pub struct Macho { /* private fields */ }Expand description
These fields contain Mac OS Mach Object file format (Mach-O) metadata.
Implementations§
Source§impl Macho
impl Macho
Sourcepub fn get_go_import_hash(&self) -> Option<&String>
pub fn get_go_import_hash(&self) -> Option<&String>
A hash of the Go language imports in a Mach-O file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
Sourcepub fn set_go_import_hash(&mut self, go_import_hash_arg: String)
pub fn set_go_import_hash(&mut self, go_import_hash_arg: String)
A hash of the Go language imports in a Mach-O file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
§Example
10bddcb4cee42080f76c88d9ff964491
Sourcepub fn get_go_imports_names_entropy(&self) -> Option<&u64>
pub fn get_go_imports_names_entropy(&self) -> Option<&u64>
Shannon entropy calculation from the list of Go imports.
Sourcepub fn set_go_imports_names_entropy(
&mut self,
go_imports_names_entropy_arg: u64,
)
pub fn set_go_imports_names_entropy( &mut self, go_imports_names_entropy_arg: u64, )
Shannon entropy calculation from the list of Go imports.
Sourcepub fn get_go_imports_names_var_entropy(&self) -> Option<&u64>
pub fn get_go_imports_names_var_entropy(&self) -> Option<&u64>
Variance for Shannon entropy calculation from the list of Go imports.
Sourcepub fn set_go_imports_names_var_entropy(
&mut self,
go_imports_names_var_entropy_arg: u64,
)
pub fn set_go_imports_names_var_entropy( &mut self, go_imports_names_var_entropy_arg: u64, )
Variance for Shannon entropy calculation from the list of Go imports.
Sourcepub fn get_go_imports(&self) -> Option<&String>
pub fn get_go_imports(&self) -> Option<&String>
List of imported Go language element names and types.
Sourcepub fn set_go_imports(&mut self, go_imports_arg: String)
pub fn set_go_imports(&mut self, go_imports_arg: String)
List of imported Go language element names and types.
Sourcepub fn get_go_stripped(&self) -> Option<&bool>
pub fn get_go_stripped(&self) -> Option<&bool>
Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
Sourcepub fn set_go_stripped(&mut self, go_stripped_arg: bool)
pub fn set_go_stripped(&mut self, go_stripped_arg: bool)
Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
Sourcepub fn get_import_hash(&self) -> Option<&String>
pub fn get_import_hash(&self) -> Option<&String>
A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
This is a synonym for symhash.
Sourcepub fn set_import_hash(&mut self, import_hash_arg: String)
pub fn set_import_hash(&mut self, import_hash_arg: String)
A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
This is a synonym for symhash.
§Example
d41d8cd98f00b204e9800998ecf8427e
Sourcepub fn get_imports(&self) -> &Vec<String>
pub fn get_imports(&self) -> &Vec<String>
List of imported element names and types.
Sourcepub fn add_import(&mut self, import_arg: String)
pub fn add_import(&mut self, import_arg: String)
List of imported element names and types.
Sourcepub fn get_imports_names_entropy(&self) -> Option<&u64>
pub fn get_imports_names_entropy(&self) -> Option<&u64>
Shannon entropy calculation from the list of imported element names and types.
Sourcepub fn set_imports_names_entropy(&mut self, imports_names_entropy_arg: u64)
pub fn set_imports_names_entropy(&mut self, imports_names_entropy_arg: u64)
Shannon entropy calculation from the list of imported element names and types.
Sourcepub fn get_imports_names_var_entropy(&self) -> Option<&u64>
pub fn get_imports_names_var_entropy(&self) -> Option<&u64>
Variance for Shannon entropy calculation from the list of imported element names and types.
Sourcepub fn set_imports_names_var_entropy(
&mut self,
imports_names_var_entropy_arg: u64,
)
pub fn set_imports_names_var_entropy( &mut self, imports_names_var_entropy_arg: u64, )
Variance for Shannon entropy calculation from the list of imported element names and types.
Sourcepub fn get_sections(&self) -> &Vec<String>
pub fn get_sections(&self) -> &Vec<String>
An array containing an object for each section of the Mach-O file.
The keys that should be present in these objects are defined by sub-fields underneath macho.sections.*.
Sourcepub fn add_section(&mut self, section_arg: String)
pub fn add_section(&mut self, section_arg: String)
An array containing an object for each section of the Mach-O file.
The keys that should be present in these objects are defined by sub-fields underneath macho.sections.*.
Sourcepub fn get_sections_entropy(&self) -> Option<&u64>
pub fn get_sections_entropy(&self) -> Option<&u64>
Shannon entropy calculation from the section.
Sourcepub fn set_sections_entropy(&mut self, sections_entropy_arg: u64)
pub fn set_sections_entropy(&mut self, sections_entropy_arg: u64)
Shannon entropy calculation from the section.
Sourcepub fn get_sections_name(&self) -> Option<&String>
pub fn get_sections_name(&self) -> Option<&String>
Mach-O Section List name.
Sourcepub fn set_sections_name(&mut self, sections_name_arg: String)
pub fn set_sections_name(&mut self, sections_name_arg: String)
Mach-O Section List name.
Sourcepub fn get_sections_physical_size(&self) -> Option<&u64>
pub fn get_sections_physical_size(&self) -> Option<&u64>
Mach-O Section List physical size.
Sourcepub fn set_sections_physical_size(&mut self, sections_physical_size_arg: u64)
pub fn set_sections_physical_size(&mut self, sections_physical_size_arg: u64)
Mach-O Section List physical size.
Sourcepub fn get_sections_var_entropy(&self) -> Option<&u64>
pub fn get_sections_var_entropy(&self) -> Option<&u64>
Variance for Shannon entropy calculation from the section.
Sourcepub fn set_sections_var_entropy(&mut self, sections_var_entropy_arg: u64)
pub fn set_sections_var_entropy(&mut self, sections_var_entropy_arg: u64)
Variance for Shannon entropy calculation from the section.
Sourcepub fn get_sections_virtual_size(&self) -> Option<&u64>
pub fn get_sections_virtual_size(&self) -> Option<&u64>
Mach-O Section List virtual size. This is always the same as physical_size.
Sourcepub fn set_sections_virtual_size(&mut self, sections_virtual_size_arg: u64)
pub fn set_sections_virtual_size(&mut self, sections_virtual_size_arg: u64)
Mach-O Section List virtual size. This is always the same as physical_size.
Sourcepub fn get_symhash(&self) -> Option<&String>
pub fn get_symhash(&self) -> Option<&String>
A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
This is a Mach-O implementation of the Windows PE imphash
Sourcepub fn set_symhash(&mut self, symhash_arg: String)
pub fn set_symhash(&mut self, symhash_arg: String)
A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
This is a Mach-O implementation of the Windows PE imphash
§Example
d3ccf195b62a9279c3c19af1080497ec