __TEXT.__swift5_assocty
    Mem: 0x0000217dc-0x0000233e8        __TEXT.__swift5_capture
    Mem: 0x0000233e8-0x000023448        __TEXT.__swift5_protos
    Mem: 0x000023448-0x000023448        __TEXT.__ustring
    Mem: 0x000023448-0x000023448        __TEXT.__text
    Mem: 0x000023448-0x0002c7fb8        __TEXT.__unwind_info
    Mem: 0x0002c7fb8-0x0002ffff8        __TEXT.__eh_frame
    Mem: 0x000300000-0x00030001b        __TEXT.__oslogstring    (C-String Literals)
LC 01: LC_SEGMENT_64              Mem: 0x000304000-0x5924000    __DATA
    Mem: 0x000304000-0x000307120        __DATA.__got    (Non-Lazy Symbol Ptrs)
    Mem: 0x000307120-0x00030c9d0        __DATA.__la_symbol_ptr    (Lazy Symbol Ptrs)
    Mem: 0x00030c9d0-0x0003106f8        __DATA.__mod_init_func    (Module Init Function Ptrs)
    Mem: 0x000310700-0x000321768        __DATA.__const
    Mem: 0x000321768-0x0003221c8        __DATA.__cfstring
    Mem: 0x0003221c8-0x000369bd0        __DATA.__objc_classlist    (Normal)
    Mem: 0x000369bd0-0x00036a248        __DATA.__objc_nlclslist    (Normal)
    Mem: 0x00036a248-0x00036da38        __DATA.__objc_catlist    (Normal)
    Mem: 0x00036da38-0x00036db58        __DATA.__objc_nlcatlist    (Normal)
    Mem: 0x00036db58-0x00037f650        __DATA.__objc_protolist
    Mem: 0x00037f650-0x00037f658        __DATA.__objc_imageinfo
    Mem: 0x00037f658-0x0009417a0        __DATA.__objc_const
    Mem: 0x0009417a0-0x0009417a8        __DATA.__objc_selrefs    (Literal Pointers)
    Mem: 0x0009417a8-0x000947ea8        __DATA.__objc_protorefs
    Mem: 0x000947ea8-0x0009881f8        __DATA.__objc_classrefs    (Normal)
    Mem: 0x0009881f8-0x0009ab740        __DATA.__objc_superrefs    (Normal)
    Mem: 0x0009ab740-0x0009acac8        __DATA.__objc_ivar
    Mem: 0x0009acac8-0x000d55b20        __DATA.__objc_data
    Mem: 0x000d55b20-0x000d5aa30        __DATA.__data
    Mem: 0x000d5aa30-0x000d5ab28        __DATA.__HTSLifeCycle
    Mem: 0x000d5ab28-0x000d5ab40        __DATA.__objc_stublist
    Mem: 0x000d5ab40-0x000d5ab58        __DATA.RewardedADJSB
    Mem: 0x000d5ab58-0x000d5ad20        __DATA.HGTimorLaunch
    Mem: 0x000d5ad20-0x000d5ad88        __DATA.HGTimorLoad
    Mem: 0x000d5ad88-0x000d5b080        __DATA.TimorLaunch
    Mem: 0x000d5b080-0x000d5b140        __DATA.TimorLoad
    Mem: 0x000d5b140-0x000d5b230        __DATA.RSDHCampaign
    Mem: 0x000d5b230-0x000d5b4b0        __DATA.XBMExternal
    Mem: 0x000d5b4b0-0x000d5b570        __DATA.LazyRegHeader
    Mem: 0x000d5b570-0x000d5b580        __DATA.AWELynxBridge
    Mem: 0x000d5b580-0x000d5b5b0        __DATA.PremainCode
    Mem: 0x000d5b5b0-0x000d60510        __DATA.LazyRegData
    Mem: 0x000d60510-0x000d61390        __DATA.__GAIA__SECTION
    Mem: 0x000d61390-0x000d614b0        __DATA.XBMDefault
    Mem: 0x000d614b0-0x000d61578        __DATA.HMDModule
    Mem: 0x000d61578-0x000d61590        __DATA.HMDLocalModule
    Mem: 0x000d61590-0x000d61710        __DATA.IESLiveBridge
    Mem: 0x000d61710-0x000d62138        __DATA.__bd_timsdk
    Mem: 0x000d62138-0x000d62228        __DATA.IESLiveTemplate
    Mem: 0x000d62228-0x000d62308        __DATA.__LIVESEI__
    Mem: 0x000d62308-0x000d62668        __DATA.__LIVESCHEMA__
    Mem: 0x000d62668-0x000d626c8        __DATA.__LSCHEMEMODEL__
    Mem: 0x000d626c8-0x000d626d8        __DATA.__ENTERROOMSEC__
    Mem: 0x000d626d8-0x000d627a8        __DATA.__VSUSERCARD__
    Mem: 0x000d627a8-0x000d627f8        __DATA.__PUZZLEMETHOD__
    Mem: 0x000d627f8-0x000d62808        __DATA.IESSLynxBridge
    Mem: 0x000d62808-0x000d62858        __DATA.RxAnnotation
    Mem: 0x000d62858-0x000d670a8        __DATA.__objc_clsrefs
    Mem: 0x000d670a8-0x000d67768        __DATA.__thread_vars    (TLV descriptors)
    Mem: 0x000d67768-0x000d67a28        __DATA.IESECSettingReg
    Mem: 0x000d67a28-0x000d67ae0        __DATA.__swift_hooks
    Mem: 0x000d67ae0-0x000d67b98        __DATA.__swift51_hooks
    Mem: 0x000d67b98-0x000d68208        __DATA.__HTSService
    Mem: 0x000d68208-0x000d682f8        __DATA.__HTSDyServImpl
    Mem: 0x000d682f8-0x000d68918        __DATA.__HTSMsgAsc
    Mem: 0x000d68918-0x000d68d68        __DATA.AWERunModernFeed
    Mem: 0x000d68d68-0x000d68f98        __DATA.AWERunShare
    Mem: 0x000d68f98-0x000d69028        __DATA.__HTSDyServ
    Mem: 0x000d69028-0x000d690a8        __DATA.__HTSMsg
    Mem: 0x000d690a8-0x000d75100        __DATA.RxInjector
    Mem: 0x000d75100-0x000d75218        __DATA.RxAppService
    Mem: 0x000d75218-0x000d75248        __DATA.__HTSNoti
    Mem: 0x000d75248-0x000d752c8        __DATA.AWERunShareSVC
    Mem: 0x000d752c8-0x000d76c68        __DATA.StudioConfigMock
    Mem: 0x000d76c68-0x000d76d28        __DATA.XBMInternal
    Mem: 0x000d76d30-0x000d84267        __DATA.__cstring    (C-String Literals)
    Mem: 0x000d84267-0x000df3302        __DATA.__objc_methname    (C-String Literals)
    Mem: 0x000df3302-0x000e1100a        __DATA.__objc_methtype    (C-String Literals)
    Mem: 0x000e1100a-0x000f4c006        __DATA.__objc_classname    (C-String Literals)
    Mem: 0x000f4c008-0x000f80848        __DATA.__thread_bss    (Thread local zerofill)
    Mem: 0x000f80860-0x001257840        __DATA._D_tconst    (Zero Fill)
    Mem: 0x001257840-0x00161ad98        __DATA._D_dconst    (Zero Fill)
    Mem: 0x00161c000-0x00173e5fc        __DATA._D_ddata    (Zero Fill)
    Mem: 0x00173e600-0x001bd8100        __DATA._D_cfstring    (Zero Fill)
    Mem: 0x001bd8100-0x0037e8970        __DATA._D_objc_const    (Zero Fill)
    Mem: 0x0037e8970-0x003893854        __DATA._D_objc_ivar    (Zero Fill)
    Mem: 0x003893858-0x003a98d20        __DATA._D_objc_selrefs    (Zero Fill)
    Mem: 0x003a98d20-0x003f4eb10        __DATA._D_gcc_except_ta    (Zero Fill)
    Mem: 0x003f4eb10-0x0047e5193        __DATA._D_cstring    (Zero Fill)
    Mem: 0x0047e5194-0x00485caee        __DATA._D_ustring    (Zero Fill)
    Mem: 0x00485caee-0x00533d1a8        __DATA._D_objc_methname    (Zero Fill)
    Mem: 0x00533d1a8-0x005507b0a        __DATA._D_objc_methtype    (Zero Fill)
    Mem: 0x005507c00-0x005687848        __DATA.__common    (Zero Fill)
    Mem: 0x005687900-0x0059229ec        __DATA.__bss    (Zero Fill)
LC 02: LC_SEGMENT_64              Mem: 0x005924000-0x11480000    __BD_TEXT
    Mem: 0x005924000-0x011476a38        __BD_TEXT.__text    (Normal)
    Mem: 0x011476a38-0x01147ef40        __BD_TEXT.__stubs    (Symbol Stubs)
LC 03: LC_SEGMENT_64              Mem: 0x011480000-0x12660000    __LTC_DATA
    Mem: 0x011480000-0x011480208        __LTC_DATA.__meta
    Mem: 0x011480208-0x011480218        __LTC_DATA.__deco
    Mem: 0x011480218-0x011b54d57        __LTC_DATA._C_objc_const
    Mem: 0x011b54d57-0x011b6eadf        __LTC_DATA._C_objc_ivar
    Mem: 0x011b6eadf-0x0120f22de        __LTC_DATA._C_cstring
    Mem: 0x0120f22de-0x01232e92d        __LTC_DATA._C_tconst
    Mem: 0x01232e92d-0x01257b342        __LTC_DATA._C_gcc_except_ta
    Mem: 0x01257b342-0x01265c5da        __LTC_DATA.__fix
LC 04: LC_SEGMENT_64              Mem: 0x012660000-0x12f28000    __LINKEDIT
LC 05: LC_ID_DYLIB               @rpath/AwemeCore.framework/AwemeCore
LC 06: LC_DYLD_INFO
       Rebase info: 350072 bytes at offset 231473152 (0xdcc0000-0xdd15778)
       Bind info:   292520 bytes at offset 231823224 (0xdd15778-0xdd5ce20)
       Weak info:   296   bytes at offset 0xdd5ce20
       Lazy info:   101024 bytes at offset 232116040 (0xdd5cf48-0xdd759e8)
       Export info: 384   bytes at offset 232217064 (0xdd759e8-0xdd75b68)
LC 07: LC_SYMTAB
LC 08: LC_DYSYMTAB
        1 local symbols at index     0
       No external symbols
     5029 undefined symbols at index 1
       No TOC
       No modtab
     7248 Indirect symbols at offset 0xdfa63c0
LC 09: LC_UUID                   UUID: F1FCF15A-6465-31F0-9300-5BA1B8F91017
LC 10: LC_VERSION_MIN_IPHONEOS    Minimum iOS version:    10.0.0
LC 11: LC_SOURCE_VERSION         Source Version:          0.0.0.0.0
LC 12: LC_ENCRYPTION_INFO_64     Encryption: 0 from offset 32768 spanning 3112960 bytes
LC 13: LC_LOAD_DYLIB             /usr/lib/libcompression.dylib
LC 14: LC_LOAD_DYLIB             @rpath/BDLRepairer.framework/BDLRepairer
LC 15: LC_LOAD_DYLIB             /usr/lib/libc++.1.dylib
LC 16: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/AdServices.framework/AdServices
LC 17: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/AppTrackingTransparency.framework/AppTrackingTransparency
LC 18: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/AuthenticationServices.framework/AuthenticationServices
LC 19: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/CoreHaptics.framework/CoreHaptics
LC 20: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/CoreTelephony.framework/CoreTelephony
LC 21: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/MetalKit.framework/MetalKit
LC 22: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/MetalPerformanceShaders.framework/MetalPerformanceShaders
LC 23: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/MetricKit.framework/MetricKit
LC 24: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/StoreKit.framework/StoreKit
LC 25: LC_LOAD_DYLIB             @rpath/VolcEngineRTC.framework/VolcEngineRTC
LC 26: LC_LOAD_DYLIB             @rpath/byteaudio.framework/byteaudio
LC 27: LC_LOAD_DYLIB             /usr/lib/libbz2.1.0.dylib
LC 28: LC_LOAD_DYLIB             /usr/lib/libc++abi.dylib
LC 29: LC_LOAD_DYLIB             /usr/lib/libiconv.2.dylib
LC 30: LC_LOAD_DYLIB             /usr/lib/libicucore.A.dylib
LC 31: LC_LOAD_DYLIB             /usr/lib/liblzma.5.dylib
LC 32: LC_LOAD_DYLIB             /usr/lib/libSystem.B.dylib
LC 33: LC_LOAD_DYLIB             /usr/lib/libresolv.9.dylib
LC 34: LC_LOAD_DYLIB             /usr/lib/libsqlite3.dylib
LC 35: LC_LOAD_DYLIB             /usr/lib/libxml2.2.dylib
LC 36: LC_LOAD_DYLIB             /usr/lib/libz.1.dylib
LC 37: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/ARKit.framework/ARKit
LC 38: LC_LOAD_DYLIB             /System/Library/Frameworks/AVFoundation.framework/AVFoundation
LC 39: LC_LOAD_DYLIB             /System/Library/Frameworks/AVKit.framework/AVKit
LC 40: LC_LOAD_DYLIB             /System/Library/Frameworks/Accelerate.framework/Accelerate
LC 41: LC_LOAD_DYLIB             /System/Library/Frameworks/AdSupport.framework/AdSupport
LC 42: LC_LOAD_DYLIB             /System/Library/Frameworks/AddressBook.framework/AddressBook
LC 43: LC_LOAD_DYLIB             /System/Library/Frameworks/AssetsLibrary.framework/AssetsLibrary
LC 44: LC_LOAD_DYLIB             /System/Library/Frameworks/AudioToolbox.framework/AudioToolbox
LC 45: LC_LOAD_DYLIB             /System/Library/Frameworks/CFNetwork.framework/CFNetwork
LC 46: LC_LOAD_DYLIB             /System/Library/Frameworks/Contacts.framework/Contacts
LC 47: LC_LOAD_DYLIB             /System/Library/Frameworks/ContactsUI.framework/ContactsUI
LC 48: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreAudio.framework/CoreAudio
LC 49: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreAudioKit.framework/CoreAudioKit
LC 50: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation
LC 51: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreGraphics.framework/CoreGraphics
LC 52: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreImage.framework/CoreImage
LC 53: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreLocation.framework/CoreLocation
LC 54: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/CoreML.framework/CoreML
LC 55: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreMedia.framework/CoreMedia
LC 56: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreMotion.framework/CoreMotion
LC 57: LC_LOAD_DYLIB             /System/Library/Frameworks/MobileCoreServices.framework/MobileCoreServices
LC 58: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlight
LC 59: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreText.framework/CoreText
LC 60: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreVideo.framework/CoreVideo
LC 61: LC_LOAD_DYLIB             /System/Library/Frameworks/EventKit.framework/EventKit
LC 62: LC_LOAD_DYLIB             /System/Library/Frameworks/Foundation.framework/Foundation
LC 63: LC_LOAD_DYLIB             /System/Library/Frameworks/GLKit.framework/GLKit
LC 64: LC_LOAD_DYLIB             /System/Library/Frameworks/GameplayKit.framework/GameplayKit
LC 65: LC_LOAD_DYLIB             /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
LC 66: LC_LOAD_DYLIB             /System/Library/Frameworks/ImageIO.framework/ImageIO
LC 67: LC_LOAD_DYLIB             /System/Library/Frameworks/Intents.framework/Intents
LC 68: LC_LOAD_DYLIB             /System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore
LC 69: LC_LOAD_DYLIB             /System/Library/Frameworks/LocalAuthentication.framework/LocalAuthentication
LC 70: LC_LOAD_DYLIB             /System/Library/Frameworks/MapKit.framework/MapKit
LC 71: LC_LOAD_DYLIB             /System/Library/Frameworks/MediaAccessibility.framework/MediaAccessibility
LC 72: LC_LOAD_DYLIB             /System/Library/Frameworks/MediaPlayer.framework/MediaPlayer
LC 73: LC_LOAD_DYLIB             /System/Library/Frameworks/MediaToolbox.framework/MediaToolbox
LC 74: LC_LOAD_DYLIB             /System/Library/Frameworks/MessageUI.framework/MessageUI
LC 75: LC_LOAD_DYLIB             /System/Library/Frameworks/Metal.framework/Metal
LC 76: LC_LOAD_DYLIB             /System/Library/Frameworks/NetworkExtension.framework/NetworkExtension
LC 77: LC_LOAD_DYLIB             /System/Library/Frameworks/OpenAL.framework/OpenAL
LC 78: LC_LOAD_DYLIB             /System/Library/Frameworks/OpenGLES.framework/OpenGLES
LC 79: LC_LOAD_DYLIB             /System/Library/Frameworks/Photos.framework/Photos
LC 80: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/PhotosUI.framework/PhotosUI
LC 81: LC_LOAD_DYLIB             /System/Library/Frameworks/QuartzCore.framework/QuartzCore
LC 82: LC_LOAD_DYLIB             /System/Library/Frameworks/ReplayKit.framework/ReplayKit
LC 83: LC_LOAD_DYLIB             /System/Library/Frameworks/SafariServices.framework/SafariServices
LC 84: LC_LOAD_DYLIB             /System/Library/Frameworks/Security.framework/Security
LC 85: LC_LOAD_DYLIB             /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration
LC 86: LC_LOAD_DYLIB             /System/Library/Frameworks/UIKit.framework/UIKit
LC 87: LC_LOAD_DYLIB             /System/Library/Frameworks/VideoToolbox.framework/VideoToolbox
LC 88: LC_LOAD_DYLIB             /System/Library/Frameworks/WebKit.framework/WebKit
LC 89: LC_LOAD_DYLIB             /System/Library/Frameworks/iAd.framework/iAd
LC 90: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/QuickLook.framework/QuickLook
LC 91: LC_LOAD_DYLIB             /usr/lib/libobjc.A.dylib
LC 92: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/Combine.framework/Combine
LC 93: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/GroupActivities.framework/GroupActivities
LC 94: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/IOSurface.framework/IOSurface
LC 95: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/UserNotifications.framework/UserNotifications
LC 96: LC_LOAD_WEAK_DYLIB        /System/Library/Frameworks/WidgetKit.framework/WidgetKit
LC 97: LC_LOAD_WEAK_DYLIB        /usr/lib/swift/libswiftCoreMIDI.dylib
LC 98: LC_LOAD_WEAK_DYLIB        /usr/lib/swift/libswiftDataDetection.dylib
LC 99: LC_LOAD_WEAK_DYLIB        /usr/lib/swift/libswiftFileProvider.dylib
LC 100: LC_LOAD_WEAK_DYLIB        /usr/lib/swift/libswiftUniformTypeIdentifiers.dylib
LC 101: LC_LOAD_WEAK_DYLIB        /usr/lib/swift/libswiftWebKit.dylib
LC 102: LC_LOAD_WEAK_DYLIB        /usr/lib/swift/libswift_Concurrency.dylib
LC 103: LC_LOAD_WEAK_DYLIB        @rpath/libswiftAVFoundation.dylib
LC 104: LC_LOAD_DYLIB             @rpath/libswiftCore.dylib
LC 105: LC_LOAD_WEAK_DYLIB        @rpath/libswiftCoreAudio.dylib
LC 106: LC_LOAD_WEAK_DYLIB        @rpath/libswiftCoreData.dylib
LC 107: LC_LOAD_WEAK_DYLIB        @rpath/libswiftCoreFoundation.dylib
LC 108: LC_LOAD_DYLIB             @rpath/libswiftCoreGraphics.dylib
LC 109: LC_LOAD_WEAK_DYLIB        @rpath/libswiftCoreImage.dylib
LC 110: LC_LOAD_WEAK_DYLIB        @rpath/libswiftCoreLocation.dylib
LC 111: LC_LOAD_WEAK_DYLIB        @rpath/libswiftCoreMedia.dylib
LC 112: LC_LOAD_WEAK_DYLIB        @rpath/libswiftDarwin.dylib
LC 113: LC_LOAD_DYLIB             @rpath/libswiftDispatch.dylib
LC 114: LC_LOAD_DYLIB             @rpath/libswiftFoundation.dylib
LC 115: LC_LOAD_WEAK_DYLIB        @rpath/libswiftIntents.dylib
LC 116: LC_LOAD_WEAK_DYLIB        @rpath/libswiftMapKit.dylib
LC 117: LC_LOAD_WEAK_DYLIB        @rpath/libswiftMetal.dylib
LC 118: LC_LOAD_WEAK_DYLIB        @rpath/libswiftNetwork.dylib
LC 119: LC_LOAD_DYLIB             @rpath/libswiftObjectiveC.dylib
LC 120: LC_LOAD_WEAK_DYLIB        @rpath/libswiftPhotos.dylib
LC 121: LC_LOAD_WEAK_DYLIB        @rpath/libswiftQuartzCore.dylib
LC 122: LC_LOAD_DYLIB             @rpath/libswiftUIKit.dylib
LC 123: LC_LOAD_WEAK_DYLIB        @rpath/libswiftos.dylib
LC 124: LC_LOAD_WEAK_DYLIB        @rpath/libswiftsimd.dylib
LC 125: LC_RPATH                  /usr/lib/swift
LC 126: LC_RPATH                  @executable_path/Frameworks
LC 127: LC_RPATH                  @loader_path/Frameworks
LC 128: LC_RPATH                  @executable_path/../../Frameworks
LC 129: LC_RPATH                  @executable_path/Frameworks
LC 130: LC_FUNCTION_STARTS        Offset: 232217448, Size: 2214096 (0xdd75b68-0xdf92438)
LC 131: LC_DATA_IN_CODE           Offset: 234431544, Size:   1320 (0xdf92438-0xdf92960)
LC 132: LC_CODE_SIGNATURE         Offset: 234688704, Size: 5977904 (0xdfd10c0-0xe5847f0)

-L：查看使用了哪些共享库Library

jtool2 -L v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore

输出内容：

➜  AwemeCore jtool2 -L ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore
Warning! Too many symbols! This can easily be fixed by J - tell him, please
../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore:
    /usr/lib/libcompression.dylib (compatibility version 1.0.0, current version 1.0.0)
    @rpath/BDLRepairer.framework/BDLRepairer (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 1200.3.0)
    /System/Library/Frameworks/AdServices.framework/AdServices (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AppTrackingTransparency.framework/AppTrackingTransparency (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AuthenticationServices.framework/AuthenticationServices (compatibility version 1.0.0, current version 612.1.27)
    /System/Library/Frameworks/CoreHaptics.framework/CoreHaptics (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreTelephony.framework/CoreTelephony (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/MetalKit.framework/MetalKit (compatibility version 1.0.0, current version 153.0.0)
    /System/Library/Frameworks/MetalPerformanceShaders.framework/MetalPerformanceShaders (compatibility version 1.0.0, current version 125.0.31)
    /System/Library/Frameworks/MetricKit.framework/MetricKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/StoreKit.framework/StoreKit (compatibility version 1.0.0, current version 1.0.0)
    @rpath/VolcEngineRTC.framework/VolcEngineRTC (compatibility version 1.0.0, current version 323.0.0)
    @rpath/byteaudio.framework/byteaudio (compatibility version 1.0.0, current version 1.0.1)
    /usr/lib/libbz2.1.0.dylib (compatibility version 1.0.0, current version 1.0.8)
    /usr/lib/libc++abi.dylib (compatibility version 1.0.0, current version 1200.3.0)
    /usr/lib/libiconv.2.dylib (compatibility version 7.0.0, current version 7.0.0)
    /usr/lib/libicucore.A.dylib (compatibility version 1.0.0, current version 68.2.0)
    /usr/lib/liblzma.5.dylib (compatibility version 6.0.0, current version 6.3.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1311.0.0)
    /usr/lib/libresolv.9.dylib (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libsqlite3.dylib (compatibility version 9.0.0, current version 329.0.0)
    /usr/lib/libxml2.2.dylib (compatibility version 10.0.0, current version 10.9.0)
    /usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)
    /System/Library/Frameworks/ARKit.framework/ARKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AVFoundation.framework/AVFoundation (compatibility version 1.0.0, current version 2.0.0)
    /System/Library/Frameworks/AVKit.framework/AVKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Accelerate.framework/Accelerate (compatibility version 1.0.0, current version 4.0.0)
    /System/Library/Frameworks/AdSupport.framework/AdSupport (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AddressBook.framework/AddressBook (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AssetsLibrary.framework/AssetsLibrary (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AudioToolbox.framework/AudioToolbox (compatibility version 1.0.0, current version 1000.0.0)
    /System/Library/Frameworks/CFNetwork.framework/CFNetwork (compatibility version 1.0.0, current version 1312.0.0)
    /System/Library/Frameworks/Contacts.framework/Contacts (compatibility version 0.0.0, current version 3529.0.0)
    /System/Library/Frameworks/ContactsUI.framework/ContactsUI (compatibility version 1.0.0, current version 1141.1.0)
    /System/Library/Frameworks/CoreAudio.framework/CoreAudio (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreAudioKit.framework/CoreAudioKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1854.0.0)
    /System/Library/Frameworks/CoreGraphics.framework/CoreGraphics (compatibility version 64.0.0, current version 1548.1.3)
    /System/Library/Frameworks/CoreImage.framework/CoreImage (compatibility version 1.0.0, current version 5.0.0)
    /System/Library/Frameworks/CoreLocation.framework/CoreLocation (compatibility version 1.0.0, current version 2663.0.3)
    /System/Library/Frameworks/CoreML.framework/CoreML (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreMedia.framework/CoreMedia (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreMotion.framework/CoreMotion (compatibility version 1.0.0, current version 2663.0.3)
    /System/Library/Frameworks/MobileCoreServices.framework/MobileCoreServices (compatibility version 1.0.0, current version 1141.1.0)
    /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlight (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreText.framework/CoreText (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreVideo.framework/CoreVideo (compatibility version 1.2.0, current version 1.5.0)
    /System/Library/Frameworks/EventKit.framework/EventKit (compatibility version 1.0.0, current version 1716.0.0)
    /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1854.0.0)
    /System/Library/Frameworks/GLKit.framework/GLKit (compatibility version 1.0.0, current version 126.0.0)
    /System/Library/Frameworks/GameplayKit.framework/GameplayKit (compatibility version 1.0.0, current version 96.1.0)
    /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
    /System/Library/Frameworks/ImageIO.framework/ImageIO (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Intents.framework/Intents (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore (compatibility version 1.0.0, current version 612.1.27)
    /System/Library/Frameworks/LocalAuthentication.framework/LocalAuthentication (compatibility version 1.0.0, current version 984.10.2)
    /System/Library/Frameworks/MapKit.framework/MapKit (compatibility version 1.0.0, current version 14.0.0)
    /System/Library/Frameworks/MediaAccessibility.framework/MediaAccessibility (compatibility version 1.0.0, current version 62.0.0)
    /System/Library/Frameworks/MediaPlayer.framework/MediaPlayer (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MediaToolbox.framework/MediaToolbox (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MessageUI.framework/MessageUI (compatibility version 1.0.0, current version 3693.0.2)
    /System/Library/Frameworks/Metal.framework/Metal (compatibility version 1.0.0, current version 257.25.0)
    /System/Library/Frameworks/NetworkExtension.framework/NetworkExtension (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/OpenAL.framework/OpenAL (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/OpenGLES.framework/OpenGLES (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Photos.framework/Photos (compatibility version 1.0.0, current version 402.5.140)
    /System/Library/Frameworks/PhotosUI.framework/PhotosUI (compatibility version 1.0.0, current version 402.5.140)
    /System/Library/Frameworks/QuartzCore.framework/QuartzCore (compatibility version 1.2.0, current version 1.11.0)
    /System/Library/Frameworks/ReplayKit.framework/ReplayKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/SafariServices.framework/SafariServices (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Security.framework/Security (compatibility version 1.0.0, current version 60157.12.1)
    /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration (compatibility version 1.0.0, current version 1163.10.2)
    /System/Library/Frameworks/UIKit.framework/UIKit (compatibility version 1.0.0, current version 5067.3.107)
    /System/Library/Frameworks/VideoToolbox.framework/VideoToolbox (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/WebKit.framework/WebKit (compatibility version 1.0.0, current version 612.1.27)
    /System/Library/Frameworks/iAd.framework/iAd (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/QuickLook.framework/QuickLook (compatibility version 1.0.0, current version 846.1.0)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /System/Library/Frameworks/Combine.framework/Combine (compatibility version 1.0.0, current version 276.0.0)
    /System/Library/Frameworks/GroupActivities.framework/GroupActivities (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/IOSurface.framework/IOSurface (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/UserNotifications.framework/UserNotifications (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/WidgetKit.framework/WidgetKit (compatibility version 1.0.0, current version 181.0.0)
    /usr/lib/swift/libswiftCoreMIDI.dylib (compatibility version 1.0.0, current version 5.0.0)
    /usr/lib/swift/libswiftDataDetection.dylib (compatibility version 1.0.0, current version 694.0.0)
    /usr/lib/swift/libswiftFileProvider.dylib (compatibility version 1.0.0, current version 374.1.2)
    /usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 718.0.0)
    /usr/lib/swift/libswiftWebKit.dylib (compatibility version 1.0.0, current version 612.1.27)
    /usr/lib/swift/libswift_Concurrency.dylib (compatibility version 1.0.0, current version 1300.0.29)
    @rpath/libswiftAVFoundation.dylib (compatibility version 1.0.0, current version 2036.25.1)
    @rpath/libswiftCore.dylib (compatibility version 1.0.0, current version 1300.0.29)
    @rpath/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 1.1.0)
    @rpath/libswiftCoreData.dylib (compatibility version 1.0.0, current version 18.0.0)
    @rpath/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 14.0.0)
    @rpath/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 3.0.0)
    @rpath/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0)
    @rpath/libswiftCoreLocation.dylib (compatibility version 1.0.0, current version 6.0.0)
    @rpath/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 2896.25.1)
    @rpath/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0)
    @rpath/libswiftDispatch.dylib (compatibility version 1.0.0, current version 9.0.0)
    @rpath/libswiftFoundation.dylib (compatibility version 1.0.0, current version 69.0.0)
    @rpath/libswiftIntents.dylib (compatibility version 1.0.0, current version 11.0.0)
    @rpath/libswiftMapKit.dylib (compatibility version 1.0.0, current version 3.0.0)
    @rpath/libswiftMetal.dylib (compatibility version 1.0.0, current version 257.25.1)
    @rpath/libswiftNetwork.dylib (compatibility version 1.0.0, current version 2736.12.1)
    @rpath/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 2.0.0)
    @rpath/libswiftPhotos.dylib (compatibility version 1.0.0, current version 402.5.140)
    @rpath/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0)
    @rpath/libswiftUIKit.dylib (compatibility version 1.0.0, current version 5038.0.0)
    @rpath/libswiftos.dylib (compatibility version 1.0.0, current version 1021.0.0)
    @rpath/libswiftsimd.dylib (compatibility version 1.0.0, current version 9.0.0)

-S: 列出符号表Symbol == nm

jtool2 -S v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore > AwemeCore_jtool2_S.txt

输出内容：

--analyze: 分析analyze -> 导出类和函数名等

jtool2 --analyze v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore

输出log：

➜  AwemeCore jtool2 --analyze ../../../../已脱壳/v18.9.0/Payload/Aweme.app/Frameworks/AwemeCore.framework/AwemeCore
Analyzing file...
Warning! Too many symbols! This can easily be fixed by J - tell him, please
Resolving stubs..
Processing __DATA..
opened companion file ./AwemeCore.ARM64.F1FCF15A-6465-31F0-9300-5BA1B8F91017
Dumping symbol cache to file
Symbolicated 144477 symbols and 355043 functions

输出内容：

0x8|_$s10Foundation25NSFastEnumerationIteratorVStAAMc|
0x10|_$s10Foundation3URLVMn|
0x18|_$s10Foundation4DataVN|
...
0x20|_$s10Foundation4DateVMn|
0x28|_$s10Foundation9IndexPathVMa|
0x30|_$s10Foundation9IndexPathVMn|
0x38|_$s10Foundation9IndexPathVSEAAMc|
0x40|_$s10Foundation9IndexPathVSQAAMc|
0x48|_$s10Foundation9IndexPathVSeAAMc|
0x50|_$s10ObjectiveC8ObjCBoolVMn|
0x58|_$s12CoreGraphics14CGPathFillRuleO7windingyA2CmFWC|
0x60|_$s12CoreGraphics7CGFloatVMn|
0x68|_$s12CoreGraphics7CGFloatVN|
0xd8|_$s15GroupActivities0A13StateObserverCMn|
0xe0|_$s15GroupActivities0A16ActivityMetadataVMa|
0xe8|_$s15GroupActivities0A16ActivityMetadataVMn|
0xf0|_$s15GroupActivities0A16ActivityMetadataVSEAAMc|
0xf8|_$s15GroupActivities0A16ActivityMetadataVSeAAMc|
0x100|_$s15GroupActivities0A16SessionMessengerC14MessageContextVMn|
0x108|_$s15GroupActivities0A16SessionMessengerC4send_2toyx_AA12ParticipantsOtYaKSeRzSERzlFTu|
0x110|_$s15GroupActivities0A16SessionMessengerC8MessagesV8IteratorVMa|
0x118|_$s15GroupActivities0A16SessionMessengerC8MessagesV8IteratorVMn|
0x120|_$s15GroupActivities0A16SessionMessengerC8MessagesV8IteratorVy_x_GScIAAMc|
0x128|_$s15GroupActivities0A16SessionMessengerC8MessagesVMa|
0x130|_$s15GroupActivities0A16SessionMessengerC8MessagesVMn|
0x138|_$s15GroupActivities0A16SessionMessengerC8MessagesVy_xGSciAAMc|
0x140|_$s15GroupActivities0A16SessionMessengerCMn|
0x148|_$s15GroupActivities0A24ActivityActivationResultO18activationDisabledyA2CmFWC|
0x150|_$s15GroupActivities0A24ActivityActivationResultO19activationPreferredyA2CmFWC|
0x158|_$s15GroupActivities0A24ActivityActivationResultO9cancelledyA2CmFWC|
0x160|_$s15GroupActivities0A7SessionC3endyyF|
0x168|_$s15GroupActivities0A7SessionC5StateO11invalidatedyAEyx_Gs5Error_p_tcAGmAA0A8ActivityRzlFWC|
0x170|_$s15GroupActivities0A7SessionC5leaveyyF|
0x178|_$s15GroupActivities0A7SessionC8SessionsV8IteratorVyx__GScIAAMc|
0x180|_$s15GroupActivities0A7SessionC8SessionsVyx_GSciAAMc|
0x188|_$s15GroupActivities0A7SessionCMa|
0x190|_$s15GroupActivities0A7SessionCMn|
0x1a0|_$s15GroupActivities0A8ActivityPAAE20prepareForActivationAA0acF6ResultOyYaFTu|
0x1a8|_$s15GroupActivities0A8ActivityPAAE8activateSbyYaKFTu|
0x1b0|_$s15GroupActivities11ParticipantVMa|
0x1b8|_$s15GroupActivities11ParticipantVMn|
0x1c0|_$s15GroupActivities11ParticipantVSHAAMc|
0x1c8|_$s15GroupActivities12ParticipantsO3allyA2CmFWC|
0x348|_$s7Combine10PublishersO16RemoveDuplicatesVMn|
0x350|_$s7Combine10PublishersO16RemoveDuplicatesVy_xGAA9PublisherAAMc|
0x358|_$s7Combine10PublishersO3MapVMn|
0x360|_$s7Combine10PublishersO3MapVy_xq_GAA9PublisherAAMc|
0x368|_$s7Combine10PublishersO4DropVMn|
0x370|_$s7Combine10PublishersO4DropVy_xGAA9PublisherAAMc|
0x378|_$s7Combine10PublishersO9ReceiveOnVMn|
0x380|_$s7Combine10PublishersO9ReceiveOnVy_xq_GAA9PublisherAAMc|
0x388|_$s7Combine14AnyCancellableCMn|
0x390|_$s7Combine9PublishedV9PublisherVMa|
0x398|_$s7Combine9PublishedV9PublisherVMn|
0x3a0|_$s7Combine9PublishedV9PublisherVyx_GAadAMc|
0x3a8|_$s7Combine9PublishedVMa|
0x3b0|_$s7Combine9PublishedVMn|
0x3c8|_$s8Dispatch0A12TimeIntervalO12millisecondsyACSicACmFWC|
0x3d0|_$s8Dispatch0A13WorkItemFlagsVMa|
0x3d8|_$s8Dispatch0A13WorkItemFlagsVMn|
0x3e0|_$s8Dispatch0A13WorkItemFlagsVs10SetAlgebraAAMc|
0x3e8|_$s8Dispatch0A3QoSV0B6SClassO7defaultyA2EmFWC|
0x400|_$sBbWV|
0x410|_$sSDMn|
...
0xc1ae6f8|-[APMobileIdentifier IMSI]|
0xc1ae704|-[APMobileIdentifier IMEI]|
0xc1ae710|-[APMobileIdentifier TID]|
0xc1ae71c|-[APMobileIdentifier deviceFingerprint]|
0xc1ae728|-[APMobileIdentifier UTDID]|
0xc1ae734|-[APMobileIdentifier setUTDID:]|
0xc1ae73c|-[APMobileIdentifier UUID]|
0xc1ae748|-[APMobileIdentifier setUUID:]|
0xc1ae750|-[APMobileIdentifier AWID]|
0xc1ae75c|-[APMobileIdentifier clientId]|
0xc1ae768|-[APMobileIdentifier .cxx_destruct]|
0xc5e5bc8|-[LynxView setAdInfoDict:]|
0xc5e5bd8|-[LynxView adInfoDict]|
0xc94fb00|-[LynxView model]|
0xc94fb04|-[LynxView setModel:]|
0xe20a878|-[LynxView awelynx_initWithBuilderBlock:]|
0xea2140c|-[CanvasAPI measureText:fontSize:]|
0xea21570|-[CanvasAPI drawSync:actions:]|
0xea21684|-[CanvasAPI release:]|
0xea23408|-[CanvasViewManager view]|
0xea23504|-[CanvasViewManager set_nativeID:forView:withDefaultView:]|
0xea235e8|-[CanvasViewManager set_actions:forView:withDefaultView:]|
0xea38bd4|-[AWERCTFoundationAPIManager init]|
0xea38c54|-[AWERCTFoundationAPIManager showToast:]|
0xea38c74|-[AWERCTFoundationAPIManager logCrash:]|
0xea38d20|-[AWERCTFoundationAPIManager logEventV1:label:value:extraValue:extras:]|
0xea38de0|-[AWERCTFoundationAPIManager logEventV3:parameters:]|
0xea38e60|-[AWERCTFoundationAPIManager getUserInfo:]|
0xea38e78|-[AWERCTFoundationAPIManager getRequestDomain:callback:]|
0xea3904c|-[AWERCTFoundationAPIManager getNetworkParams:]|
0xea3918c|-[AWERCTFoundationAPIManager getLocale:]|
0xea39298|-[AWERCTFoundationAPIManager request:info:callback:]|
0xea3a0dc|-[AWERCTFoundationAPIManager openScene:sceneName:initProperties:callback:]|
0xea3a274|-[AWERCTFoundationAPIManager openH5Page:URLString:controlFlags:callback:]|
0xea3a41c|-[AWERCTFoundationAPIManager openSchema:schemeURL:callback:]|
0xea3a7fc|-[AWERCTFoundationAPIManager pushViewController:withReactID:callback:]|
0xea3a910|-[AWERCTFoundationAPIManager closeWithResult:result:callback:]|
0xea3a92c|-[AWERCTFoundationAPIManager close:callback:]|
0xea3a938|-[AWERCTFoundationAPIManager closeReactID:callback:]|
0xea3b048|-[AWERCTFoundationAPIManager darkMode:enable:]|
0xea3b180|-[AWERCTFoundationAPIManager componentDidMount:]|
0xea3b268|-[AWERCTFoundationAPIManager webVCWithRouterParams:]|
0xea3b2c8|-[AWERCTFoundationAPIManager getUserInfoWithCallBack:]|
0xea3b600|-[AWERCTFoundationAPIManager schemaHandler]|
0xea3b608|-[AWERCTFoundationAPIManager setSchemaHandler:]|
0xea3b614|-[AWERCTFoundationAPIManager .cxx_destruct]|
0xf56fd94|-[WCTDatabase studio_recoverFromPath:withPageSize:backupCipher:databaseCipher:error:]|
0x105b540c|-[LynxView lynxBridgeContext]|
0x105b5418|-[LynxView setLynxBridgeContext:]|
0x105e25a4|-[LynxView bdx_engineType]|
0x105e25ec|-[LynxView bdx_dealloc]|
0x105f0d50|-[LynxView isBDXCreated]|
0x105f0d94|-[LynxView setIsBDXCreated:]|
0x11227850|-[LynxLayoutNode turboNativeLayoutNode]|
0x11227974|-[LynxLayoutNode adoptNativeLayoutNode:]|
0x112279e8|-[LynxLayoutNode setMeasureDelegate:]|
0x11227a24|-[LynxLayoutNode updateLayoutWithFrame:]|
0x11227a4c|-[LynxLayoutNode setNeedsLayout]|
0x11227a68|-[LynxLayoutNode needsLayout]|
0x11227a7c|-[LynxLayoutNode layoutDidStart]|
0x11227a80|-[LynxLayoutNode layoutDidUpdate]|
0x11227a84|-[LynxLayoutNode hasCustomLayout]|
0x11227a8c|-[LynxLayoutNode frame]|
0x11227aa4|-[LynxLayoutNode padding]|
0x11227abc|-[LynxLayoutNode margin]|
0x11227ad4|-[LynxLayoutNode border]|
0x11227aec|-[LynxLayoutNode style]|
0x11227afc|-[LynxLayoutNode measureDelegate]|
0x11227b1c|-[LynxLayoutNode .cxx_destruct]|
0x112350a0|-[LynxUI drawParameter]|
0x11235150|-[LynxUI enableAsyncDisplay]|
0x11235210|-[LynxUI displayAsynchronously]|
0x1123539c|-[LynxUI displayComplexBackgroundAsynchronouslyWithDisplay:completion:]|
0x1123559c|-[LynxUI displayAsyncWithCompletionBlock:]|
0x11239d48|-[LynxUIImage init]|
0x11239dfc|-[LynxUIImage createView]|
0x11239e68|-[LynxUIImage onImageReady:]|
0x1123a44c|-[LynxUIImage updateLayerMaskOnFrameChangedInner:]|
0x1123a934|-[LynxUIImage updateLayerMaskOnFrameChanged]|
0x1123a9b0|-[LynxUIImage frameDidChange]|
0x1123aa00|-[LynxUIImage propsDidUpdate]|
0x1123aa50|-[LynxUIImage enableAsyncDisplay]|
0x1123aa64|-[LynxUIImage requestImage]|
0x1123aab4|-[LynxUIImage getEnableImageDownsampling]|
0x1123ab48|-[LynxUIImage requestImage:]|
0x1123b9ec|-[LynxUIImage reportURLSrcError:type:source:]|
0x1123bd38|-[LynxUIImage resetImage]|
0x1123be74|-[LynxUIImage setSrc:requestReset:]|
0x1123c0c4|-[LynxUIImage setPlaceholder:requestReset:]|
0x1123c220|-[LynxUIImage setMode:requestReset:]|
0x1123c378|-[LynxUIImage setCoverStart:requestReset:]|
0x1123c420|-[LynxUIImage setBlurRadius:requestReset:]|
0x1123c678|-[LynxUIImage setInnerCapInsets:requestReset:]|
0x1123c92c|-[LynxUIImage setCapInsets:requestReset:]|
0x1123c9c0|-[LynxUIImage setCapInsetsScale:requestReset:]|
0x1123ca8c|-[LynxUIImage setLoopCount:requestReset:]|
0x1123cb28|-[LynxUIImage setPreFetchWidth:requestReset:]|
0x1123cc7c|-[LynxUIImage setPreFetchHeight:requestReset:]|
0x1123cdd0|-[LynxUIImage setDownsampling:requestReset:]|
0x1123ce6c|-[LynxUIImage setAutoSize:requestReset:]|
0x1123ce80|-[LynxUIImage toCapInsetValue:]|
0x1123d010|-[LynxUIImage frameSize]|
0x1123d038|-[LynxUIImage drawParameter]|
0x1123d758|-[LynxUIImage restartAnimation]|
0x1123d7a8|-[LynxUIImage isAnimated]|
0x1123d804|-[LynxUIImage enableAccessibilityByDefault]|
0x1123d80c|-[LynxUIImage startAnimating]|
0x1123d84c|-[LynxUIImage measureNode:withWidth:widthMode:height:heightMode:]|
0x1123d9dc|-[LynxUIImage accessibilityTraitsByDefault]|
0x1123d9ec|-[LynxUIImage resizeMode]|
0x1123d9fc|-[LynxUIImage setResizeMode:]|
0x1123da0c|-[LynxUIImage coverStart]|
0x1123da1c|-[LynxUIImage setCoverStart:]|
0x1123da2c|-[LynxUIImage src]|
0x1123da3c|-[LynxUIImage setSrc:]|
0x1123da50|-[LynxUIImage placeholder]|
0x1123da60|-[LynxUIImage setPlaceholder:]|
0x1123da74|-[LynxUIImage blurRadius]|
0x1123da84|-[LynxUIImage setBlurRadius:]|
0x1123da94|-[LynxUIImage capInsets]|
0x1123daac|-[LynxUIImage setCapInsets:]|
0x1123dac4|-[LynxUIImage capInsetsScale]|
0x1123dad4|-[LynxUIImage setCapInsetsScale:]|
0x1123dae4|-[LynxUIImage image]|
0x1123daf4|-[LynxUIImage setImage:]|
0x1123db08|-[LynxUIImage cancelBlocks]|
0x1123db18|-[LynxUIImage setCancelBlocks:]|
0x1123db2c|-[LynxUIImage loopCount]|
0x1123db3c|-[LynxUIImage setLoopCount:]|
0x1123db4c|-[LynxUIImage preFetchWidth]|
0x1123db5c|-[LynxUIImage setPreFetchWidth:]|
0x1123db6c|-[LynxUIImage preFetchHeight]|
0x1123db7c|-[LynxUIImage setPreFetchHeight:]|
0x1123db8c|-[LynxUIImage downsampling]|
0x1123db9c|-[LynxUIImage setDownsampling:]|
0x1123dbac|-[LynxUIImage autoSize]|
0x1123dbbc|-[LynxUIImage setAutoSize:]|
0x1123dbcc|-[LynxUIImage .cxx_destruct]|
0x1123fe18|-[LynxUIScroller init]|
0x1123fe94|-[LynxUIScroller createView]|
0x1123ff6c|-[LynxUIScroller adjustContentOffsetForRTL]|
0x11240148|-[LynxUIScroller layoutDidFinished]|
0x112401a0|-[LynxUIScroller updateContentSize]|
0x112405e4|-[LynxUIScroller contentOffset]|
0x11240640|-[LynxUIScroller setScrollY:requestReset:]|
0x1124065c|-[LynxUIScroller setScrollX:requestReset:]|
0x1124067c|-[LynxUIScroller setScrollYReverse:requestReset:]|
0x112407c8|-[LynxUIScroller setScrollXReverse:requestReset:]|
0x11240918|-[LynxUIScroller setScrollLeft:requestReset:]|
0x112409c8|-[LynxUIScroller setScrollTop:requestReset:]|
0x11240a6c|-[LynxUIScroller setScrollToIndex:requestReset:]|
0x11240c34|-[LynxUIScroller setScrollBarEnable:requestReset:]|
0x11240cbc|-[LynxUIScroller setBounces:requestReset:]|
0x11240d04|-[LynxUIScroller setEnableScroll:requestReset:]|
0x11240d4c|-[LynxUIScroller setUpperThreshold:requestReset:]|
0x11240d64|-[LynxUIScroller setLowerThreshold:requestReset:]|
0x11240d7c|-[LynxUIScroller getHitTestPoint:]|
0x11240eac|-[LynxUIScroller eventDidSet]|
0x1124106c|-[LynxUIScroller onScrollSticky:withOffsetY:]|
0x1124118c|-[LynxUIScroller sendScrollEvent:]|
0x1124149c|-[LynxUIScroller scrollViewDidScroll:]|
0x11241598|-[LynxUIScroller scrollViewDidEndDecelerating:]|
0x11241680|-[LynxUIScroller scrollViewDidEndDragging:willDecelerate:]|
0x1124176c|-[LynxUIScroller scrollInto:isSmooth:blockType:inlineType:]|
0x11241c64|-[LynxUIScroller sendScrollEvent:scrollTop:scollleft:scrollHeight:scrollWidth:deltaX:deltaY:]|
0x11241f30|-[LynxUIScroller contentSizeDidChanged]|
0x1124213c|-[LynxUIScroller clampScrollToPosition:]|
0x1124224c|-[LynxUIScroller scrollTo:withResult:]|
0x112424cc|-[LynxUIScroller autoScroll:withResult:]|
0x112425ac|-[LynxUIScroller startAutoScrollWithRate:]|
0x112426d4|-[LynxUIScroller stopAutoScroll]|
0x11242734|-[LynxUIScroller dealloc]|
0x112427b0|-[LynxUIScroller frameDidChange]|
0x1124286c|-[LynxUIScroller scrollLeftLimit]|
0x11242900|-[LynxUIScroller scrollRightLimit]|
0x112429fc|-[LynxUIScroller scrollUpLimit]|
0x11242a90|-[LynxUIScroller scrollDownLimit]|
0x11242b8c|-[LynxUIScroller canScroll:]|
0x11242cb8|-[LynxUIScroller scroll:direction:]|
0x11242e04|-[LynxUIScroller scrollByX:]|
0x11242e14|-[LynxUIScroller scrollByY:]|
0x11242e24|-[LynxUIScroller flick:direction:]|
0x11243054|-[LynxUIScroller flickX:]|
0x11243064|-[LynxUIScroller flickY:]|
0x11243074|-[LynxUIScroller enableSticky]|
0x11243084|-[LynxUIScroller setEnableSticky:]|
0x11243094|-[LynxUIScroller enableScrollY]|
0x112430a4|-[LynxUIScroller setEnableScrollY:]|
0x112430b4|-[LynxUIScroller .cxx_destruct]|
0x1124518c|-[LynxView initWithCoder:]|
0x11245224|-[LynxView onLongPress]|
0x11245250|-[LynxView init]|
0x11245260|-[LynxView initWithFrame:]|
0x112452d8|-[LynxView initWithBuilderBlock:]|
0x11245434|-[LynxView initWithoutRender]|
0x11245524|-[LynxView getLifecycleDispatcher]|
0x11245534|-[LynxView requestLayoutWhenSafepointEnable]|
0x11245538|-[LynxView updateScreenMetricsWithWidth:height:]|
0x11245550|-[LynxView updateFontScale:]|
0x11245570|-[LynxView initLifecycleDispatcher]|
0x11245644|-[LynxView loadTemplate:withURL:]|
0x11245654|-[LynxView loadTemplateFromURL:]|
0x11245664|-[LynxView loadTemplate:withURL:initData:]|
0x112457a8|-[LynxView dispatchError:]|
0x112458e0|-[LynxView loadTemplateFromURL:initData:]|
0x112459f8|-[LynxView hotModuleReplace:withPaths:]|
0x11245ad4|-[LynxView findUIByIndex:]|
0x11245b08|-[LynxView setGlobalPropsWithDictionary:]|
0x11245b7c|-[LynxView setGlobalPropsWithTemplateData:]|
0x11245bf0|-[LynxView updateDataWithString:]|
0x11245c00|-[LynxView updateDataWithString:processorName:]|
0x11245ca0|-[LynxView updateDataWithDictionary:]|
0x11245cb0|-[LynxView updateDataWithDictionary:processorName:]|
0x11245d50|-[LynxView updateDataWithTemplateData:]|
0x11245dc4|-[LynxView resetDataWithTemplateData:]|
0x11245e38|-[LynxView getCurrentData]|
0x11245e6c|-[LynxView onEnterForeground]|
0x11245f24|-[LynxView onEnterBackground]|
0x11245fd8|-[LynxView sendGlobalEvent:withParams:]|
0x11246078|-[LynxView sendGlobalEventToLepus:withParams:]|
0x11246118|-[LynxView setFrame:]|
0x1124614c|-[LynxView layoutSubviews]|
0x112461bc|-[LynxView invalidateIntrinsicContentSize]|
0x11246208|-[LynxView triggerLayout]|
0x11246234|-[LynxView setEnableRadonCompatible:]|
0x11246244|-[LynxView setEnableTextNonContiguousLayout:]|
0x11246254|-[LynxView enableTextNonContiguousLayout]|
0x112462cc|-[LynxView intrinsicContentSize]|
0x112462e0|-[LynxView setIntrinsicContentSize:]|
0x11246334|-[LynxView updateViewport]|
0x11246360|-[LynxView updateViewportWithPreferredLayoutWidth:preferredLayoutHeight:]|
0x11246370|-[LynxView updateViewportWithPreferredLayoutWidth:preferredLayoutHeight:needLayout:]|
0x112463f4|-[LynxView client]|
0x11246428|-[LynxView setClient:]|
0x112465d4|-[LynxView setImageFetcher:]|
0x11246664|-[LynxView setResourceFetcher:]|
0x112466f4|-[LynxView reset]|
0x11246824|-[LynxView dispatchViewDidStartLoading]|
0x112468c4|-[LynxView willMoveToWindow:]|
0x1124696c|-[LynxView didMoveToWindow]|
0x112469dc|-[LynxView tapOnUICalloutBarButton:withEvent:]|
0x11246de0|-[LynxView hitTest:withEvent:]|
0x112471cc|-[LynxView clearForDestroy]|
0x112474a8|-[LynxView dealloc]|
0x1124759c|-[LynxView viewWithName:]|
0x11247618|-[LynxView findViewWithName:]|
0x11247694|-[LynxView uiWithName:]|
0x11247710|-[LynxView viewWithIdSelector:]|
0x1124778c|-[LynxView uiWithIdSelector:]|
0x11247808|-[LynxView cardVersion]|
0x1124783c|-[LynxView lynxConfigInfo]|
0x1124788c|-[LynxView forceGetPerf]|
0x11247894|-[LynxView getJSModule:]|
0x11247910|-[LynxView getLynxRuntimeId]|
0x11247944|-[LynxView pauseRootLayoutAnimation]|
0x11247970|-[LynxView resumeRootLayoutAnimation]|
0x1124799c|-[LynxView addLifecycleClient:]|
0x112479fc|-[LynxView setTheme:]|
0x11247a70|-[LynxView theme]|
0x11247aa4|-[LynxView setEnableAsyncDisplay:]|
0x11247ad0|-[LynxView enableAsyncDisplay]|
0x11247af0|-[LynxView resetAnimation]|
0x11247b1c|-[LynxView restartAnimation]|
0x11247b48|-[LynxView layoutHeightMode]|
0x11247b6c|-[LynxView setLayoutHeightMode:]|
0x11247b98|-[LynxView layoutWidthMode]|
0x11247bbc|-[LynxView setLayoutWidthMode:]|
0x11247be8|-[LynxView preferredMaxLayoutWidth]|
0x11247c0c|-[LynxView setPreferredMaxLayoutWidth:]|
0x11247c38|-[LynxView preferredMaxLayoutHeight]|
0x11247c5c|-[LynxView setPreferredMaxLayoutHeight:]|
0x11247c88|-[LynxView preferredLayoutWidth]|
0x11247cac|-[LynxView setPreferredLayoutWidth:]|
0x11247cd8|-[LynxView preferredLayoutHeight]|
0x11247cfc|-[LynxView setPreferredLayoutHeight:]|
0x11247d28|-[LynxView url]|
0x11247d5c|-[LynxView baseInspectorOwner]|
0x11247e0c|-[LynxView detachRender]|
0x11247e24|-[LynxView attachTemplateRender:]|
0x11247ec0|-[LynxView processLayout:withURL:initData:]|
0x11247fa0|-[LynxView processRender]|
0x11248144|-[LynxView isLayoutFinish]|
0x1124815c|-[LynxView resetViewAndLayer]|
0x11248230|-[LynxView getAllJsSource]|
0x11248264|-[LynxView rootWidth]|
0x11248288|-[LynxView rootHeight]|
0x112482ac|-[LynxView isUIRunningMode]|
0x112482bc|-[LynxView imageFetcher]|
0x112482dc|-[LynxView resourceFetcher]|
0x112482fc|-[LynxView catchAllException]|
0x1124830c|-[LynxView setCatchAllException:]|
0x1124831c|-[LynxView attached]|
0x1124832c|-[LynxView setAttached:]|
0x1124833c|-[LynxView lifecycleDispatcher]|
0x1124834c|-[LynxView setLifecycleDispatcher:]|
0x11248360|-[LynxView templateRender]|
0x11248370|-[LynxView setTemplateRender:]|
0x11248384|-[LynxView .cxx_destruct]|

总体来说，还是有点用的。尤其是--analyze

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 11:40:54

MaskPro.dylib

jtool2用法举例：MaskPro.dylib

-h

➜  DynamicLibraries export ARCH=arm64
➜  DynamicLibraries jtool2 -h MaskPro.dylib > MaskProDylib/MaskProDylib_jtool2_h_header.txt

输出：

Magic:    64-bit MachO (Little Endian)
Type:    dylib
CPU:    ARM64 (ARMv8)
Cmds:    24
Size:    3304
Flags:    0x100085

-l

➜  DynamicLibraries jtool2 -l MaskPro.dylib > MaskProDylib/MaskProDylib_jtool2_l_list.txt

输出：

LC 00: LC_SEGMENT_64              Mem: 0x000000000-0x40000    __TEXT
    Mem: 0x0000078e4-0x00003e3e0        __TEXT.__text    (Normal)
    Mem: 0x00003e3e0-0x00003e5e4        __TEXT.__stubs    (Symbol Stubs)
    Mem: 0x00003e5e4-0x00003e800        __TEXT.__stub_helper    (Normal)
    Mem: 0x00003e800-0x00003f2c0        __TEXT.__const
    Mem: 0x00003f2c0-0x00003fb08        __TEXT.__objc_methname    (C-String Literals)
    Mem: 0x00003fb08-0x00003fb3e        __TEXT.__cstring    (C-String Literals)
    Mem: 0x00003fb3e-0x00003fb8d        __TEXT.__objc_classname    (C-String Literals)
    Mem: 0x00003fb8d-0x00003fc0a        __TEXT.__objc_methtype    (C-String Literals)
    Mem: 0x00003fc0c-0x00003fee4        __TEXT.__gcc_except_tab
    Mem: 0x00003fee4-0x00003fff4        __TEXT.__unwind_info
LC 01: LC_SEGMENT_64              Mem: 0x000040000-0x48000    __DATA
    Mem: 0x000040000-0x000040030        __DATA.__got    (Non-Lazy Symbol Ptrs)
    Mem: 0x000040030-0x000040188        __DATA.__la_symbol_ptr    (Lazy Symbol Ptrs)
    Mem: 0x000040188-0x000040190        __DATA.__mod_init_func    (Module Init Function Ptrs)
    Mem: 0x000040190-0x000040290        __DATA.__const
    Mem: 0x000040290-0x0000402b0        __DATA.__cfstring
    Mem: 0x0000402b0-0x0000402d8        __DATA.__objc_classlist    (Normal)
    Mem: 0x0000402d8-0x0000402e0        __DATA.__objc_imageinfo
    Mem: 0x0000402e0-0x0000408b0        __DATA.__objc_const
    Mem: 0x0000408b0-0x000040b90        __DATA.__objc_selrefs    (Literal Pointers)
    Mem: 0x000040b90-0x000040c60        __DATA.__objc_classrefs    (Normal)
    Mem: 0x000040c60-0x000040df0        __DATA.__objc_data
    Mem: 0x000040df0-0x000044ea8        __DATA.__data
    Mem: 0x000044ea8-0x000044fb4        __DATA.__bss    (Zero Fill)
    Mem: 0x000044fb4-0x000045170        __DATA.__common    (Zero Fill)
LC 02: LC_SEGMENT_64              Mem: 0x000048000-0x4c000    __LLVM
    Mem: 0x000048000-0x000048001        __LLVM.__bundle
LC 03: LC_SEGMENT_64              Mem: 0x00004c000-0x50000    __LINKEDIT
LC 04: LC_ID_DYLIB               /Library/MobileSubstrate/DynamicLibraries/MaskPro.dylib
LC 05: LC_DYLD_INFO
       Rebase info: 184   bytes at offset 311296 (0x4c000-0x4c0b8)
       Bind info:   1208  bytes at offset 311480 (0x4c0b8-0x4c570)
    No Weak info
       Lazy info:   944   bytes at offset 312688 (0x4c570-0x4c920)
       Export info: 1568  bytes at offset 313632 (0x4c920-0x4cf40)
LC 06: LC_SYMTAB
LC 07: LC_DYSYMTAB
        1 local symbols at index     0
      121 external symbols at index  1
       75 undefined symbols at index 122
       No TOC
       No modtab
       92 Indirect symbols at offset 0x4dc10
LC 08: LC_UUID                   UUID: AEBF7878-1DF0-373D-89C5-6B4DA33631D1
LC 09: LC_VERSION_MIN_IPHONEOS    Minimum iOS version:    8.0.0
LC 10: LC_SOURCE_VERSION         Source Version:          0.0.0.0.0
LC 11: LC_ENCRYPTION_INFO_64     Encryption: 0 from offset 16384 spanning 245760 bytes
LC 12: LC_LOAD_DYLIB             /System/Library/Frameworks/AdSupport.framework/AdSupport
LC 13: LC_LOAD_DYLIB             /usr/lib/libMobileGestalt.dylib
LC 14: LC_LOAD_DYLIB             /System/Library/Frameworks/UIKit.framework/UIKit
LC 15: LC_LOAD_DYLIB             /System/Library/Frameworks/Foundation.framework/Foundation
LC 16: LC_LOAD_DYLIB             /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate
LC 17: LC_LOAD_DYLIB             /usr/lib/libobjc.A.dylib
LC 18: LC_LOAD_DYLIB             /usr/lib/libc++.1.dylib
LC 19: LC_LOAD_DYLIB             /usr/lib/libSystem.B.dylib
LC 20: LC_LOAD_DYLIB             /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation
LC 21: LC_FUNCTION_STARTS        Offset:    315200, Size:    128 (0x4cf40-0x4cfc0)
LC 22: LC_DATA_IN_CODE           Offset:    315328, Size:      0 (0x4cfc0-0x4cfc0)
LC 23: LC_CODE_SIGNATURE         Offset:    321424, Size:   4528 (0x4e790-0x4f940)

-L

➜  DynamicLibraries jtool2 -L MaskPro.dylib > MaskProDylib/MaskProDylib_jtool2_L_library.txt

输出：

MaskPro.dylib:
    /System/Library/Frameworks/AdSupport.framework/AdSupport (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libMobileGestalt.dylib (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/UIKit.framework/UIKit (compatibility version 1.0.0, current version 61000.0.0)
    /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1677.104.0)
    /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate (compatibility version 0.0.0, current version 0.0.0)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 902.0.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1281.100.1)
    /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1677.104.0)

-S

➜  DynamicLibraries jtool2 -S MaskPro.dylib > MaskProDylib/MaskProDylib_jtool2_S_symbol.txt

输出：

0000000000040d28 D _OBJC_CLASS_$_NbGzxsksqtAxgN
0000000000040c88 D _OBJC_CLASS_$_NxNXRxsbBxexSx
0000000000040cd8 D _OBJC_CLASS_$_daAxbxbayGwxtxdcca
0000000000040d78 D _OBJC_CLASS_$_xrxleWZnuCXPEx
0000000000040dc8 D _OBJC_CLASS_$_xxWxKxrETCxJpx
0000000000040d00 D _OBJC_METACLASS_$_NbGzxsksqtAxgN
0000000000040c60 D _OBJC_METACLASS_$_NxNXRxsbBxexSx
0000000000040cb0 D _OBJC_METACLASS_$_daAxbxbayGwxtxdcca
0000000000040d50 D _OBJC_METACLASS_$_xrxleWZnuCXPEx
0000000000040da0 D _OBJC_METACLASS_$_xxWxKxrETCxJpx
0000000000044fb4 S _g_slide
00000000000450f8 S _x
00000000000450fc S _x.146
。。。
0000000000044fdc S _y.382
                 U _CC_MD5
                 U _MGCopyAnswer
                 U _MSHookFunction
                 U _MSHookMessageEx
                 U _NSClassFromString
                 U _NSFileSystemFreeSize
                 U _NSHomeDirectory
                 U _OBJC_CLASS_$_ASIdentifierManager
                 U _OBJC_CLASS_$_NSBundle
                 U _OBJC_CLASS_$_NSData
                 U _OBJC_CLASS_$_NSDate
                 U _OBJC_CLASS_$_NSDateFormatter
                 U _OBJC_CLASS_$_NSDictionary
                 U _OBJC_CLASS_$_NSFileManager
                 U _OBJC_CLASS_$_NSJSONSerialization
                 U _OBJC_CLASS_$_NSMutableData
                 U _OBJC_CLASS_$_NSMutableDictionary
                 U _OBJC_CLASS_$_NSMutableString
                 U _OBJC_CLASS_$_NSMutableURLRequest
                 U _OBJC_CLASS_$_NSNumber
                 U _OBJC_CLASS_$_NSObject
                 U _OBJC_CLASS_$_NSString
                 U _OBJC_CLASS_$_NSTimeZone
                 U _OBJC_CLASS_$_NSURL
                 U _OBJC_CLASS_$_NSURLConnection
                 U _OBJC_CLASS_$_NSURLRequest
                 U _OBJC_CLASS_$_NSURLSession
                 U _OBJC_CLASS_$_NSURLSessionConfiguration
                 U _OBJC_CLASS_$_UIDevice
                 U _OBJC_METACLASS_$_NSObject
                 U __Block_object_assign
                 U __Block_object_dispose
                 U __NSConcreteGlobalBlock
                 U __NSConcreteStackBlock
                 U __Unwind_Resume
                 U ___CFConstantStringClassReference
                 U ___assert_rtn
                 U ___gxx_personality_v0
                 U ___objc_personality_v0
                 U ___stack_chk_fail
                 U ___stack_chk_guard
                 U __dyld_get_image_vmaddr_slide
                 U __objc_empty_cache
                 U _bzero
                 U _dispatch_async
                 U _dispatch_get_global_queue
                 U _dispatch_semaphore_create
                 U _dispatch_semaphore_signal
                 U _dispatch_semaphore_wait
                 U _dispatch_time
                 U _dlclose
                 U _dlopen
                 U _dlsym
                 U _exit
                 U _free
                 U _getpid
                 U _ioctl
                 U _isatty
                 U _malloc
                 U _objc_autorelease
                 U _objc_autoreleaseReturnValue
                 U _objc_getClass
                 U _objc_msgSend
                 U _objc_release
                 U _objc_retain
                 U _objc_retainAutorelease
                 U _objc_retainAutoreleasedReturnValue
                 U _perror
                 U _pthread_create
                 U _sleep
                 U _strstr
                 U _syscall
                 U _sysctl
                 U _uname
                 U dyld_stub_binder

--analyze

➜  DynamicLibraries jtool2 --analyze MaskPro.dylib > MaskProDylib/MaskProDylib_jtool2_analyze.txt
Analyzing file...
processLoadCommands: Not a Mach-O magic (0xbebafeca)
Resolving stubs..
Not ARM64 - will not resolve stubs..
Processing __DATA..
opened companion file ./MaskPro.dylib.ARM64.AEBF7878-1DF0-373D-89C5-6B4DA33631D1
Dumping symbol cache to file
Symbolicated 131 symbols and 0 functions
➜  DynamicLibraries mv MaskPro.dylib.ARM64.AEBF7878-1DF0-373D-89C5-6B4DA33631D1 MaskProDylib/MaskProDylib_jtool2_analyze.txt

输出：

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 23:21:11

akd

akd

--pages

✘ crifan@licrifandeMacBook-Pro  ~/dev/dev_root/iosReverse/AppleStore/AuthKit_akd/AuthKit.framework/iOS15.0_arm64  jtool2 --pages ./akd
0x0-0xf4000 __TEXT    (999424 bytes)
    0x43d0-0xbbf24 __TEXT.__text    (752468 bytes)
    0xbbf24-0xbc788 __TEXT.__stubs    (2148 bytes)
    0xbc788-0xc159c __TEXT.__objc_methlist    (19988 bytes)
    0xc15a0-0xc38b0 __TEXT.__const    (8976 bytes)
    0xc38b0-0xc5388 __TEXT.__gcc_except_tab    (6872 bytes)
    0xc5388-0xd85a0 __TEXT.__objc_methname    (78360 bytes)
    0xd85a0-0xdd5f3 __TEXT.__cstring    (20563 bytes)
    0xdd5f3-0xed3bb __TEXT.__oslogstring    (64968 bytes)
    0xed3bb-0xee39a __TEXT.__objc_classname    (4063 bytes)
    0xee39a-0xf1aff __TEXT.__objc_methtype    (14181 bytes)
    0xf1aff-0xf1bed __TEXT.__dlopen_cstrs    (238 bytes)
    0xf1bed-0xf217b __TEXT.__info_plist    (1422 bytes)
    0xf217c-0xf3ff8 __TEXT.__unwind_info    (7804 bytes)
0xf4000-0x100000 __DATA_CONST    (49152 bytes)
    0xf4000-0xf4d50 __DATA_CONST.__got    (3408 bytes)
    0xf4d50-0xfa090 __DATA_CONST.__const    (21312 bytes)
    0xfa090-0xfe890 __DATA_CONST.__cfstring    (18432 bytes)
    0xfe890-0xfec18 __DATA_CONST.__objc_classlist    (904 bytes)
    0xfec18-0xfec20 __DATA_CONST.__objc_catlist    (8 bytes)
    0xfec20-0xfed50 __DATA_CONST.__objc_protolist    (304 bytes)
    0xfed50-0xfed58 __DATA_CONST.__objc_imageinfo    (8 bytes)
0x100000-0x11c000 __DATA    (114688 bytes)
    0x100000-0x110968 __DATA.__objc_const    (67944 bytes)
    0x110968-0x114cb8 __DATA.__objc_selrefs    (17232 bytes)
    0x114cb8-0x114cd8 __DATA.__objc_protorefs    (32 bytes)
    0x114cd8-0x115450 __DATA.__objc_classrefs    (1912 bytes)
    0x115450-0x1156b0 __DATA.__objc_superrefs    (608 bytes)
    0x1156b0-0x115c88 __DATA.__objc_ivar    (1496 bytes)
    0x115c88-0x117fd8 __DATA.__objc_data    (9040 bytes)
    0x117fd8-0x118e18 __DATA.__data    (3648 bytes)
    0x118e18-0x118ef0 __DATA.__objc_intobj    (216 bytes)
0x11c000-0x12ce50 __LINKEDIT    (69200 bytes)
    0x120d98-0x121f98 Function Starts    (4608 bytes)
    0x121f98-0x1243e8 Symbol Table    (9296 bytes)
    0x124d60-0x128f38 String Table    (16856 bytes)
    0x128f40-0x12ce50 Code Signature    (16144 bytes)

结果分析：

arm64的akd二进制内部的偏移量：

整个TEXT代码段是：0x0-0xf4000 __TEXT (999424 bytes = 976KB)

我们要找到的，单独是程序的二进制代码是：0x43d0-0xbbf24 __TEXT.__text (752468 bytes) = 约734.8KB

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 15:44:41

help

jtool2的help语法

➜  ~ jtool2 --help
Usage: jtool [options] _filename_

OTool Compatible Options:
   -h             Dump Mach-O (or DYLD Shared Cache) header
   -l             List sections/commands in binary
   -L             print shared libraries used

JTool (classic) Options:
   -S             List Symbols (like NM)
   -v[v]          Toggle verbosity (vv = very verbose)
   -e             extract fat slice, Mach-O segment/section, dyld shared cache dylib or (NEW) kernelcache kext
   -q             Quick operation - do not process any symbols in the Mach-O
   -F             find all occurrences of _string_ in binary
   -a             Find offset/segment corresponding to virtual address _addr_
   -o             Find address corresponding to offset _offset_
   -d             Dump (smart dump, will disassemble text and dump data by autodetecting)

Code Signing Options:
   --sig          Show code signature in binary (if any)
   --stripsig     Remove existing code signature (useful for MacOS unrestricting)
   --ent          Show entitlements in binary (if any)
   -+ent=...[,...]    Inject entitlements into binary (implies resigning inplace)
   -+platformize    Platformize binary (injects platform-application, also implies resigning inplace)

Joker Compatible Options (applicable on kernel caches only):
   -k             List kexts
   -K             Kextract™ a kernel extension by its bundle ID
   -dec           Decompress a kernelcache to /tmp/kernel (no longer necessary since JTool can now operate on compressed caches)

dyldinfo Compatible Options:
   --bind             print addresses dyld will set based on symbolic lookups
   --lazy_bind        print addresses dyld will lazily set on first use
   --opcodes          print opcodes used to generate the rebase and binding information
   --function_starts    print table of function start addresses

Newer (JTool 2) Options:
   --analyze      Analyze file and create a companion file
   --symbolicate    Symbolicate an .ips panic file
   --machoize      [text=0x...-0x...] [strings=0x....-0x...] [data=0x....-0x....] _filename_
   --tbd          Create a .tbd file (for *OS private frameworks only - you'll need the dyld shared cache for this)
   --objc         Like old -d objc and/or classdumpZ - Mike, this is for you :-)
   -D             Decompile (totally experimental - would love your feedback if you're reading this)
   -G             Gadget search (specify gadgets as comma delimited mnemonics)
   -W             Write [address] [value] - [value] is a string or 0x....

Environment Variables:
   ARCH                    Select architecture slice. Set to arm64, arm64e, arm64_32, armv7, armv7k, x86_64 or (not for long) i386
   JCOLOR                  ANSI Colors. Note you'll need 'less -R' if piping output
   JTOOLDIR                path to search for companion jtool files (default: $PWD).
            Use this to force create a file, if one does not exist
   NOPSUP                  Suppress NOPs in disassembly
   JENTS                   Default entitlements (comma separated) for --sign
   JHASH                   Choice of Hash algorithm for signing (SHA1,SHA256 (default), SHA256T, SHA384)
   JSHUDDUP                Suppress stderr (risky, but useful)
   JDEBUG                  Enhanced debug output. May be very verbose
   JDEBUGCS                Debug output specifically for code signing operations. Useful to watch these step-by-step
   WITHSIGBLOB             Code signing: Also create an empty CMS blob (no longer a default due to CoreTrust)

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-04 23:07:06

otool

otool

otool

=object file displaying tool

是什么：查看目标文件信息的工具

用途：用来发现应用中使用到了哪些系统库，调用了其中哪些方法，使用了库中哪些对象及属性

比如

查看iOS的Mach-O格式的二进制文件的信息

来源：Xcode自带的常用工具

相关

比otool更好的：jtool

otool的GUI版：otx

x43x61x69/otx: The Mach-O disassembler. Now 64bit and Xcode 6 compatible.

https://github.com/x43x61x69/otx

下载安装otool

Mac自带otool，无需额外安装。

查看当前otool位置：

✘ crifan@licrifandeMacBook-Pro  ~  which otool
/usr/bin/otool

当前版本：

✘ crifan@licrifandeMacBook-Pro  ~  otool --version
llvm-otool(1): Apple Inc. version cctools-927.0.2
Apple LLVM version 10.0.1 (clang-1001.0.46.4)
  Optimized build.
  Default target: x86_64-apple-darwin19.2.0
  Host CPU: broadwell

  Registered Targets:
    aarch64    - AArch64 (little endian)
    aarch64_be - AArch64 (big endian)
    arm        - ARM
    arm64      - ARM64 (little endian)
    armeb      - ARM (big endian)
    thumb      - Thumb
    thumbeb    - Thumb (big endian)
    x86        - 32-bit X86: Pentium-Pro and above
    x86-64     - 64-bit X86: EM64T and AMD64

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 10:54:29

用法

otool用法

单个参数

-l: print the load commands

otool -l iOSBinaryFile

-L: print shared Libraries used

otool -L iOSBinaryFile

-o: print the Objective-C segment

-V: print disassembled operands symbolically

参数组合

-oV

otool -oV iOSBinaryFile

-tV

otool -tV iOSBinaryFile

用途

用otool去手动计算地址转函数

otool -arch <arch> -l <path_to_dsym> | grep __TEXT -m 2 -A 1 | grep vmaddr

常见问题

is not an object file

otool只支持查看Mach-O格式的文件，不支持其他格式的文件。

比如如果用otool查看ELF格式的话，会报错：

➜  arm64-v8a otool -L libtacker.so
libtacker.so: is not an object file

➜  arm64-v8a otool -oV libtacker.so
libtacker.so: is not an object file

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 11:28:56

举例

otool用法举例

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-05 16:05:36

Aweme

otool用法举例：Aweme

-l

➜  Aweme.app otool -l Aweme
Aweme:
Load command 0
      cmd LC_SEGMENT_64
  cmdsize 72
  segname __PAGEZERO
   vmaddr 0x0000000000000000
   vmsize 0x0000000100000000
  fileoff 0
 filesize 0
  maxprot 0x00000000
 initprot 0x00000000
   nsects 0
    flags 0x0
Load command 1
      cmd LC_SEGMENT_64
  cmdsize 552
  segname __TEXT
   vmaddr 0x0000000100000000
   vmsize 0x0000000000008000
  fileoff 0
 filesize 32768
  maxprot 0x00000005
 initprot 0x00000005
   nsects 6
    flags 0x0
Section
  sectname __text
   segname __TEXT
      addr 0x0000000100006af4
      size 0x00000000000011bc
    offset 27380
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x80000400
 reserved1 0
 reserved2 0
Section
  sectname __stubs
   segname __TEXT
      addr 0x0000000100007cb0
      size 0x00000000000000f0
    offset 31920
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x80000408
 reserved1 0 (index into indirect symbol table)
 reserved2 12 (size of stubs)
Section
  sectname __stub_helper
   segname __TEXT
      addr 0x0000000100007da0
      size 0x0000000000000108
    offset 32160
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x80000400
 reserved1 0
 reserved2 0
Section
  sectname __const
   segname __TEXT
      addr 0x0000000100007ea8
      size 0x0000000000000011
    offset 32424
     align 2^1 (2)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __cstring
   segname __TEXT
      addr 0x0000000100007eb9
      size 0x000000000000009b
    offset 32441
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __unwind_info
   segname __TEXT
      addr 0x0000000100007f54
      size 0x00000000000000ac
    offset 32596
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Load command 2
      cmd LC_SEGMENT_64
  cmdsize 792
  segname __DATA
   vmaddr 0x0000000100008000
   vmsize 0x0000000000004000
  fileoff 32768
 filesize 16384
  maxprot 0x00000003
 initprot 0x00000003
   nsects 9
    flags 0x0
Section
  sectname __got
   segname __DATA
      addr 0x0000000100008000
      size 0x0000000000000010
    offset 32768
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000006
 reserved1 20 (index into indirect symbol table)
 reserved2 0
Section
  sectname __la_symbol_ptr
   segname __DATA
      addr 0x0000000100008010
      size 0x00000000000000a0
    offset 32784
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000007
 reserved1 22 (index into indirect symbol table)
 reserved2 0
Section
  sectname __mod_init_func
   segname __DATA
      addr 0x00000001000080b0
      size 0x0000000000000008
    offset 32944
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000009
 reserved1 0
 reserved2 0
Section
  sectname __const
   segname __DATA
      addr 0x00000001000080b8
      size 0x0000000000000018
    offset 32952
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_imageinfo
   segname __DATA
      addr 0x00000001000080d0
      size 0x0000000000000008
    offset 32976
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __swift_hooks
   segname __DATA
      addr 0x00000001000080d8
      size 0x00000000000000b8
    offset 32984
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __data
   segname __DATA
      addr 0x0000000100008190
      size 0x0000000000000015
    offset 33168
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __swift51_hooks
   segname __DATA
      addr 0x00000001000081a8
      size 0x00000000000000b8
    offset 33192
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __bss
   segname __DATA
      addr 0x0000000100008260
      size 0x00000000000000d8
    offset 0
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000001
 reserved1 0
 reserved2 0
Load command 3
      cmd LC_SEGMENT_64
  cmdsize 152
  segname __DATA_CONST
   vmaddr 0x000000010000c000
   vmsize 0x0000000000208000
  fileoff 49152
 filesize 0
  maxprot 0x00000003
 initprot 0x00000003
   nsects 1
    flags 0x0
Section
  sectname __objc_selrefs
   segname __DATA_CONST
      addr 0x000000010000c000
      size 0x00000000002054d2
    offset 0
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000001
 reserved1 0
 reserved2 0
Load command 4
      cmd LC_SEGMENT_64
  cmdsize 152
  segname __OBJC
   vmaddr 0x0000000100214000
   vmsize 0x0000000000000000
  fileoff 49152
 filesize 0
  maxprot 0x00000001
 initprot 0x00000001
   nsects 1
    flags 0x0
Section
  sectname __message_refs
   segname __OBJC
      addr 0x0000000100214000
      size 0x0000000000000000
    offset 49152
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Load command 5
      cmd LC_SEGMENT_64
  cmdsize 72
  segname __LINKEDIT
   vmaddr 0x0000000100214000
   vmsize 0x0000000000008000
  fileoff 49152
 filesize 24304
  maxprot 0x00000001
 initprot 0x00000001
   nsects 0
    flags 0x0
Load command 6
            cmd LC_DYLD_INFO_ONLY
        cmdsize 48
     rebase_off 49152
    rebase_size 16
       bind_off 49168
      bind_size 56
  weak_bind_off 0
 weak_bind_size 0
  lazy_bind_off 49224
 lazy_bind_size 416
     export_off 0
    export_size 0
Load command 7
     cmd LC_SYMTAB
 cmdsize 24
  symoff 49672
   nsyms 22
  stroff 50192
 strsize 320
Load command 8
            cmd LC_DYSYMTAB
        cmdsize 80
      ilocalsym 0
      nlocalsym 1
     iextdefsym 1
     nextdefsym 0
      iundefsym 1
      nundefsym 21
         tocoff 0
           ntoc 0
      modtaboff 0
        nmodtab 0
   extrefsymoff 0
    nextrefsyms 0
 indirectsymoff 50024
  nindirectsyms 42
      extreloff 0
        nextrel 0
      locreloff 0
        nlocrel 0
Load command 9
          cmd LC_LOAD_DYLINKER
      cmdsize 32
         name /usr/lib/dyld (offset 12)
Load command 10
     cmd LC_UUID
 cmdsize 24
    uuid 31ED6D91-1868-36F5-89B8-C39FBF7D01E3
Load command 11
      cmd LC_VERSION_MIN_IPHONEOS
  cmdsize 16
  version 10.0
      sdk 15.0
Load command 12
      cmd LC_SOURCE_VERSION
  cmdsize 16
  version 0.0
Load command 13
       cmd LC_MAIN
   cmdsize 24
  entryoff 31896
 stacksize 0
Load command 14
          cmd LC_ENCRYPTION_INFO_64
      cmdsize 24
     cryptoff 28672
    cryptsize 4096
      cryptid 1
          pad 0
Load command 15
          cmd LC_LOAD_DYLIB
      cmdsize 64
         name @rpath/AwemeCore.framework/AwemeCore (offset 24)
   time stamp 2 Thu Jan  1 08:00:02 1970
      current version 1.0.0
compatibility version 1.0.0
Load command 16
          cmd LC_LOAD_DYLIB
      cmdsize 88
         name /System/Library/Frameworks/Foundation.framework/Foundation (offset 24)
   time stamp 2 Thu Jan  1 08:00:02 1970
      current version 1854.0.0
compatibility version 300.0.0
Load command 17
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libobjc.A.dylib (offset 24)
   time stamp 2 Thu Jan  1 08:00:02 1970
      current version 228.0.0
compatibility version 1.0.0
Load command 18
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libSystem.B.dylib (offset 24)
   time stamp 2 Thu Jan  1 08:00:02 1970
      current version 1311.0.0
compatibility version 1.0.0
Load command 19
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name @rpath/libswiftCore.dylib (offset 24)
   time stamp 2 Thu Jan  1 08:00:02 1970
      current version 1300.0.29
compatibility version 1.0.0
Load command 20
          cmd LC_RPATH
      cmdsize 32
         path /usr/lib/swift (offset 12)
Load command 21
          cmd LC_RPATH
      cmdsize 40
         path @executable_path/Frameworks (offset 12)
Load command 22
      cmd LC_FUNCTION_STARTS
  cmdsize 16
  dataoff 49640
 datasize 32
Load command 23
      cmd LC_DATA_IN_CODE
  cmdsize 16
  dataoff 49672
 datasize 0
Load command 24
      cmd LC_CODE_SIGNATURE
  cmdsize 16
  dataoff 50512
 datasize 22944

查看是否加密=脱壳

未加密

➜  Aweme.app otool -l Aweme | grep crypt
    cryptoff 28672
    cryptsize 4096
      cryptid 0

说明

cryptid 0：表示未加密 = 已脱壳

已加密

➜  Aweme.app pwd
xxx/Aweme抖音/iPhone7-137black/Aweme.app
➜  Aweme.app otool -l Aweme | grep crypt
    cryptoff 28672
    cryptsize 4096
      cryptid 1

说明

cryptid 1：表示已加密 = 未脱壳

-L

➜  Aweme.app otool -L Aweme
Aweme:
    @rpath/AwemeCore.framework/AwemeCore (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1854.0.0)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1311.0.0)
    @rpath/libswiftCore.dylib (compatibility version 1.0.0, current version 1300.0.29)

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 11:14:31

AwemeCore

otool用法举例：AwemeCore

输入文件：

/Users/crifan/dev/DevRoot/iOSReverse/Aweme/exportFromiPhone/iPhone7P-1341/Aweme.app/Frameworks/AwemeCore.framework

➜  AwemeCore.framework ll
total 10208480
-rw-r--r--  1 crifan  staff   230M  1  8 09:43 AwemeCore

-l

➜  AwemeCore.framework otool -l AwemeCore > otool_l_AwemeCore.txt

输出内容（很多，有2000多行）：

AwemeCore:
Load command 0
      cmd LC_SEGMENT_64
  cmdsize 1752
  segname __TEXT
   vmaddr 0x0000000000000000
   vmsize 0x0000000000304000
  fileoff 0
 filesize 3162112
  maxprot 0x00000005
 initprot 0x00000005
   nsects 21
    flags 0x0
Section
  sectname __stub_helper
   segname __TEXT
      addr 0x000000000000b9b0
      size 0x00000000000084c0
    offset 47536
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x80000400
 reserved1 0
 reserved2 0
Section
  sectname __const
   segname __TEXT
      addr 0x0000000000013e70
      size 0x0000000000004020
    offset 81520
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __swift5_typeref
   segname __TEXT
      addr 0x0000000000017e90
      size 0x0000000000002ef8
    offset 97936
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __swift5_fieldmd
   segname __TEXT
      addr 0x000000000001ad88
      size 0x0000000000002988
    offset 109960
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __swift5_proto
   segname __TEXT
      addr 0x000000000001d710
      size 0x0000000000000338
    offset 120592
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __swift5_types
   segname __TEXT
      addr 0x000000000001da48
      size 0x000000000000028c
    offset 121416
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __cstring
   segname __TEXT
      addr 0x000000000001dcd4
      size 0x0000000000000000
    offset 122068
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __objc_methname
   segname __TEXT
      addr 0x000000000001dcd4
      size 0x0000000000000000
    offset 122068
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __objc_classname
   segname __TEXT
      addr 0x000000000001dcd4
      size 0x0000000000000000
    offset 122068
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __objc_methtype
   segname __TEXT
      addr 0x000000000001dcd4
      size 0x0000000000000000
    offset 122068
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __gcc_except_tab
   segname __TEXT
      addr 0x000000000001dcd4
      size 0x0000000000000068
    offset 122068
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
...
Section
  sectname __PUZZLEMETHOD__
   segname __DATA
      addr 0x0000000000d627a8
      size 0x0000000000000050
    offset 14034856
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname IESSLynxBridge
   segname __DATA
      addr 0x0000000000d627f8
      size 0x0000000000000010
    offset 14034936
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname RxAnnotation
   segname __DATA
      addr 0x0000000000d62808
      size 0x0000000000000050
    offset 14034952
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_clsrefs
   segname __DATA
      addr 0x0000000000d62858
      size 0x0000000000004850
    offset 14035032
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __thread_vars
   segname __DATA
      addr 0x0000000000d670a8
      size 0x00000000000006c0
    offset 14053544
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000013
 reserved1 0
 reserved2 0
...
Section
  sectname _D_ustring
   segname __DATA
      addr 0x00000000047e5194
      size 0x000000000007795a
    offset 0
     align 2^1 (2)
    reloff 0
    nreloc 0
     flags 0x00000001
 reserved1 0
 reserved2 0
Section
  sectname _D_objc_methname
   segname __DATA
      addr 0x000000000485caee
      size 0x0000000000ae06ba
    offset 0
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000001
 reserved1 0
 reserved2 0
Section
  sectname _D_objc_methtype
   segname __DATA
      addr 0x000000000533d1a8
      size 0x00000000001ca962
    offset 0
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000001
 reserved1 0
 reserved2 0
Section
  sectname __common
   segname __DATA
      addr 0x0000000005507c00
      size 0x000000000017fc48
    offset 0
     align 2^10 (1024)
    reloff 0
    nreloc 0
     flags 0x00000001
 reserved1 0
 reserved2 0
Section
  sectname __bss
   segname __DATA
      addr 0x0000000005687900
      size 0x000000000029b0ec
    offset 0
     align 2^8 (256)
    reloff 0
    nreloc 0
     flags 0x00000001
 reserved1 0
 reserved2 0
Load command 2
      cmd LC_SEGMENT_64
  cmdsize 232
  segname __BD_TEXT
   vmaddr 0x0000000005924000
   vmsize 0x000000000bb5c000
  fileoff 16269312
 filesize 196460544
  maxprot 0x00000005
 initprot 0x00000005
   nsects 2
    flags 0x0
Section
  sectname __text
   segname __BD_TEXT
      addr 0x0000000005924000
      size 0x000000000bb52a38
    offset 16269312
     align 2^14 (16384)
    reloff 0
    nreloc 0
     flags 0x80000400
 reserved1 0
 reserved2 0
Section
  sectname __stubs
   segname __BD_TEXT
      addr 0x0000000011476a38
      size 0x0000000000008508
    offset 212691512
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x80000408
 reserved1 4410 (index into indirect symbol table)
 reserved2 12 (size of stubs)
Load command 3
      cmd LC_SEGMENT_64
  cmdsize 712
  segname __LTC_DATA
   vmaddr 0x0000000011480000
   vmsize 0x00000000011e0000
  fileoff 212729856
 filesize 18743296
  maxprot 0x00000001
 initprot 0x00000001
   nsects 8
    flags 0x0
...
Section
  sectname _C_gcc_except_ta
   segname __LTC_DATA
      addr 0x000000001232e92d
      size 0x000000000024ca15
    offset 228124973
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __fix
   segname __LTC_DATA
      addr 0x000000001257b342
      size 0x00000000000e1298
    offset 230536002
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Load command 4
      cmd LC_SEGMENT_64
  cmdsize 72
  segname __LINKEDIT
   vmaddr 0x0000000012660000
   vmsize 0x00000000008c8000
  fileoff 231473152
 filesize 9193456
  maxprot 0x00000001
 initprot 0x00000001
   nsects 0
    flags 0x0
Load command 5
          cmd LC_ID_DYLIB
      cmdsize 64
         name @rpath/AwemeCore.framework/AwemeCore (offset 24)
   time stamp 1 Thu Jan  1 08:00:01 1970
      current version 1.0.0
compatibility version 1.0.0
Load command 6
            cmd LC_DYLD_INFO_ONLY
        cmdsize 48
     rebase_off 231473152
    rebase_size 350072
       bind_off 231823224
      bind_size 292520
  weak_bind_off 232115744
 weak_bind_size 296
  lazy_bind_off 232116040
 lazy_bind_size 101024
     export_off 232217064
    export_size 384
Load command 7
     cmd LC_SYMTAB
 cmdsize 24
  symoff 234432864
   nsyms 5030
  stroff 234542336
 strsize 146360
Load command 8
            cmd LC_DYSYMTAB
        cmdsize 80
      ilocalsym 0
      nlocalsym 1
     iextdefsym 1
     nextdefsym 0
      iundefsym 1
      nundefsym 5029
         tocoff 0
           ntoc 0
      modtaboff 0
        nmodtab 0
   extrefsymoff 0
    nextrefsyms 0
 indirectsymoff 234513344
  nindirectsyms 7248
      extreloff 0
        nextrel 0
      locreloff 0
        nlocrel 0
Load command 9
     cmd LC_UUID
 cmdsize 24
    uuid F1FCF15A-6465-31F0-9300-5BA1B8F91017
Load command 10
      cmd LC_VERSION_MIN_IPHONEOS
  cmdsize 16
  version 10.0
      sdk 15.0
Load command 11
      cmd LC_SOURCE_VERSION
  cmdsize 16
  version 0.0
Load command 12
          cmd LC_ENCRYPTION_INFO_64
      cmdsize 24
     cryptoff 32768
    cryptsize 3112960
      cryptid 0
          pad 0
Load command 13
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libcompression.dylib (offset 24)
   time stamp 2 Thu Jan  1 08:00:02 1970
      current version 1.0.0
compatibility version 1.0.0
Load command 14
          cmd LC_LOAD_DYLIB
      cmdsize 72
         name @rpath/BDLRepairer.framework/BDLRepairer (offset 24)
   time stamp 2 Thu Jan  1 08:00:02 1970
      current version 1.0.0
compatibility version 1.0.0
Load command 15
          cmd LC_LOAD_DYLIB
      cmdsize 48
         name /usr/lib/libc++.1.dylib (offset 24)
   time stamp 2 Thu Jan  1 08:00:02 1970
      current version 1200.3.0
compatibility version 1.0.0
...
Load command 123
          cmd LC_LOAD_WEAK_DYLIB
      cmdsize 48
         name @rpath/libswiftos.dylib (offset 24)
   time stamp 2 Thu Jan  1 08:00:02 1970
      current version 1021.0.0
compatibility version 1.0.0
Load command 124
          cmd LC_LOAD_WEAK_DYLIB
      cmdsize 56
         name @rpath/libswiftsimd.dylib (offset 24)
   time stamp 2 Thu Jan  1 08:00:02 1970
      current version 9.0.0
compatibility version 1.0.0
Load command 125
          cmd LC_RPATH
      cmdsize 32
         path /usr/lib/swift (offset 12)
Load command 126
          cmd LC_RPATH
      cmdsize 40
         path @executable_path/Frameworks (offset 12)
Load command 127
          cmd LC_RPATH
      cmdsize 40
         path @loader_path/Frameworks (offset 12)
Load command 128
          cmd LC_RPATH
      cmdsize 48
         path @executable_path/../../Frameworks (offset 12)
Load command 129
          cmd LC_RPATH
      cmdsize 40
         path @executable_path/Frameworks (offset 12)
Load command 130
      cmd LC_FUNCTION_STARTS
  cmdsize 16
  dataoff 232217448
 datasize 2214096
Load command 131
      cmd LC_DATA_IN_CODE
  cmdsize 16
  dataoff 234431544
 datasize 1320
Load command 132
      cmd LC_CODE_SIGNATURE
  cmdsize 16
  dataoff 234688704
 datasize 5977904

-oV

➜  AwemeCore.framework otool -oV AwemeCore > otool_oV_AwemeCore.txt

输出（共16万行）：

AwemeCore:
Contents of (__DATA,__objc_classlist) section
00000000003221c8 0x9acaf0
    isa        0x9acac8
    superclass 0x0 _OBJC_CLASS_$_NSObject
    cache      0x0 __objc_empty_cache
    vtable     0x0
    data       0x37f798
        flags          0x0
        instanceStart  8
        instanceSize   12
        reserved       0x0
        ivarLayout     0x0
        name           0xe1100a BDLDecompressor_AwemeCore
        baseMethods    0x37f708
            entsize 24
            count   3
            name    0xd86870 copyWithZone:
            types   0xdf3478 @24@0:8^{_NSZone=}16
            imp     0x5babaf0
            name    0xd84267 foo
            types   0xdf34a7 i16@0:8
            imp     0x5bac0a0
            name    0xd84298 setFoo:
            types   0xdf34af v20@0:8i16
            imp     0x5bac0a8
        baseProtocols  0x37f6a8
            count    1
            list[0]  0x9bd758
                isa       0x0
                name      0xe11497 NSCopying
                protocols 0x0
                instanceMethods 0x38ffe8
                    entsize 24
                    count   1
                    name    0xd86870 copyWithZone:
                    types   0xdf3478 @24@0:8^{_NSZone=}16
                    imp     0x0
                classMethods 0x0
                optionalInstanceMethods 0x0
                optionalClassMethods 0x0
                instanceProperties 0x0
        ivars          0x37f758
            entsize   32
            count     1
            offset    0x9ab740 8
            name      0xd842a0 _foo
            type      0xdf34ba i
            alignment 2
            size      4
        weakIvarLayout 0x0
        baseProperties 0x37f780
            entsize    16
            count      1
            name       0xd84267 foo
            attributes 0xd842a5 Ti,N,V_foo
Meta Class
    isa        0x0 _OBJC_METACLASS_$_NSObject
    superclass 0x0 _OBJC_METACLASS_$_NSObject
    cache      0x0 __objc_empty_cache
...
000000000037f630 0xd54b90
    isa       0x0
    name      0xf4bbac BDXVideoCorePlayerDelegate
    protocols 0x0
    instanceMethods 0x0
    classMethods 0x0
    optionalInstanceMethods 0x0
    optionalClassMethods 0x0
    instanceProperties 0x0
000000000037f638 0xd54bf0
    isa       0x0
    name      0xf4bbc7 BDXVideoPlayProgressDelegate
    protocols 0x0
    instanceMethods 0x0
    classMethods 0x0
    optionalInstanceMethods 0x0
    optionalClassMethods 0x0
    instanceProperties 0x0
000000000037f640 0xd54d90
    isa       0x0
    name      0xf4bc44 BDXVideoFullScreenPlayer
    protocols 0x0
    instanceMethods 0x0
    classMethods 0x0
    optionalInstanceMethods 0x0
    optionalClassMethods 0x0
    instanceProperties 0x0
000000000037f648 0xd55890
    isa       0x0
    name      0xf4bf19 YYWebImageOperation
    protocols 0x0
    instanceMethods 0x0
    classMethods 0x0
    optionalInstanceMethods 0x0
    optionalClassMethods 0x0
    instanceProperties 0x0
Contents of (__DATA,__objc_selrefs) section
    0xd84267 foo
Contents of (__DATA,__objc_imageinfo) section
    version 0
    flags   0x5010700 Swift 5 or later

输出内容分析

其中也有AWECloudJailBreakUtility：

0000000000322a18 0x9bf000
    isa        0x9befd8
    superclass 0x0 _OBJC_CLASS_$_NSObject
    cache      0x0 __objc_empty_cache
    vtable     0x0
    data       0x3921f8
        flags          0x80
        instanceStart  8
        instanceSize   8
        reserved       0x0
        ivarLayout     0x0
        name           0xe12aaf AWECloudJailBreakUtility
        baseMethods    0x0
        baseProtocols  0x0
        ivars          0x0
        weakIvarLayout 0x0
        baseProperties 0x0
Meta Class
    isa        0x0 _OBJC_METACLASS_$_NSObject
    superclass 0x0 _OBJC_METACLASS_$_NSObject
    cache      0x0 __objc_empty_cache
    vtable     0x0
    data       0x3921b0
        flags          0x81 RO_META
        instanceStart  40
        instanceSize   40
        reserved       0x0
        ivarLayout     0x0
        name           0xe12aaf AWECloudJailBreakUtility
        baseMethods    0x0
        baseProtocols  0x0
        ivars          0x0
        weakIvarLayout 0x0
        baseProperties 0x0

且信息更全：

父类=superclass是：_OBJC_METACLASS_$_NSObject

对于：

name 0xe12aaf AWECloudJailBreakUtility

->好像是：AWECloudJailBreakUtility这个类的位置是0xe12aaf

-》如果是：则就是我们之前，曾想要的：

通过类名字：AWECloudJailBreakUtility

去寻找其具体地址：0xe12aaf

-> 用于去后续（lldb、XCode等）调试中，去打断点

另外搜：jail

也是能搜到，类似于strings找到的几个：

Meta Class
    isa        0x0 _OBJC_METACLASS_$_NSObject
    superclass 0x0 _OBJC_METACLASS_$_NSObject
    cache      0x0 __objc_empty_cache
    vtable     0x0
    data       0x3a71e0
        flags          0x81 RO_META
        instanceStart  40
        instanceSize   40
        reserved       0x0
        ivarLayout     0x0
        name           0xe163f6 BDInstallNetworkUtility
        baseMethods    0x3a70e8
            entsize 24
            count   10
            name    0xd842dd load
            types   0xdf33c3 v16@0:8
            imp     0x5927654
            name    0xd8dbc6 onTheFlyParameter
            types   0xdf33de @16@0:8
            imp     0x5f8d0dc
            name    0xd8dc1d commonURLParameters
            types   0xdf33de @16@0:8
            imp     0x5f8e628
            name    0xd8dc31 buildQueryFromDictionary:
            types   0xdf3380 @24@0:8@16
            imp     0x5f8edf4
            name    0xd8dc83 isUpgradeUser
            types   0xdf3410 B16@0:8
            imp     0x5f8f07c
            name    0xd8c1d2 isJailBroken
            types   0xdf3410 B16@0:8
            imp     0x5f8f23c
            name    0xd8dc91 decodeBase64String:
            types   0xdf3380 @24@0:8@16
            imp     0x5f8f3c8
            name    0xd8c1df resolutionString
            types   0xdf33de @16@0:8
            imp     0x5f8f44c
            name    0xd8c2a6 appDisplayName
            types   0xdf33de @16@0:8
            imp     0x5f8f528
            name    0xd8dc7a platform
            types   0xdf33de @16@0:8
            imp     0x5f8f62c
        baseProtocols  0x0
        ivars          0x0
        weakIvarLayout 0x0
        baseProperties 0x0

-》很明显，信息更全：

可以知道：

symbol=符号=函数=function：isJailBroken

所属的类是：BDInstallNetworkUtility

name 0xe163f6 BDInstallNetworkUtility

superclass 0x0 _OBJC_METACLASS_$_NSObject

其他还有一个：isJailBroken

Meta Class
    isa        0x0 _OBJC_METACLASS_$_NSObject
    superclass 0x0 _OBJC_METACLASS_$_NSObject
    cache      0x0 __objc_empty_cache
    vtable     0x0
    data       0x5f3678
        flags          0x81 RO_META
        instanceStart  40
        instanceSize   40
        reserved       0x0
        ivarLayout     0x0
        name           0xe8e38c TTInstallUtil
        baseMethods    0x5f34c0
            entsize 24
            count   18
            name    0xdc6a5b generateMockDeviceInfo
            types   0xdf33c3 v16@0:8
            imp     0x92ee848
            name    0xdc6a72 setResetMode:
            types   0xdf339e v20@0:8B16
            imp     0x92ee988
            name    0xdc6a80 isResetMode
            types   0xdf3410 B16@0:8
            imp     0x92eeab0
            name    0xd8fa16 setAutoReset:
            types   0xdf339e v20@0:8B16
            imp     0x92eeb1c
            name    0xd8fa24 isAutoReset
            types   0xdf3410 B16@0:8
            imp     0x92eeb74
            name    0xdc6a1e clearAllUserDefaultsData
            types   0xdf33c3 v16@0:8
            imp     0x92eebd0
            name    0xd842dd load
            types   0xdf33c3 v16@0:8
            imp     0x5927238
            name    0xd8bb2a uuid
            types   0xdf33de @16@0:8
            imp     0x92ec3f0
            name    0xd8dbc6 onTheFlyParameter
            types   0xdf33de @16@0:8
            imp     0x92ec444
            name    0xdc69ef isInHouseVersion
            types   0xdf3410 B16@0:8
            imp     0x5981a34
            name    0xd8dc1d commonURLParameters
            types   0xdf33de @16@0:8
            imp     0x92ed7e4
            name    0xd8dc31 buildQueryFromDictionary:
            types   0xdf3380 @24@0:8@16
            imp     0x92ee034
            name    0xd8dc83 isUpgradeUser
            types   0xdf3410 B16@0:8
            imp     0x92ee2bc
            name    0xdc6a00 loadUserDefaultsStringForKey:
            types   0xdf3380 @24@0:8@16
            imp     0x92ee4b0
            name    0xd8c1df resolutionString
            types   0xdf33de @16@0:8
            imp     0x92ee534
            name    0xd8c1d2 isJailBroken
            types   0xdf3410 B16@0:8
            imp     0x92ee610
            name    0xd8dc7a platform
            types   0xdf33de @16@0:8
            imp     0x92ee6f0
            name    0xd86653 authorizationStatus
            types   0xdf3437 Q16@0:8
            imp     0x92ee788
        baseProtocols  0x0
        ivars          0x0
        weakIvarLayout 0x0
        baseProperties 0x0

-》

name 0xd8c1d2 isJailBroken

name 0xe8e38c TTInstallUtil

data 0x5f3678

其他几个：

000000000036aa78 0x3cd4a0
    name      0xe1bc2c BDXAdditions
    cls       0x0 _OBJC_CLASS_$_UIDevice
    instanceMethods 0x0
    classMethods 0x3cd150
        entsize 24
        count   35
        name    0xd98274 bdx_runningProcesses
        types   0xdf33de @16@0:8
        imp     0x62225dc
        name    0xd98227 getSysInfoByName:
        types   0xe05b74 @24@0:8*16
        imp     0x62228e8
        name    0xd98239 bdx_platform
        types   0xdf33de @16@0:8
        imp     0x6222960
        name    0xd98289 bdx_hwmodel
        types   0xdf33de @16@0:8
        imp     0x6222974
        name    0xd98246 bdx_platformType
        types   0xdf3437 Q16@0:8
        imp     0x6222988
        name    0xd981c1 bdx_platformName
        types   0xdf33de @16@0:8
        imp     0x62234c0
        name    0xd98295 bdx_platformString
        types   0xdf33de @16@0:8
        imp     0x622350c
        name    0xd98257 bdx_OSVersion
        types   0xdf33de @16@0:8
        imp     0x6223a28
        name    0xd982a8 bdx_OSVersionNumber
        types   0xdf34c8 f16@0:8
        imp     0x6223a74
        name    0xd982bc bdx_currentLanguage
        types   0xdf33de @16@0:8
        imp     0x6223ac0
        name    0xd982d0 bdx_currentRegion
        types   0xdf33de @16@0:8
        imp     0x6223b10
        name    0xd982e2 bdx_isJailBroken
        types   0xdf3410 B16@0:8
        imp     0x6223b68
        name    0xd982f3 bdx_carrierName
        types   0xdf33de @16@0:8
        imp     0x6223bfc
        name    0xd98303 bdx_carrierMCC
        types   0xdf33de @16@0:8
        imp     0x6223c64
        name    0xd98312 bdx_carrierMNC
        types   0xdf33de @16@0:8
        imp     0x6223ccc
        name    0xd98321 bdx_poorDevice
        types   0xdf3410 B16@0:8
        imp     0x6223d34
        name    0xd98330 bdx_screenScale
        types   0xdf3396 d16@0:8
        imp     0x6223dec
        name    0xd98340 bdx_is480Screen
        types   0xdf3410 B16@0:8
        imp     0x6223e38
        name    0xd98350 bdx_is568Screen
        types   0xdf3410 B16@0:8
        imp     0x6223e90
        name    0xd98360 bdx_is667Screen
        types   0xdf3410 B16@0:8
        imp     0x6223ee8
        name    0xd98370 bdx_is736Screen
        types   0xdf3410 B16@0:8
        imp     0x6223f40
        name    0xd98380 bdx_is812Screen
        types   0xdf3410 B16@0:8
        imp     0x6223f98
        name    0xd98390 bdx_is896Screen
        types   0xdf3410 B16@0:8
        imp     0x6223ff0
        name    0xd983a0 bdx_isScreenWidthLarge320
        types   0xdf3410 B16@0:8
        imp     0x6224048
        name    0xd96d2c bdx_isIPhoneXSeries
        types   0xdf3410 B16@0:8
        imp     0x62240ac
        name    0xd983ba bdx_screenSize
        types   0xdf420a {CGSize=dd}16@0:8
        imp     0x6224310
        name    0xd983c9 bdx_screenWidth
        types   0xdf3396 d16@0:8
        imp     0x622436c
        name    0xd983d9 bdx_screenHeight
        types   0xdf3396 d16@0:8
        imp     0x62243b8
        name    0xd983ea bdx_isPadDevice
        types   0xdf3410 B16@0:8
        imp     0x6224404
        name    0xd98265 bdx_resolution
        types   0xdf420a {CGSize=dd}16@0:8
        imp     0x6224454
        name    0xd983fa bdx_resolutionString
        types   0xdf33de @16@0:8
        imp     0x62244e8
        name    0xd9840f bdx_onePixel
        types   0xdf3396 d16@0:8
        imp     0x6224534
        name    0xd9841c bdx_deviceWidthType
        types   0xdf3437 Q16@0:8
        imp     0x62245a4
        name    0xd98430 bdx_getTotalDiskSpace
        types   0xdf3302 q16@0:8
        imp     0x62246f4
        name    0xd98446 bdx_getFreeDiskSpace
        types   0xdf3302 q16@0:8
        imp     0x62247b0
    protocols 0x0
    instanceProperties 0x0

-》

name 0xd982e2 bdx_isJailBroken

name 0xe1bc2c BDXAdditions

cls 0x0 _OBJC_CLASS_$_UIDevice

000000000036aa78 0x3cd4a0

以及：

000000000036aba8 0x3d60e0
    name      0xe1ce54 BTDAdditions
    cls       0x0 _OBJC_CLASS_$_UIDevice
    instanceMethods 0x0
    classMethods 0x3d5d90
        entsize 24
        count   35
        name    0xd99a94 btd_runningProcesses
        types   0xdf33de @16@0:8
        imp     0x62a5ec0
        name    0xd98227 getSysInfoByName:
        types   0xe05b74 @24@0:8*16
        imp     0x59911f8
        name    0xd8df0a btd_platform
        types   0xdf33de @16@0:8
        imp     0x59911e4
        name    0xd99aa9 btd_hwmodel
        types   0xdf33de @16@0:8
        imp     0x62a6230
        name    0xd99a74 btd_platformType
        types   0xdf3437 Q16@0:8
        imp     0x62a6244
        name    0xd8d746 btd_platformName
        types   0xdf33de @16@0:8
        imp     0x62a718c
        name    0xd8d733 btd_platformString
        types   0xdf33de @16@0:8
        imp     0x62a71e8
        name    0xd8c129 btd_OSVersion
        types   0xdf33de @16@0:8
        imp     0x5991188
        name    0xd99ab5 btd_OSVersionNumber
        types   0xdf34c8 f16@0:8
        imp     0x5b74794
        name    0xd8d757 btd_currentLanguage
        types   0xdf33de @16@0:8
        imp     0x62a75e4
        name    0xd99ac9 btd_currentRegion
        types   0xdf33de @16@0:8
        imp     0x62a7644
        name    0xd99adb btd_isJailBroken
        types   0xdf3410 B16@0:8
        imp     0x62a76ac
        name    0xd99aec btd_carrierName
        types   0xdf33de @16@0:8
        imp     0x62a7760
        name    0xd99afc btd_carrierMCC
        types   0xdf33de @16@0:8
        imp     0x62a77e0
        name    0xd99b0b btd_carrierMNC
        types   0xdf33de @16@0:8
        imp     0x62a7860
        name    0xd99b1a btd_poorDevice
        types   0xdf3410 B16@0:8
        imp     0x62a78e0
        name    0xd99b29 btd_screenScale
        types   0xdf3396 d16@0:8
        imp     0x62a79d4
        name    0xd99b39 btd_is480Screen
        types   0xdf3410 B16@0:8
        imp     0x62a7a30
        name    0xd99b49 btd_is568Screen
        types   0xdf3410 B16@0:8
        imp     0x62a7aa0
        name    0xd99b59 btd_is667Screen
        types   0xdf3410 B16@0:8
        imp     0x62a7b10
        name    0xd99b69 btd_is736Screen
        types   0xdf3410 B16@0:8
        imp     0x62a7b80
        name    0xd99b79 btd_is812Screen
        types   0xdf3410 B16@0:8
        imp     0x62a7bf0
        name    0xd99b89 btd_is896Screen
        types   0xdf3410 B16@0:8
        imp     0x62a7c60
        name    0xd99b99 btd_isScreenWidthLarge320
        types   0xdf3410 B16@0:8
        imp     0x62a7cd0
        name    0xd8cbb0 btd_isIPhoneXSeries
        types   0xdf3410 B16@0:8
        imp     0x62a7d44
        name    0xd99bb3 btd_screenSize
        types   0xdf420a {CGSize=dd}16@0:8
        imp     0x62a8004
        name    0xd99bc2 btd_screenWidth
        types   0xdf3396 d16@0:8
        imp     0x5991320
        name    0xd99bd2 btd_screenHeight
        types   0xdf3396 d16@0:8
        imp     0x599137c
        name    0xd99be3 btd_isPadDevice
        types   0xdf3410 B16@0:8
        imp     0x5b1743c
        name    0xd99a85 btd_resolution
        types   0xdf420a {CGSize=dd}16@0:8
        imp     0x5a03198
        name    0xd99bf3 btd_resolutionString
        types   0xdf33de @16@0:8
        imp     0x62a8068
        name    0xd99c08 btd_onePixel
        types   0xdf3396 d16@0:8
        imp     0x5b19920
        name    0xd99c15 btd_deviceWidthType
        types   0xdf3437 Q16@0:8
        imp     0x62a80b4
        name    0xd99c29 btd_getTotalDiskSpace
        types   0xdf3302 q16@0:8
        imp     0x62a8224
        name    0xd99c3f btd_getFreeDiskSpace
        types   0xdf3302 q16@0:8
        imp     0x62a8324
    protocols 0x0
    instanceProperties 0x0

-》

name 0xd99adb btd_isJailBroken

name 0xe1ce54 BTDAdditions

cls 0x0 OBJC_CLASS$_UIDevice

-》前面2个：

BDXAdditions

BTDAdditions

都是属于：

cls 0x0 _OBJC_CLASS_$_UIDevice

-》估计都是：

集成自 = 父类是：UIDevice

另外：

BTDAdditions

btd_carrierName

btd_carrierMCC

btd_carrierMNC

btd_poorDevice

等，好像和：

检测当前设备信息

改机参数

有关 -》 也算是，和检测越狱有关？

-tV

➜  AwemeCore.framework otool -tV AwemeCore > otool_tV_AwemeCore.txt

输出：

AwemeCore:
(__TEXT,__text) section

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 11:22:52

MaskPro.dylib

otool用法举例：MaskPro.dylib

-l

➜  DynamicLibraries otool -l MaskPro.dylib > MaskProDylib/MaskProDylib_otool_l.txt

输出：

-oV

➜  DynamicLibraries otool -oV MaskPro.dylib > MaskProDylib/MaskProDylib_otool_oV.txt

输出：

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 23:21:52

help

otool的help语法

✘ crifan@licrifandeMacBook-Pro  ~  otool -help
error: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/otool: unknown char `p' in flag -help

Usage: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/otool [-arch arch_type] [-fahlLDtdorSTMRIHGvVcXmqQjCP] [-mcpu=arg] [--version] <object file> ...
    -f print the fat headers
    -a print the archive header
    -h print the mach header
    -l print the load commands
    -L print shared libraries used
    -D print shared library id name
    -t print the text section (disassemble with -v)
    -p <routine name>  start dissassemble from routine name
    -s <segname> <sectname> print contents of section
    -d print the data section
    -o print the Objective-C segment
    -r print the relocation entries
    -S print the table of contents of a library (obsolete)
    -T print the table of contents of a dynamic shared library (obsolete)
    -M print the module table of a dynamic shared library (obsolete)
    -R print the reference table of a dynamic shared library (obsolete)
    -I print the indirect symbol table
    -H print the two-level hints table (obsolete)
    -G print the data in code table
    -v print verbosely (symbolically) when possible
    -V print disassembled operands symbolically
    -c print argument strings of a core file
    -X print no leading addresses or headers
    -m don't use archive(member) syntax
    -B force Thumb disassembly (ARM objects only)
    -q use llvm's disassembler (the default)
    -Q use otool(1)'s disassembler
    -mcpu=arg use `arg' as the cpu for disassembly
    -j print opcode bytes
    -P print the info plist section as strings
    -C print linker optimization hints
    --version print the version of /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/otool

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-04 22:58:13

pagestuff

pagestuff

pagestuff

是什么：Mach-O格式文件分析工具

作用：显示Mach-O的每个逻辑页的信息，比如section名称、符号表等

注：不支持FAT格式的Mach-O

安装

无需安装

Mac中自带

路径：/usr/bin/pagestuff

使用

举例

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 22:04:48

help

pagestuff的help语法

➜  ~ pagestuff
Usage: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/pagestuff mach-o [-arch name] [-p] [-a] pagenumber [pagenumber ...]

man手册

PAGESTUFF(1)                                               General Commands Manual                                                 PAGESTUFF(1)

NAME
       pagestuff - Mach-O file page analysis tool

SYNOPSIS
       pagestuff file [-a] [-p] [pagenumber...]

DESCRIPTION
       pagestuff  displays information about the specified logical pages of a file conforming to the Mach-O executable format.  For each specified
       page of code, symbols (function and static data structure names) are displayed.  If no pages are specified, symbols for all  pages  in  the
       __TEXT, __text section are displayed.

       The options to pagestuff(1) are:

       -a     Displays all pages.  All other arguments are ignored.

       -p     Print  a     list  of the sections of the specified Mach-O file, with offsets and lengths.  All other arguments are ignored.  Note that
              the size(1) tool given arguments "-m -l -x" displays a much more concise listing.

SEE ALSO
       Mach-O(5), size(1)

Apple Computer, Inc.                                           January 3, 2001                                                     PAGESTUFF(1)

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 16:03:03

附录

附录

下面列出相关参考资料。

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2022-03-17 20:39:28

Mach-O文档和资料

Mach-O文档和资料

Mach-O的官网文档

旧资料

已失效

http://developer.apple.com/mac/library/documentation/DeveloperTools/Conceptual/MachORuntime/Reference/reference.html

现存有效的

PDF

osx-abi-macho-file-format-reference/Mach-O_File_Format.pdf at master · aidansteele/osx-abi-macho-file-format-reference (github.com)

Mach-O_File_Format.pdf

https://github.com/aidansteele/osx-abi-macho-file-format-reference/raw/master/Mach-O_File_Format.pdf

网页（只有文字，无图）

https://web.archive.org/web/20090901205800/http://developer.apple.com/mac/library/documentation/DeveloperTools/Conceptual/MachORuntime/Reference/reference.html

aidansteele/osx-abi-macho-file-format-reference: Mirror of OS X ABI Mach-O File Format Reference (github.com)

新资料

Overview of the Mach-O Executable Format (apple.com)

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-06 16:50:17

参考资料

参考资料

【整理】iOS中的XNU

【记录】静态分析Mask的动态库：MaskPro.dylib

【整理】去研究Mach-O格式

【记录】Mach-O格式相关资料

【整理】苹果的二进制格式Mach-O的详细定义

【整理】Mach-O格式和启动相关

【记录】用otool查看分析二进制和库文件信息

【记录】用otool去分析抖音二进制AwemeCore

【未解决】Mac中用otool查看ELF格式二进制库文件信息

【已解决】Mac M2 Max中安装和使用jtool2

【记录】用jtool查看抖音二进制信息

【规避解决】Mac M2 Max中jtool2运行崩溃：killed

【未解决】Mac中找命令行工具运行jtool2报错killed的崩溃日志文件

【已解决】iOS逆向：jtool2在Mac M2 Max中运行崩溃AMFI Unrecoverable CT signature issue, bailing out

【规避解决】iOS逆向：jtool2在Mac M2 Max中运行崩溃AMFI unsuitable CT policy 0 for this platform/device, rejecting signature

【记录】用radare2查看抖音二进制信息

【记录】用rabin2查看抖音AwemeCore二进制的信息

【部分解决】用MachOView查看抖音二进制AwemeCore的信息

【已解决】Mac中编译生成gdbinit的MachOView的app

【已解决】用jtool2查看Mach-O的二进制akd找代码段相关信息

【已解决】Mach-O中LC相关Load Command的数值定义和含义

【已解决】LC_DYLD_CHAINED_FIXUPS和LC_DYLD_EXPORTS_TRIE等Load Command的含义

【未解决】Mach-O中_DATA的__la_symbol_ptr含义

【未解决】Mach-O中的__got的含义

【记录】用MachOView查看分析黑豹动态库zzzzHeiBaoLib.dylib

【整理】iOS二进制包含多个架构：FAT

【未解决】iOS逆向iOS15的debugserver出错：用lipo瘦身

【已解决】iOS逆向iOS15：用lipo给FAT格式瘦身

【记录】Mach-O二进制中的VM Address虚拟内存地址和RAW原始地址

【已解决】iOS逆向akd：从Mach-O二进制文件akd中查看代码码段opcode二进制数据

【已解决】用MachOView查看arm64的akd的代码段相关信息

【记录】Mac中用MachOView查看arm64的main二进制

可执行文件格式

可执行文件格式：ELF

Confusion about mach-o offsets and addresses : jailbreakdevelopers (reddit.com)

XLsn0w/Cydia

XNU - 维基百科，自由的百科全书 (wikipedia.org)

Kernel - The iPhone Wiki

Apple Open Source

Source Browser (apple.com)

iOS/Mach_and_BSD.md at master · writeups/iOS · GitHub

Mach-O - Wikipedia

Introduction to Code Size Performance Guidelines (apple.com)

aidansteele/osx-abi-macho-file-format-reference: Mirror of OS X ABI Mach-O File Format Reference (github.com)

Understanding the Mach-O File Format | by Travis Matthews | Medium

Parsing Mach-O files - Low Level Bits

Mach-O Executables · objc.io

The Mach-O binary file format - Mobile Application Penetration Testing [Book] (oreilly.com)

Understanding the Mach-O File Format - DEV Community

Overview of Mach-O binary | Efiens Blog

So Macho - A look at Apple executable files | Red Maple Technologies

How to Reverse Engineer an iOS App and macOS Software | Apriorit

A Deep Dive into Core Dumps on iOS · iOS Snapshot Fuzzing (tkopf.de)

iOS/Bypassing-AMFI.md at master · writeups/iOS · GitHub

iOS/Mach-O.md at master · writeups/iOS · GitHub

iOS dyld - 简书 (jianshu.com)

Package ld - The Go Programming Language (google.cn)

osx-abi-macho-file-format-reference/Mach-O_File_Format.pdf at master · aidansteele/osx-abi-macho-file-format-reference (github.com)

Mac Dev Center: Mac OS X ABI Mach-O File Format Reference

aidansteele/osx-abi-macho-file-format-reference: Mirror of OS X ABI Mach-O File Format Reference (github.com)

Overview of the Mach-O Executable Format (apple.com)

Position-Independent Code

Mach-O文件结构理解 | LJ小窝 (jianli2017.top)

Edgar's Blog (tbfungeek.github.io)

Building Mach-O Files (apple.com)

Crack prevention - iPhone Development Wiki

iOS逆向----iOS11以后绕过越狱检测-CSDN博客

0xced/class-dump at swift-binaries (github.com)

Symbolicating iOS Crash Reports and Logs | Bugsnag Blog

求教optool的使用方法 - 技术讨论 | Discussion - iOSRE

编写dylib_iOS逆向-无需越狱注入动态库 - CodeAntenna

excitedplus1s/jtool2: jtool2 support Mac arm64 and x86_64

Rabin2 - The Official Radare2 Book

File Identification - The Official Radare2 Book

Imports - The Official Radare2 Book

Exports - The Official Radare2 Book

Symbols - The Official Radare2 Book

Libraries - The Official Radare2 Book

Strings - The Official Radare2 Book

Program Sections - The Official Radare2 Book

JTool2 - Taking the O out of otool - squared (newosxbook.com)

MachO文件格式 (liangmc.com)

Mach-O/README.md at master · XLsn0w/Mach-O (github.com)

XLsn0w/Mach-O: Mach-O其实是Mach Object文件格式的缩写，是macOS以及iOS上可执行文件的格式 (github.com)

How to Reverse Engineer and Patch an iOS Application for Beginners: Part I (inversecos.com)

pagestuff(1) [osx man page] (unix.com)

Mach-O文件介绍之ASLR(进程地址空间布局随机化) | ctinusDev's Blog

Jailbreak Detection • Sandbox integrity (slideshare.net)

macho.rs - source (docs.rs)

llios/chained_fixups.md at main · qyang-nj/llios (github.com)

llios/README.md at main · qyang-nj/llios (github.com)

iOS逆向分析笔记 - 简书 (jianshu.com)

iOS-Reverse/README.md at master · XLsn0w/iOS-Reverse (github.com)

[iOS 逆向 12] 加密与动态保护_Eric's Blog-程序员ITS404 - 程序员ITS404

探究Mach-O文件 - 掘金 (juejin.cn)

Principle of Dynamic Linking of Imported Functions in Mach-O (apriorit.com)

图解 Mach-O 中的 got - 掘金 (juejin.cn)

Understanding Concepts of VA, RVA and File Offsets (tech-zealots.com)

ida - Mach-O : Convert virtual address to file offset on disk - Reverse Engineering Stack Exchange

disassembly - Convert Mach-O VM Address To File Offset - Reverse Engineering Stack Exchange

iOS Tampering and Reverse Engineering - OWASP Mobile Application Security

今日头条优化实践： iOS 包大小二进制优化，一行代码减少 60 MB 下载大小移动字节跳动技术团队_InfoQ精选文章

crifan.org，使用署名4.0国际(CC BY 4.0)协议发布 all right reserved，powered by Gitbook最后更新： 2023-10-07 22:17:52