As some of you may have already been aware, for the past few weeks I have been working on Libhelper. This is a small library aimed at assisting the handling and parsing of Mach-O files, Image4 files and other things related to iOS Security analysis.

To test the library I had been writing a few tools - two of which I'm releasing today. I've also been working on HTool but that is still a little while off yet.

The tools I'm releasing today as part of the "Mach-O Helper Toolset" are macho-section and macho-split. There is not much to go over with the tools themselves, so I'll give some quick usage information and then discuss the toolset and my plan for it in the future.

Mach-O Section Tool

The aim of macho-section is to quickly carve out a segment/section of a Mach-O file. So, for example, if you would like to rip __TEXT.__const from a Mach-O you can do so like so:

$ macho-section kernel.macho __TEXT __const
-----------------------------------------------------
 macho-section 1.0.0 (macho-helper-100.14.1) - Built Thu Jan  9 00:00:33 2020
-----------------------------------------------------
Attempting to seperate __TEXT.__const from kernel.macho
Wrote file to __TEXT.__const.dat
$

You'll then have the relevant file available, so if you extracted a section with executable code you could pass that to a disassembler.

Mach-O Split Tool

The macho-split tool takes a Universal Binary / FAT file that contains multiple Mach-O's of different architectures and splits them into individual Mach-O files. Here is an example:

$ macho-split some_fat_fil
-----------------------------------------------------
 macho-split 1.0.0 (macho-helper-100.14.1) - Built Thu Jan  9 00:03:15 2020
-----------------------------------------------------
[*] some_fat_file: Mach-O Universal Binary. Found 4 architectures.
    some_fat_file (for architecture x86_64):	Mach-O 64-bit Executable x86_64
    some_fat_file (for architecture arm64_32):	Mach-O 32-bit Executable arm64_32
    some_fat_file (for architecture arm64): 	Mach-O 64-bit Executable arm64
    some_fat_file (for architecture arm64e):	Mach-O 64-bit Executable arm64e
[*] macho-split00.x86_64 	...done
[*] macho-split01.arm64_32 	...done
[*] macho-split02.arm64 	...done
[*] macho-split03.arm64e 	...done

You can then handle the Mach-O's how you'd like. The following example demonstrates HTool analysing the segment commands for macho-split-01.arm64

$ htool -l macho-split01.arm64
HTool Version 1.0.0~Alpha; Tue Jan  7 22:39:25 2020; libhelper-1000.836.27.12/BETA_X86_64 x86_64

LC 0: LC_SEGMENT_64	Off: 0x000000000-0x100000000	__PAGEZERO
    No Section 64 data
LC 1: LC_SEGMENT_64	Off: 0x100000000-0x100084000	__TEXT
    Off: 0x100004b30-0x10004ed20	303600 bytes		__TEXT.__text	
    Off: 0x10004ed20-0x10004effc	732 bytes		__TEXT.__stubs	
    Off: 0x10004effc-0x10004f2f0	756 bytes		__TEXT.__stub_helper	
    Off: 0x10004f2f0-0x10004f9c0	1744 bytes		__TEXT.__const	
    Off: 0x10004f9c0-0x100083c6e	213678 bytes		__TEXT.__cstring	
    Off: 0x100083c70-0x100083ff8	904 bytes		__TEXT.__unwind_info	
LC 2: LC_SEGMENT_64	Off: 0x100084000-0x1000d0000	__DATA
    Off: 0x100084000-0x100084020	32 bytes		__DATA.__got	
    Off: 0x100084020-0x100084208	488 bytes		__DATA.__la_symbol_ptr	
    Off: 0x100084208-0x1000842a8	160 bytes		__DATA.__const	
    Off: 0x1000842a8-0x1000c0ebc	248852 bytes		__DATA.__data	
    Off: 0x1000c0ec0-0x1000c9684	34756 bytes		__DATA.__common	
    Off: 0x1000c9688-0x1000ce420	19864 bytes		__DATA.__bss	
LC 3: LC_SEGMENT_64	Off: 0x1000d0000-0x1000d7000	__LINKEDIT
    No Section 64 data
...

Mach-O Helper Toolset

Now to discuss my aims for this "Toolset". As I develop and test libhelper I'll probably write more of these - in fact if you look at the sourcecode you'll see macho-dump which aims at dumping bytes from a start address for a given size. So more of these tools will be added.

Next is the way I'm versioning the toolset. All the tools are built from the same source file, libhelper/tools/macho_toolset.c to be specific, so I decided I needed a way of both keeping track of individual versions of the tools, and that single codebase as a whole. Therefore, there is the toolset version, and the actual tools version. Here's an example:

$ macho-section -v
MachO-Helper macho-section Version 1.0.0 (macho-helper-100.14.1)
  Build Time:		Thu Jan  9 00:00:33 2020
  Default Target:	darwin-x86_64
  Libhelper:		libhelper-1000.836.27.12
  Toolset:		macho-helper-100.14.1

This is the -v version output for macho-section. First we see the version for macho-section as version 1.0.0, beside that the version of the toolset - macho-helper-100.14.1. Underneath is some more detailed information such as the compile time (to further help me keep track of things), the target as this will eventually work on both arm64 and Linux and the version of Libhelper linked against the toolset.

Summary

So, time for the download links! You can grab the tools from the Downloads which will also list historical downloads. Libhelper is not yet available as a pre-compiled library, however feel free to compile it and submit any changes you'd like to see on it's GitHub.

Thanks for checking this out, let me know about any suggestions and/or issue you have on Twitter.

Mach-O Helper Toolset.

Mach-O Section Tool

Mach-O Split Tool

Mach-O Helper Toolset

Summary