Struct FatMacho 

pub struct FatMacho<'a> {
    pub binaries: Vec<Macho<'a>>,
    pub has_overlay: Option<bool>,
    pub contents: &'a [u8],
}

Available on crate feature macho only.

Fat Mach-O files contain executable code for more than one architecture, allowing the same binary to be run on different hardware, such as the same file working on Power PC, Intel, and Apple Silicon machines.

This format is an array of Mach-O files. However, the magic number is also used for Java class files, so we need to make sure the amount of stored binaries makes sense. Too high, and it’s probably the Java class version and not the number of contained Mach Objects.

Fields

binaries: Vec<Macho<'a>>

The embedded Mach-O files within

has_overlay: Option<bool>

If the binary has extra data after the last section, could be used to hide something

contents: &'a [u8]

The array containing the raw bytes used to parse this program

Implementations

impl<'a> FatMacho<'a>

pub fn from(contents: &'a [u8]) -> Result<Self>

Fat Mach-O parsed from a sequence of bytes

Errors

Returns an error if parsing fails.

Trait Implementations

impl<'a> Clone for FatMacho<'a>

fn clone(&self) -> FatMacho<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for FatMacho<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for FatMacho<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ExecutableFile for FatMacho<'_>

fn architecture(&self) -> Option<Architecture>

Get the architecture type

fn pointer_size(&self) -> usize

Get the pointer size, 32- or 64-bit

fn operating_system(&self) -> OperatingSystem

Get the operating system type for a binary

fn compiled_timestamp(&self) -> Option<DateTime<Utc>>

Get the compilation timestamp, if available

fn num_sections(&self) -> u32

Number of sections for a binary

fn sections(&self) -> Option<&Vec<Section<'_>>>

Vec of sections for the binary

fn import_hash(&self) -> Option<Uuid>

Import hash of the binary

fn fuzzy_imports(&self) -> Option<String>

SSDeep fuzzy hash of the binary

impl SpecimenFile for FatMacho<'_>

const MAGIC: &'static [&'static [u8]]

Magic number, the bytes at the beginning of the file, which identify the file format Some file types have more than one possible magic number

fn type_name(&self) -> &'static str

Common name for a specific file type