使用 Rabin2 处理 Mach-0 文件我得到以下结果:
$ rabin2 -I mybinaryfile
arw 00000000000000000000000000000000000000000000000000000000000000001f0000000000000000000000170000001f0000001f0000000000000000000000
arch x86
baddr 0x0
binsz 69256
bintype mach0
bits 32
canary false
sanitiz false
class MACH0
crypto false
endian little
havecode true
laddr 0x0
lang c++
linenum false
lsyms false
machine 386
maxopsz 16
minopsz 1
nx false
os darwin
pcalign 0
pic false
relocs false
static true
stripped false
subsys darwin
va true
使用 Radare2 打开它会出现相同的“arw”行:
$ radare2 mybinaryfile
arw 00000000000000000000000000000000000000000000000000000000000000001f0000000000000000000000170000001f0000001f0000000000000000000000
-- radare2-built farm beats the facebook one.
[0x00000000]>
[0x00000000]> ih
0x00000000 Magic 0xfeedface
0x00000004 CpuType 0x7
0x00000008 CpuSubType 0x3
0x0000000c FileType 0x1
0x00000010 nCmds 3
0x00000014 sizeOfCmds 840
0x00000018 Flags 0x2000
0x00000020 cmd 0 0x1 LC_SEGMENT
0x00000024 cmdsize 736
0x00000300 cmd 1 0x2 LC_SYMTAB
0x00000304 cmdsize 24
0x00000318 cmd 2 0x5 LC_UNIXTHREAD
0x0000031c cmdsize 80
我已经搜索过,但没有找到任何答案。这个“arw”线是什么意思?