hexspell 1.0.0

Dependency-free Rust library for parsing and patching PE, ELF, and Mach-O executables with a 1:1 on-disk API
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

//! Bitcode bundle detection (`__LLVM` segment).
//!
//! LLVM bitcode is stored in a `__LLVM` segment (often with a `__bundle` section). HexSpell exposes
//! the segment and its sections as parsed layout entries — it does not decode the bitcode IR.

use super::section::SectionEntry;
use super::segment::SegmentEntry;

/// Name of the LLVM bitcode segment in Mach-O images.
pub const LLVM_SEGMENT_NAME: &str = "__LLVM";

/// Typical section name holding the bitcode bundle.
pub const LLVM_BUNDLE_SECTION: &str = "__bundle";

/// Returns the `__LLVM` segment, if present.
pub fn llvm_segment(segments: &[SegmentEntry]) -> Option<&SegmentEntry> {
    segments
        .iter()
        .find(|s| s.name().trim_end_matches('\0') == LLVM_SEGMENT_NAME)
}

/// Returns every section nested under the `__LLVM` segment.
pub fn llvm_sections<'a>(
    _segments: &'a [SegmentEntry],
    sections: &'a [SectionEntry],
) -> Vec<&'a SectionEntry> {
    sections
        .iter()
        .filter(|s| s.segment_name().trim_end_matches('\0') == LLVM_SEGMENT_NAME)
        .collect()
}