blob: 4f97cc0345eb191586392f87296153e4d2c8db68 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
#------------------------------------------------------------------------------
# $File: cafebabe,v 1.28 2022/07/01 23:24:47 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
# the test must be performed in the same "magic" sequence to get both right.
# The long at offset 4 in a Mach-O universal binary tells the number of
# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
# version and the short at offset 6 is the JVM major version. Since there are only
# only 18 labeled Mach-O architectures at current, and the first released
# Java class format was version 43.0, we can safely choose any number
# between 18 and 39 to test the number of architectures against
# (and use as a hack). Let's not use 18, because the Mach-O people
# might add another one or two as time goes by...
#
### JAVA START ###
# Reference: http://en.wikipedia.org/wiki/Java_class_file
# Update: Joerg Jenderek
0 belong 0xcafebabe
>4 ubelong >30 compiled Java class data,
!:mime application/x-java-applet
#!:mime application/java-byte-code
!:ext class
>>6 ubeshort x version %d.
>>4 ubeshort x \b%d
# for debugging purpose version as hexadecimal to compare with Mach-O universal binary
#>>4 ubelong x (%#8.8x)
# Which is which?
# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html
#>>4 belong 0x002b (Java 0.?)
#>>4 belong 0x032d (Java 1.0)
#>>4 belong 0x032d (Java 1.1)
>>4 belong 0x002e (Java 1.2)
>>4 belong 0x002f (Java 1.3)
>>4 belong 0x0030 (Java 1.4)
>>4 belong 0x0031 (Java 1.5)
>>4 belong 0x0032 (Java 1.6)
>>4 belong 0x0033 (Java 1.7)
>>4 belong 0x0034 (Java 1.8)
>>4 belong 0x0035 (Java SE 9)
>>4 belong 0x0036 (Java SE 10)
>>4 belong 0x0037 (Java SE 11)
>>4 belong 0x0038 (Java SE 12)
>>4 belong 0x0039 (Java SE 13)
>>4 belong 0x003A (Java SE 14)
>>4 belong 0x003B (Java SE 15)
>>4 belong 0x003C (Java SE 16)
>>4 belong 0x003D (Java SE 17)
>>4 belong 0x003E (Java SE 18)
>>4 belong 0x003F (Java SE 19)
>>4 belong 0x0040 (Java SE 20)
# pool count unequal zero
#>>8 beshort x \b, pool count %#x
# pool table
#>>10 ubequad x \b, pool %#16.16llx...
0 belong 0xcafed00d JAR compressed with pack200,
>5 byte x version %d.
>4 byte x \b%d
!:mime application/x-java-pack200
0 belong 0xcafed00d JAR compressed with pack200,
>5 byte x version %d.
>4 byte x \b%d
!:mime application/x-java-pack200
### JAVA END ###
### MACH-O START ###
# URL: https://en.wikipedia.org/wiki/Mach-O
0 name mach-o \b [
# for debugging purpose CPU type as hexadecimal
#>0 ubequad x CPU=%16.16llx
# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
>0 use mach-o-cpu \b
# for debugging purpose print offset to 1st mach_header like:
# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
#>8 ubelong x at %#x offset
>(8.L) indirect x \b:
>0 belong x \b]
# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/
# include/mach-o/fat.h
# include/mach/machine.h
0 belong 0xcafebabe
>4 belong 1 Mach-O universal binary with 1 architecture:
!:mime application/x-mach-binary
>>8 use mach-o \b
# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
>4 ubelong >1
>>4 ubelong <20 Mach-O universal binary with %d architectures:
!:mime application/x-mach-binary
>>>8 use mach-o \b
>>>4 ubelong >1
>>>>28 use mach-o \b
>>>4 ubelong >2
>>>>48 use mach-o \b
>>>4 ubelong >3
>>>>68 use mach-o \b
>>>4 ubelong >4
>>>>88 use mach-o \b
>>>4 ubelong >5
>>>>108 use mach-o \b
### MACH-O END ###
|
