Struct malwaredb_types::exec::macho::Macho

pub struct Macho<'a> {
    pub is64bit: bool,
    pub arch: Architecture,
    pub has_overlay: Option<bool>,
    pub ordering: Ordering,
    pub executable_type: ExecutableType,
    pub os: OperatingSystem,
    pub sections: Option<Sections<'a>>,
    pub imports: Option<Imports>,
    pub contents: &'a [u8],
}

Fields

is64bit: bool

If the program is 64-bit

arch: Architecture

Instruction set architecture for this binary

has_overlay: Option<bool>

If the binary has extra data after the last section, could be used to hide something

ordering: Ordering

Byte ordering for this binary

executable_type: ExecutableType

Executable subtype: Program, Library, or Core file?

os: OperatingSystem

Operating System for this binary, going to be Mac OS or some derivative, could be NeXTSTEP

sections: Option<Sections<'a>>

Sections of this binary

imports: Option<Imports>

External libraries used by this application or library

contents: &'a [u8]

The array containing the raw bytes used to parse this program

Implementations

impl<'a> Macho<'a>

pub fn from(contents: &'a [u8]) -> Result<Self>

Trait Implementations

impl<'a> Clone for Macho<'a>

fn clone(&self) -> Macho<'a>

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for Macho<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> Display for Macho<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> ExecutableFile for Macho<'a>

fn type_name(&self) -> String

fn architecture(&self) -> &Architecture

fn pointer_size(&self) -> usize

fn operating_system(&self) -> &OperatingSystem

fn compiled_timestamp(&self) -> Option<DateTime<Utc>>

fn num_sections(&self) -> u32

fn sections(&self) -> Result<&Sections<'_>>

impl<'a> TypeMagic for Macho<'a>

const MAGIC: &'static [&'static [u8]] = _