PHP怎样解析Mach-O可执行文件 Mach-O文件解析技巧分享

<?php

function read_mach_header(string $file_path): array
{
    $file_handle = fopen($file_path, 'rb');
    if (!$file_handle) {
        throw new Exception("无法打开文件: $file_path");
    }

    // 读取文件头的前32个字节，足以包含关键信息
    $header_data = fread($file_handle, 32);
    fclose($file_handle);

    // 检查魔数，判断是32位还是64位
    $magic = unpack('Nmagic', substr($header_data, 0, 4))['magic'];

    $is_64bit = false;
    if ($magic == 0xfeedfacf || $magic == 0xfeedface) { // 32位魔数
        $format = 'Nmagic/Ncpu_type/Ncpu_subtype/Nfile_type/Nnum_load_commands/Nsize_load_commands/Nflags';
    } elseif ($magic == 0xfeedfacf || $magic == 0xfeedfacf) { // 64位魔数
        $is_64bit = true;
        $format = 'Nmagic/Ncpu_type/Ncpu_subtype/Nfile_type/Nnum_load_commands/Nsize_load_commands/Nflags/Nreserved';
    } else {
        throw new Exception("未知Mach-O魔数: 0x" . dechex($magic));
    }

    $header = unpack($format, $header_data);

    return $header;
}

try {
    $header = read_mach_header('/path/to/your/macho/file');
    print_r($header);
} catch (Exception $e) {
    echo "错误: " . $e->getMessage() . "\n";
}

?>

<?php

function read_load_commands(string $file_path, array $header): array
{
    $file_handle = fopen($file_path, 'rb');
    if (!$file_handle) {
        throw new Exception("无法打开文件: $file_path");
    }

    // 跳过文件头
    fseek($file_handle, $header['size_load_commands'] + 32);

    $load_commands = [];
    for ($i = 0; $i < $header['num_load_commands']; $i++) {
        $command_header_data = fread($file_handle, 8); // Load Command头部固定为8字节
        $command_header = unpack('Ncommand_type/Ncommand_size', $command_header_data);

        $load_commands[] = $command_header;

        // 根据command_type和command_size读取剩余数据，这里省略具体解析过程
        fseek($file_handle, $command_header['command_size'] - 8, SEEK_CUR);
    }

    fclose($file_handle);
    return $load_commands;
}

try {
    $header = read_mach_header('/path/to/your/macho/file');
    $load_commands = read_load_commands('/path/to/your/macho/file', $header);
    print_r($load_commands);
} catch (Exception $e) {
    echo "错误: " . $e->getMessage() . "\n";
}

?>

<?php

function extract_code_segment(string $file_path, array $header): ?string
{
    $file_handle = fopen($file_path, 'rb');
    if (!$file_handle) {
        throw new Exception("无法打开文件: $file_path");
    }

    // 跳过文件头
    fseek($file_handle, $header['size_load_commands'] + 32);

    for ($i = 0; $i < $header['num_load_commands']; $i++) {
        $command_header_data = fread($file_handle, 8);
        $command_header = unpack('Ncommand_type/Ncommand_size', $command_header_data);

        if ($command_header['command_type'] == 0x1) { // LC_SEGMENT
            $segment_data = fread($file_handle, 64); // 读取LC_SEGMENT的数据
            $segment = unpack('a16segname/Vvmaddr/Vvmsize/Vfileoff/Vfilesize/Vmaxprot/Vinitprot/Vnsects/Vflags', $segment_data);

            if (trim($segment['segname']) == '__TEXT') {
                // 找到__TEXT段
                fseek($file_handle, $segment['fileoff']);
                $code = fread($file_handle, $segment['filesize']);
                fclose($file_handle);
                return $code;
            } else {
                fseek($file_handle, $command_header['command_size'] - 8 - 64, SEEK_CUR); // 跳过剩余数据
            }

        } else {
            fseek($file_handle, $command_header['command_size'] - 8, SEEK_CUR); // 跳过整个Load Command
        }
    }

    fclose($file_handle);
    return null;
}

try {
    $header = read_mach_header('/path/to/your/macho/file');
    $code = extract_code_segment('/path/to/your/macho/file', $header);

    if ($code) {
        echo "代码段提取成功，长度为：" . strlen($code) . "字节\n";
        // 可以将代码段保存到文件或进行其他处理
        // file_put_contents('code.bin', $code);
    } else {
        echo "未找到__TEXT段\n";
    }
} catch (Exception $e) {
    echo "错误: " . $e->getMessage() . "\n";
}

?>

<?php

function otool_dump(string $file_path, string $option): string
{
    $command = "otool {$option} {$file_path}";
    exec($command, $output, $return_var);

    if ($return_var !== 0) {
        throw new Exception("otool执行失败，返回码: {$return_var}");
    }

    return implode("\n", $output);
}

try {
    $output = otool_dump('/path/to/your/macho/file', '-hv'); // 显示文件头
    echo $output . "\n";

    $output = otool_dump('/path/to/your/macho/file', '-l'); // 显示Load Commands
    echo $output . "\n";

    $output = otool_dump('/path/to/your/macho/file', '-tv'); // 显示代码段
    echo $output . "\n";
} catch (Exception $e) {
    echo "错误: " . $e->getMessage() . "\n";
}

?>