hexspell 0.0.5

A open source lib to parse executables in Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74

//! Core structures describing the Mach-O header.
//!
//! The header identifies CPU architecture, file type and endianness for a
//! binary. Each field is wrapped in [`Field`](crate::field::Field) to ease
//! patching and the module provides helper routines for detecting the
//! correct [`Endianness`] when parsing additional data from the file.

use crate::errors;
use crate::field::Field;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Endianness {
    Little,
    Big,
}

#[derive(Debug)]
pub struct MachHeader {
    pub endianness: Endianness,
    pub magic: Field<u32>,
    pub cpu_type: Field<u32>,
    pub cpu_subtype: Field<u32>,
    pub file_type: Field<u32>,
    pub ncmds: Field<u32>,
    pub sizeofcmds: Field<u32>,
    pub flags: Field<u32>,
    pub reserved: Option<Field<u32>>, // Only Mach-O 64 bits
}

impl MachHeader {
    pub fn parse(buffer: &[u8], endianness: Endianness) -> Result<Self, errors::FileParseError> {
        if buffer.len() < 28 {
            return Err(errors::FileParseError::BufferOverflow);
        }

        let read_u32 = |offset: usize| -> Result<u32, errors::FileParseError> {
            let bytes: [u8; 4] = buffer
                .get(offset..offset + 4)
                .ok_or(errors::FileParseError::BufferOverflow)?
                .try_into()
                .map_err(|_| errors::FileParseError::BufferOverflow)?;
            Ok(match endianness {
                Endianness::Little => u32::from_le_bytes(bytes),
                Endianness::Big => u32::from_be_bytes(bytes),
            })
        };

        let magic = Field::new(read_u32(0)?, 0, 4);
        let cpu_type = Field::new(read_u32(4)?, 4, 4);
        let cpu_subtype = Field::new(read_u32(8)?, 8, 4);
        let file_type = Field::new(read_u32(12)?, 12, 4);
        let ncmds = Field::new(read_u32(16)?, 16, 4);
        let sizeofcmds = Field::new(read_u32(20)?, 20, 4);
        let flags = Field::new(read_u32(24)?, 24, 4);

        let reserved: Option<Field<u32>> = if buffer.len() >= 32 {
            Some(Field::new(read_u32(28)?, 28, 4))
        } else {
            None
        };

        Ok(MachHeader {
            endianness,
            magic,
            cpu_type,
            cpu_subtype,
            file_type,
            ncmds,
            sizeofcmds,
            flags,
            reserved,
        })
    }
}