in src/extract_execute.rs [277:337]
fn parse_macho(mach: &mach::Mach, buffer: &[u8]) -> BinaryInfo {
let mut sections = Vec::new();
let mut architecture = String::new();
let mut entry_string = String::new();
let mut imports: HashMap<String, HashSet<String>> = HashMap::new();
let mut exports = HashSet::new();
match mach {
mach::Mach::Fat(fat) => {
if let Ok(arches) = fat.arches() {
for arch in arches {
let size = arch.size as usize;
let offset = arch.offset as usize;
if offset + size > buffer.len() {
continue;
}
let Ok(macho) = mach::Mach::parse(&buffer[offset..offset + size]) else {
continue;
};
let mach::Mach::Binary(macho_binary) = macho else {
continue;
};
handle_macho_binary(
&macho_binary,
&mut sections,
&mut architecture,
&mut entry_string,
&mut imports,
&mut exports
);
}
}
}
mach::Mach::Binary(macho) => {
handle_macho_binary(
macho,
&mut sections,
&mut architecture,
&mut entry_string,
&mut imports,
&mut exports
);
}
}
if architecture.is_empty() {
architecture = "unknown".to_string();
}
BinaryInfo {
format: "Mach-O".to_string(),
entry: entry_string,
architecture,
size: buffer.len() as u64,
sections,
imports,
exports,
}
}