AppleMachoImage.h

Go to the documentation of this file.

 
#ifndef APPLE_MACHO_IMAGE_H
#define APPLE_MACHO_IMAGE_H
 
#define MACH_CPU_ARCH_ABI64     BIT24
#define MACH_CPU_ARCH_ABI64_32  BIT25
 
//
// Capability bits used in the definition of MACH_CPU_SUBTYPE.
//
#define MACH_CPU_SUBTYPE_MASK   0xFF000000U  
#define MACH_CPU_SUBTYPE_LIB64  BIT17        
 
#define MACH_CPU_SUBTYPE_INTEL_MODEL_SHIFT  4U
#define MACH_CPU_SUBTYPE_INTEL_FAMILY_MAX   0x0FU
#define MACH_CPU_SUBTYPE_INTEL_MODEL_ALL    0U
 
#define MACH_CPU_SUBTYPE_INTEL(f, Model)  \
  ((f) + ((Model) << MACH_CPU_SUBTYPE_INTEL_MODEL_SHIFT))
 
#define MACH_CPU_SUBTYPE_INTEL_FAMILY(Identifier)  \
  ((Identifier) & MACH_CPU_SUBTYPE_INTEL_FAMILY_MAX)
 
#define MACH_CPU_SUBTYPE_INTEL_MODEL(Identifier)  \
  ((Identifier) >> MACH_CPU_SUBTYPE_INTEL_MODEL_SHIFT)
 
#define FORMALIZE_CPU_SUBTYPE(CpuSubtype)  ((CpuSubtype) & ~CPU_SUBTYPE_MASK)
 
#define MACH_CPU_TYPE_64(CpuType)  ((CpuType) | MACH_CPU_ARCH_ABI64)
 
#define MACH_CPU_TYPE_64_32(CpuType)  ((CpuType) | MACH_CPU_ARCH_ABI64_32)
 
#if !defined (MACH_LITTLE_ENDIAN) && !defined (MACH_BIG_ENDIAN)
  #if defined (MDE_CPU_IA32) || defined (MDE_CPU_X64)
#define MACH_LITTLE_ENDIAN
  #endif 
#endif 
 
enum {
  MachCpuTypeAny     = -1,
  MachCpuTypeVax     = 1,
  MachCpuTypeMc680x0 = 6,
  MachCpuTypeX86     = 7,
  MachCpuTypeI386    = MachCpuTypeX86,
  MachCpuTypeX8664   = MACH_CPU_TYPE_64 (MachCpuTypeX86),
  MachCpuTypeMc98000 = 10,
  MachCpuTypeHppa    = 11,
  MachCpuTypeArm     = 12,
  MachCpuTypeArm64   = MACH_CPU_TYPE_64 (MachCpuTypeArm),
  MachCpuTypeArm6432 = MACH_CPU_TYPE_64_32 (MachCpuTypeArm),
 
  MachCpuTypeMc88000   = 13,
  MachCpuTypeSparc     = 14,
  MachCpuTypeI860      = 15,
  MachCpuTypePowerPc   = 18,
  MachCpuTypePowerPc64 = MACH_CPU_TYPE_64 (MachCpuTypePowerPc),
  MachCpuTypeVeo       = 255
};
 
typedef INT32 MACH_CPU_TYPE;
 
enum {
  MachCpuSubtypeInvalid = -1,
  //
  // Any
  //
  MachCpuSubtypeMultiple     = -1,
  MachCpuSubtypeLittleEndian = 0,
  MachCpuSubtypeBigEndian    = 1,
  //
  // VAX Subtypes
  //
  MachCpuSubtypeVaxAll  = 0,
  MachCpuSubtypeVax780  = 1,
  MachCpuSubtypeVax785  = 2,
  MachCpuSubtypeVax750  = 3,
  MachCpuSubtypeVax730  = 4,
  MachCpuSubtypeUVax1   = 5,
  MachCpuSubtypeUVax2   = 6,
  MachCpuSubtypeVax8200 = 7,
  MachCpuSubtypeVax8500 = 8,
  MachCpuSubtypeVax8600 = 9,
  MachCpuSubtypeVax8650 = 10,
  MachCpuSubtypeVax8800 = 11,
  MachCpuSubtypeUVax3   = 12,
  //
  // MC680 Subtypes
  //
  MachCpuSubtypeMc680All    = 1,
  MachCpuSubtypeMc68030     = MachCpuSubtypeMc680All,
  MachCpuSubtypeMc68040     = 2,
  MachCpuSubtypeMc68030Only = 3,
  //
  // x86 Subtypes
  //
  MachCpuSubtypeX86All   = MACH_CPU_SUBTYPE_INTEL (3, 0),
  MachCpuSubtypeX86Arch1 = MACH_CPU_SUBTYPE_INTEL (4, 0),
  //
  // x86_64 Subtypes
  //
  MachCpuSubtypeX8664All = MachCpuSubtypeX86All,
  MachCpuSubtypeX8664H   = MACH_CPU_SUBTYPE_INTEL (8, 0),
  //
  // i386 Subytpes
  //
  MachCpuSubtypeI386All       = MachCpuSubtypeX86All,
  MachCpuSubtype386           = MachCpuSubtypeI386All,
  MachCpuSubtype486           = MachCpuSubtypeX86Arch1,
  MachCpuSubtype486Sx         = MACH_CPU_SUBTYPE_INTEL (4, 8),
  MachCpuSubtype586           = MACH_CPU_SUBTYPE_INTEL (5, 0),
  MachCpuSubtypePentium       = MachCpuSubtype586,
  MachCpuSubtypePentiumPro    = MACH_CPU_SUBTYPE_INTEL (6, 1),
  MachCpuSubtypePentium3M3    = MACH_CPU_SUBTYPE_INTEL (6, 3),
  MachCpuSubtypePentium3M5    = MACH_CPU_SUBTYPE_INTEL (6, 5),
  MachCpuSubtypeCeleron       = MACH_CPU_SUBTYPE_INTEL (7, 6),
  MachCpuSubtypeCeleronMobile = MACH_CPU_SUBTYPE_INTEL (7, 7),
  MachCpuSubtypePentium3      = MACH_CPU_SUBTYPE_INTEL (8, 0),
  MachCpuSubtypePentium3M     = MACH_CPU_SUBTYPE_INTEL (8, 1),
  MachCpuSubtypePentium3Xeon  = MACH_CPU_SUBTYPE_INTEL (8, 2),
  MachCpuSubtypePentiumM      = MACH_CPU_SUBTYPE_INTEL (9, 0),
  MachCpuSubtypePentium4      = MACH_CPU_SUBTYPE_INTEL (10, 0),
  MachCpuSubtypePentium4M     = MACH_CPU_SUBTYPE_INTEL (10, 1),
  MachCpuSubtypeItanium       = MACH_CPU_SUBTYPE_INTEL (11, 0),
  MachCpuSubtypeItanium2      = MACH_CPU_SUBTYPE_INTEL (11, 1),
  MachCpuSubtypeXeon          = MACH_CPU_SUBTYPE_INTEL (12, 0),
  MachCpuSubtypeXeonMp        = MACH_CPU_SUBTYPE_INTEL (12, 1),
  //
  // Mips subtypes
  //
  MachCpuSubtypeMipsAll    = 0,
  MachCpuSubtypeMipsR2300  = 1,
  MachCpuSubtypeMipsR2600  = 2,
  MachCpuSubtypeMipsR2800  = 3,
  MachCpuSubtypeMipsR2000a = 4,
  MachCpuSubtypeMipsR2000  = 5,
  MachCpuSubtypeMipsR3000a = 6,
  MachCpuSubtypeMipsR3000  = 7,
  //
  // MC98000 Subtypes
  //
  MachCpuSubtypeMc98000All = 0,
  MachCpuSubtypeMc98601    = 1,
  //
  // HPPA Subtypes
  //
  MachCpuSubtypeHppaAll    = 0,
  MachCpuSubtypeHppa7100   = MachCpuSubtypeHppaAll,
  MachCpuSubtypeHppa7100Lc = 1,
  //
  // ARM Subtypes
  //
  MachCpuSubtypeArmAll    = 0,
  MachCpuSubtypeArmV4T    = 5,
  MachCpuSubtypeArmV6     = 6,
  MachCpuSubtypeArmV5Tej  = 7,
  MachCpuSubtypeArmXscale = 8,
  MachCpuSubtypeArmV7     = 9,
  MachCpuSubtypeArmV7F    = 10,
  MachCpuSubtypeArmV7S    = 11,
  MachCpuSubtypeArmV7K    = 12,
  MachCpuSubtypeArmV8     = 13,
  MachCpuSubtypeArmV6M    = 14,
  MachCpuSubtypeArmV7M    = 15,
  MachCpuSubtypeArmV7Em   = 16,
  //
  // ARM64 Subytypes
  //
  MachCpuSubtypeArm64All = 0,
  MachCpuSubtypeArm64V8  = 1,
  //
  // ARM64_32 Subtypes
  //
  MachCpuSubtypeArm6432All = 0,
  MachCpuSubtypeArm6432V8  = 1,
  //
  // MC88000 Subytpes
  //
  MachCpuSubtypeMc88000All = 0,
  MachCpuSubtypeMc88100    = 1,
  MachCpuSubtypeMc88110    = 2,
  //
  // SPARC Subtypes
  //
  MachCpuSubtypeSparcAll = 0,
  //
  // i860 Subtypes
  //
  MachCpuSubtypeI860All = 0,
  MachCpuSubtypeI860860 = 1,
  //
  // PowerPC Subtypes
  //
  MachCpuSubtypePowerPcAll   = 0,
  MachCpuSubtypePowerPc601   = 1,
  MachCpuSubtypePowerPc602   = 2,
  MachCpuSubtypePowerPc603   = 3,
  MachCpuSubtypePowerPc603e  = 4,
  MachCpuSubtypePowerPc603ev = 5,
  MachCpuSubtypePowerPc604   = 6,
  MachCpuSubtypePowerPc604e  = 7,
  MachCpuSubtypePowerPc620   = 8,
  MachCpuSubtypePowerPc750   = 9,
  MachCpuSubtypePowerPc7400  = 10,
  MachCpuSubtypePowerPc7450  = 11,
  MachCpuSubtypePowerPc970   = 100,
  //
  // VEO Subtypes
  //
  MachCpuSubtypeVeo1   = 1,
  MachCpuSubtypeVeo2   = 2,
  MachCpuSubtypeVeo3   = 3,
  MachCpuSubtypeVeo4   = 4,
  MachCpuSubtypeVeoAll = MachCpuSubtypeVeo2
};
 
typedef INT32 MACH_CPU_SUBTYPE;
 
enum {
  MachCpuFamilyUnknown = 0,
  //
  // PowerPC Family
  //
  MachCpuFamilyPowerPcG3 = 0xCEE41549,
  MachCpuFamilyPowerPcG4 = 0x77C184AE,
  MachCpuFamilyPowerPcG5 = 0xED76D8AA,
  //
  // Intel Family
  //
  MachCpuFamilyIntel613         = 0xAA33392B,
  MachCpuFamilyIntelYonah       = 0x73D67300,
  MachCpuFamilyIntelMerom       = 0x426F69EF,
  MachCpuFamilyIntelPenryn      = 0x78EA4FBC,
  MachCpuFamilyIntelNehalem     = 0x6B5A4CD2,
  MachCpuFamilyIntelWestmere    = 0x573B5EEC,
  MachCpuFamilyIntelSandyBridge = 0x5490B78C,
  MachCpuFamilyIntelIvyBridge   = 0x1F65E835,
  MachCpuFamilyIntelHaswell     = 0x10B282DC,
  MachCpuFamilyIntelBroadwell   = 0x582ED09C,
  MachCpuFamilyIntelSkylake     = 0x37FC219F,
  MachCpuFamilyIntelKabyLake    = 0x0F817246,
  MachCpuFamilyIntelCoffeeLake  = MachCpuFamilyIntelKabyLake,
  MachCpuFamilyIntelIceLake     = 0x38435547,
  MachCpuFamilyIntelCometLake   = 0x1CF8A03E,
  //
  // The following synonyms are deprecated:
  //
  MachCpuFamilyIntel614   = MachCpuFamilyIntelYonah,
  MachCpuFamilyIntel615   = MachCpuFamilyIntelMerom,
  MachCpuFamilyIntel623   = MachCpuFamilyIntelPenryn,
  MachCpuFamilyIntel626   = MachCpuFamilyIntelNehalem,
  MachCpuFamilyIntelCore  = MachCpuFamilyIntelYonah,
  MachCpuFamilyIntelCore2 = MachCpuFamilyIntelMerom,
  //
  // ARM Family
  //
  MachCpuFamilyArm9                = 0xE73283AE,
  MachCpuFamilyArm11               = 0x8FF620D8,
  MachCpuFamilyArmXscale           = 0x53B005F5,
  MachCpuFamilyArm12               = 0xBD1B0AE9,
  MachCpuFamilyArm13               = 0x0CC90E64,
  MachCpuFamilyArm14               = 0x96077EF1,
  MachCpuFamilyArm15               = 0xA8511BCA,
  MachCpuFamilyArmSwift            = 0x1E2D6381,
  MachCpuFamilyArmCyclone          = 0x37A09642,
  MachCpuFamilyArmTyphoon          = 0x2C91A47E,
  MachCpuFamilyArmTwister          = 0x92FB37C8,
  MachCpuFamilyArmHurricane        = 0x67CEEE93,
  MachCpuFamilyArmMonsoonMistral   = 0xE81E7EF6,
  MachCpuFamilyArmVortexTempest    = 0x07D34B9F,
  MachCpuFamilyArmLightningThunder = 0x462504D2,
};
 
typedef UINT32 MACH_CPU_FAMILY;
typedef INT32  MACH_CPU_THREADTYPE;
typedef INT32  MACH_VM_PROTECTION;
 
typedef union {
  UINT32    Offset;    
  UINT32    Address32; 
} MACH_LOAD_COMMAND_STRING;
 
typedef struct {
  MACH_LOAD_COMMAND_STRING    Name;          
  UINT32                      MinorVersion;  
  UINT32                      HeaderAddress; 
} MACH_FIXED_VM_LIB;
 
typedef struct {
  MACH_LOAD_COMMAND_STRING    Name;
  UINT32                      Timestamp;
  UINT32                      CurrentVersion;
  UINT32                      CompatibilityVersion;
} MACH_DYLIB;
 
//
// Mach Load Commands
//
 
#define MACH_LC_REQUIRE_DYLD  BIT31
#define MACH_LOAD_COMMAND_SEGMENT  1U
#define MACH_LOAD_COMMAND_SYMTAB  2U
#define MACH_LOAD_COMMAND_SYMSEG  3U
#define MACH_LOAD_COMMAND_THREAD  4U
#define MACH_LOAD_COMMAND_UNIX_THREAD  5U
#define MACH_LOAD_COMMAND_LOAD_FIXED_VM_LIB  6U
#define MACH_LOAD_COMMAND_IDENTIFICATION_VM_LIB  7U
#define MACH_LOAD_COMMAND_IDENTIFICATION  8U
#define MACH_LOAD_COMMAND_FIXED_VM_FILE  9U
#define MACH_LOAD_COMMAND_PRE_PAGE  10U
#define MACH_LOAD_COMMAND_DYSYMTAB  11U
#define MACH_LOAD_COMMAND_LOAD_DYLIB  12U
#define MACH_LOAD_COMMAND_IDENTITY_DYLIB  13U
#define MACH_LOAD_COMMAND_LOAD_DYLD  14U
#define MACH_LOAD_COMMAND_IDENTIFICATION_DYLD  15U
#define MACH_LOAD_COMMAND_PREBOUNT_SYLIB  16U
#define MACH_LOAD_COMMAND_ROUTINES  17U
#define MACH_LOAD_COMMAND_SUB_FRAMEWORK  18U
#define MACH_LOAD_COMMAND_SUB_UMBRELLA  19U
#define MACH_LOAD_COMMAND_SUB_CLIENT  20U
#define MACH_LOAD_COMMAND_SUB_LIBRARY  21U
#define MACH_LOAD_COMMAND_TWO_LEVEL_HINTS  22U
#define MACH_LOAD_COMMAND_PREBIND_CHECKSUM  23U
#define MACH_LOAD_COMMAND_LLOAD_WEAK_DYLIB  (24U | MACH_LC_REQUIRE_DYLD)
#define MACH_LOAD_COMMAND_SEGMENT_64  25U
#define MACH_LOAD_COMMAND_ROUTINES_64  26U
#define MACH_LOAD_COMMAND_UUID  27U
#define MACH_LOAD_COMMAND_RUN_PATH  (28U | MACH_LC_REQUIRE_DYLD)
#define MACH_LOAD_COMMAND_CODE_SIGNATURE  29U
#define MACH_LOAD_COMMAND_SEGMENT_SPLIT_INFO  30U
#define MACH_LOAD_COMMAND_REEXPORT_DYLIB  (31U | MACH_LC_REQUIRE_DYLD)
#define MACH_LOAD_COMMAND_LAZY_LOAD_DYLIB  32U
#define MACH_LOAD_COMMAND_ENCRYPTION_INFO  33U
#define MACH_LOAD_COMMAND_DYLD_INFO  34U
#define MACH_LOAD_COMMAND_DYLD_INFO_ONLY  (34U | MACH_LC_REQUIRE_DYLD)
#define MACH_LOAD_COMMAND_LOAD_UPWARD_DYLIB  (35U | MACH_LC_REQUIRE_DYLD)
#define MACH_LOAD_COMMAND_VERSION_MIN_MAC_OS_X  36U
#define MACH_LOAD_COMMAND_VERSION_MIN_IPHONE_OS  37U
#define MACH_LOAD_COMMAND_FUNCTION_STARTS  38U
#define MACH_LOAD_COMMAND_DYLD_ENVIRONMENT  39U
#define MACH_LOAD_COMMAND_MAIN  (40U | MACH_LC_REQUIRE_DYLD)
#define MACH_LOAD_COMMAND_DATA_IN_CODE  41U
#define MACH_LOAD_COMMAND_SOURCE_VERSION  42U
#define MACH_LOAD_COMMAND_DYLIB_CODE_SIGN_DRS  43U
#define MACH_LOAD_COMMAND_ENCRYPTION_INFO_64  44U
#define MACH_LOAD_COMMAND_LINKER_OPTION  45U
#define MACH_LOAD_COMMAND_LINKER_OPTIMIZATION_HINT  46U
#define MACH_LOAD_COMMAND_VERSION_MIN_TV_OS  47U
#define MACH_LOAD_COMMAND_VERSION_MIN_WATCH_OS  48U
#define MACH_LOAD_COMMAND_NOTE  49U
#define MACH_LOAD_COMMAND_BUILD_VERSION  50U
#define MACH_LOAD_COMMAND_DYLD_EXPORTS_TRIE  (51U | MACH_LC_REQUIRE_DYLD)
#define MACH_LOAD_COMMAND_DYLD_CHAINED_FIXUPS  (52U | MACH_LC_REQUIRE_DYLD)
#define MACH_LOAD_COMMAND_FILESET_ENTRY  (53U  | MACH_LC_REQUIRE_DYLD)
 
typedef UINT32 MACH_LOAD_COMMAND_TYPE;
 
#define MACH_LOAD_COMMAND_HDR_                                    \
  MACH_LOAD_COMMAND_TYPE CommandType; /* type of load command */  \
  UINT32                 CommandSize; /* total size of command in bytes
                                         (includes sizeof section structs) */
 
#define NEXT_MACH_LOAD_COMMAND(Command)  \
  ((MACH_LOAD_COMMAND *)((UINTN)(Command) + (Command)->CommandSize))
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
} MACH_LOAD_COMMAND;
 
//
// Constants for the Flags field of the MACH_SEGMENT_COMMAND struct
//
 
#define MACH_SEGMENT_FLAG_HIGH_VIRTUAL_MEMORY  BIT0
#define MACH_SEGMENT_FLAG_FIXED_VM_LIB  BIT1
#define MACH_SEGMENT_FLAG_NO_RELOCATION  BIT2
#define MACH_SEGMENT_FLAG_PROTECTED_VERSION_1  BIT3
 
#define MACH_SEGMENT_VM_PROT_NONE  0U
 
#define MACH_SEGMENT_VM_PROT_READ     BIT0
#define MACH_SEGMENT_VM_PROT_WRITE    BIT1
#define MACH_SEGMENT_VM_PROT_EXECUTE  BIT2
 
typedef UINT32 MACH_SEGMENT_FLAGS;
 
enum {
  MachSectionTypeRegular = 0,
  MachSectionTypeZeroFill = 1,
  MachSectionTypeCStringLiterals = 2,
  MachSectionType4ByteLiterals = 3,
  MachSectionType8ByteLiterals = 4,
  MachSectionTypeLiteralPointers = 5,
 
  //
  // For the two types of symbol pointers sections and the symbol stubs section
  // they have indirect symbol table entries.  For each of the entries in the
  // section the indirect symbol table entries, in corresponding order in the
  // indirect symbol table, start at the index stored in the reserved1 field
  // of the section structure.  Since the indirect symbol table entries
  // correspond to the entries in the section the number of indirect symbol
  // table entries is inferred from the size of the section divided by the size
  // of the entries in the section.  For symbol pointers sections the size of
  // the entries in the section is 4 bytes and for symbol stubs sections the
  // byte size of the stubs is stored in the reserved2 field of the section
  // structure.
  //
 
  MachSectionTypeNonLazySymbolPointers = 6,
  MachSectionTypeLazySymbolPointers = 7,
  MachSectionTypeSymbolStubs = 8,
  MachSectionTypeModInitalizeFunctionPointers = 9,
  MachSectionTypeModTerminateFunctionPointers = 10,
  MachSectionTypeCoalesced = 11,
  MachSectionTypeGigabyteZeroFill = 12,
  MachSectionTypeInterposing = 13,
  MachSectionType16ByteLiterals = 14,
  MachSectionTypeDtraceObjectFormat = 15,
  MachSectionTypeLazyDylibSymbolPointers = 16,
 
  //
  // Section types to support thread local variables
  //
 
  MachSectionTypeThreadLocalRegular = 17,
  MachSectionTypeThreadLocalZeroFill = 18,
  MachSectionTypeThreadLocalVariables = 19,
  MachSectionTypeThreadVariablePointers = 20,
  MachSectionTypeThreadLocalInitializeFunctionPointers = 21,
  MachSectionTypeThreadLocalInitializeFunctionOffsets = 22
};
 
//
// Constants for the section attributes part of the Flags field of a section
// structure.
//
 
#define MACH_SECTION_ATTRIBUTES_SYSYTEM  0x00FFFF00U
#define MACH_SECTION_ATTRIBUTES_USER  0xFF000000U
#define MACH_SECTION_ATTRIBUTE_LOCAL_RELOCATION  BIT8
#define MACH_SECTION_ATTRIBUTE_EXTERNAL_RELOCATION  BIT9
#define MACH_SECTION_ATTRIBUTE_SOME_INSTRUCTIONS  BIT10
 
//
// The flags field of a section structure is separated into two parts a section
// type and section attributes.The section types are mutually exclusive (it
// can only have one type) but the section attributes are not (it may have more
// than one attribute).
//
#define MACH_SECTION_TYPE_MASK        0x000000FFU  
#define MACH_SECTION_ATTRIBUTES_MASK  0xFFFFFF00U  
 
#define MACH_SECTION_ATTRIBUTE_DEBUG  BIT25
#define MACH_SECTION_ATTRIBUTE_SELF_MODIFYING_CODE  BIT26
#define MACH_SECTION_ATTRIBUTE_LIVE_SUPPORT  BIT27
#define MACH_SECTION_ATTRIBUTE_NO_DEAD_STRIP  BIT28
#define MACH_SECTION_ATTRIBUTE_STRIP_STATIC_SYMBOLS  BIT29
#define MACH_SECTION_ATTRIBUTE_NO_TOC  BIT30
#define MACH_SECTION_ATTRIBUTE_PURE_INSTRUCTIONS  BIT31
 
typedef struct {
  CHAR8     SectionName[16];       
  CHAR8     SegmentName[16];       
  UINT32    Address;               
  UINT32    Size;                  
  UINT32    Offset;                
  UINT32    Alignment;             
  UINT32    RelocationsOffset;     
  UINT32    NumRelocations;        
  UINT32    Flags;                 
  UINT32    Reserved1;             
  UINT32    Reserved2;             
} MACH_SECTION;
 
typedef struct {
  CHAR8     SectionName[16];   
  CHAR8     SegmentName[16];   
  UINT64    Address;           
  UINT64    Size;              
  UINT32    Offset;            
  UINT32    Alignment;         
  UINT32    RelocationsOffset; 
  UINT32    NumRelocations;    
  UINT32    Flags;             
  UINT32    Reserved1;         
  UINT32    Reserved2;         
  UINT32    Reserved3;         
} MACH_SECTION_64;
 
typedef union {
  MACH_SECTION       Section32;
  MACH_SECTION_64    Section64;
} MACH_SECTION_ANY;
 
#define NEXT_MACH_SEGMENT(Segment) \
  (MACH_SEGMENT_COMMAND *)((UINTN)(Segment) + (Segment)->Command.Size)
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  CHAR8                 SegmentName[16];   
  UINT32                VirtualAddress;    
  UINT32                Size;              
  UINT32                FileOffset;        
  UINT32                FileSize;          
  MACH_VM_PROTECTION    MaximumProtection; 
  MACH_VM_PROTECTION    InitialProtection; 
  UINT32                NumSections;       
  MACH_SEGMENT_FLAGS    Flags;             
  MACH_SECTION          Sections[];
} MACH_SEGMENT_COMMAND;
 
#define NEXT_MACH_SEGMENT_64(Segment) \
  (MACH_SEGMENT_COMMAND_64 *)((UINTN)(Segment) + (Segment)->Hdr.Size)
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  CHAR8                 SegmentName[16];   
  UINT64                VirtualAddress;    
  UINT64                Size;              
  UINT64                FileOffset;        
  UINT64                FileSize;          
  MACH_VM_PROTECTION    MaximumProtection; 
  MACH_VM_PROTECTION    InitialProtection; 
  UINT32                NumSections;       
  MACH_SEGMENT_FLAGS    Flags;             
  MACH_SECTION_64       Sections[];
} MACH_SEGMENT_COMMAND_64;
 
typedef union {
  MACH_SEGMENT_COMMAND       Segment32;
  MACH_SEGMENT_COMMAND_64    Segment64;
} MACH_SEGMENT_COMMAND_ANY;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  MACH_FIXED_VM_LIB    FixedVmLib; 
} MACH_FIXED_VM_LIB_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  MACH_DYLIB    Dylib;      
} MACH_DYLIB_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  MACH_LOAD_COMMAND_STRING    Umbrella; 
} MACH_SUB_FRAMEWORK_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  MACH_LOAD_COMMAND_STRING    Client; 
} MACH_SUB_CLIENT_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  MACH_LOAD_COMMAND_STRING    SubUmbrella; 
} MACH_SUB_UMBRELLA_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  MACH_LOAD_COMMAND_STRING    SubLibrary; 
} MACH_SUB_LIBRARY_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  MACH_LOAD_COMMAND_STRING    Name;            
  UINT32                      NumModules;      
  MACH_LOAD_COMMAND_STRING    LinkedModules[]; 
} MACH_PREBOUND_DYLIB_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  MACH_LOAD_COMMAND_STRING    Name; 
} MACH_DYLINKER_COMMAND;
 
enum {
  MachX86ThreadState32    = 1,
  MachX86FloatState32     = 2,
  MachX86ExceptionState32 = 3,
  MachX86ThreadState64    = 4,
  MachX86FloatState64     = 5,
  MachX86ExceptionState64 = 6,
  MachX86ThreadState      = 7,
  MachX86FloatState       = 8,
  MachX86ExceptionState   = 9,
  MachX86DebugState32     = 10,
  MachX86DebugState64     = 11,
  MachX86DebugState       = 12,
  MachThreadStateNone     = 13,
  //
  // 14 and 15 are used for the internal x86SavedState flavours.
  //
  MachX86AvxState32    = 16,
  MachX86AvxState64    = 17,
  MachX86AvxState      = 18,
  MachX86Avx512State32 = 19,
  MachX86Avx512State64 = 20,
  MachX86Avx512State   = 21,
};
 
#define MACH_X86_THREAD_STATE_MAX  614
 
typedef struct {
  UINT32    eax;
  UINT32    ebx;
  UINT32    ecx;
  UINT32    edx;
  UINT32    edi;
  UINT32    esi;
  UINT32    ebp;
  UINT32    esp;
  UINT32    ss;
  UINT32    eflags;
  UINT32    eip;
  UINT32    cs;
  UINT32    ds;
  UINT32    es;
  UINT32    fs;
  UINT32    gs;
} MACH_X86_THREAD_STATE32;
 
typedef struct {
  UINT64    rax;
  UINT64    rbx;
  UINT64    rcx;
  UINT64    rdx;
  UINT64    rdi;
  UINT64    rsi;
  UINT64    rbp;
  UINT64    rsp;
  UINT64    r8;
  UINT64    r9;
  UINT64    r10;
  UINT64    r11;
  UINT64    r12;
  UINT64    r13;
  UINT64    r14;
  UINT64    r15;
  UINT64    rip;
  UINT64    rflags;
  UINT64    cs;
  UINT64    fs;
  UINT64    gs;
} MACH_X86_THREAD_STATE64;
 
typedef union {
  MACH_X86_THREAD_STATE32    State32;
  MACH_X86_THREAD_STATE64    State64;
} MACH_X86_THREAD_STATE;
 
#define MACH_VALID_THREAD_STATE_FLAVOR(Flavor)  \
    (((Flavor) == MachX86ThreadState32)         \
  || ((Flavor) == MachX86FloatState32)          \
  || ((Flavor) == MachX86ExceptionState32)      \
  || ((Flavor) == MachX86DebugState32)          \
  || ((Flavor) == MachX86ThreadState64)         \
  || ((Flavor) == MachX86FloatState64)          \
  || ((Flavor) == MachX86ExceptionState64)      \
  || ((Flavor) == MachX86DebugState64)          \
  || ((Flavor) == MachX86ThreadState)           \
  || ((Flavor) == MachX86FloatState)            \
  || ((Flavor) == MachX86ExceptionState)        \
  || ((Flavor) == MachX86DebugState)            \
  || ((Flavor) == MachX86AvxState32)            \
  || ((Flavor) == MachX86AvxState64)            \
  || ((Flavor) == MachX86AvxState)              \
  || ((Flavor) == MachX86Avx512State32)         \
  || ((Flavor) == MachX86Avx512State64)         \
  || ((Flavor) == MachX86Avx512State)           \
  || ((Flavor) == MachThreadStateNone))
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32    Flavor;                   
  UINT32    NumThreadStates;          
  UINT32    ThreadState[];
} MACH_THREAD_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32    InitRoutineAddress;
  UINT32    InitModuleIndex;
  UINT32    Reserved1;
  UINT32    Reserved2;
  UINT32    Reserved3;
  UINT32    Reserved4;
  UINT32    Reserved5;
  UINT32    Reserved6;
} MACH_ROUTINES_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT64    InitiRoutineAddress;
  UINT64    InitModuleIndex;
  UINT64    Reserved1;
  UINT64    Reserved2;
  UINT64    Reserved3;
  UINT64    Reserved4;
  UINT64    Reserved5;
  UINT64    Reserved6;
} MACH_ROUTINES_COMMAND_64;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32    SymbolsOffset;          
  UINT32    NumSymbols;             
  UINT32    StringsOffset;          
  UINT32    StringsSize;            
} MACH_SYMTAB_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
 
  //
  // The symbols indicated by symoff and nsyms of the LC_SYMTAB load command
  // are grouped into the following three groups:
  //  local symbols (further grouped by the module they are from)
  //  defined external symbols (further grouped by the module they are from)
  //  undefined symbols
  //
  // The local symbols are used only for debugging.  The dynamic binding
  // process may have to use them to indicate to the debugger the local
  // symbols for a module that is being bound.
  //
  // The last two groups are used by the dynamic binding process to do the
  // binding (indirectly through the module table and the reference symbol
  // table when this is a dynamically linked shared library file).
  //
 
  UINT32    LocalSymbolsIndex; 
  UINT32    NumLocalSymbols;   
 
  UINT32    ExternalSymbolsIndex; 
  UINT32    NumExternalSymbols;   
 
  UINT32    UndefinedSymbolsIndex; 
  UINT32    NumUndefinedSymbols;   
 
  //
  // For the for the dynamic binding process to find which module a symbol
  // is defined in the table of contents is used (analogous to the ranlib
  // structure in an archive) which maps defined external symbols to modules
  // they are defined in.  This exists only in a dynamically linked shared
  // library file.  For executable and object modules the defined external
  // symbols are sorted by name and is use as the table of contents.
  //
 
  UINT32    TableOfContentsFileOffset;
  UINT32    TableOfContentsNumEntries;
 
  //
  // To support dynamic binding of "modules" (whole object files) the symbol
  // table must reflect the modules that the file was created from.  This is
  // done by having a module table that has indexes and counts into the merged
  // tables for each module.  The module structure that these two entries
  // refer to is described below.  This exists only in a dynamically linked
  // shared library file.  For executable and object modules the file only
  // contains one module so everything in the file belongs to the module.
  //
 
  UINT32    ModuleTableFileOffset; 
  UINT32    ModuleTableNumEntries; 
 
  //
  // To support dynamic module binding the module structure for each module
  // indicates the external references (defined and undefined) each module
  // makes.  For each module there is an offset and a count into the
  // reference symbol table for the symbols that the module references.
  // This exists only in a dynamically linked shared library file.  For
  // executable and object modules the defined external symbols and the
  // undefined external symbols indicates the external references.
  //
 
  UINT32    ReferencedSymbolTableFileOffset;
  UINT32    ReferencedSymbolTableNumEntries;
 
  //
  // The sections that contain "symbol pointers" and "routine stubs" have
  // indexes and (implied counts based on the size of the section and fixed
  // size of the entry) into the "indirect symbol" table for each pointer
  // and stub.  For every section of these two types the index into the
  // indirect symbol table is stored in the section header in the field
  // reserved1.  An indirect symbol table entry is simply a 32bit index into
  // the symbol table to the symbol that the pointer or stub is referring to.
  // The indirect symbol table is ordered to match the entries in the section.
  //
 
  UINT32    IndirectSymbolsOffset;
  UINT32    NumIndirectSymbols;
 
  //
  // To support relocating an individual module in a library file quickly the
  // external relocation entries for each module in the library need to be
  // accessed efficiently.  Since the relocation entries can't be accessed
  // through the section headers for a library file they are separated into
  // groups of local and external entries further grouped by module.  In this
  // case the presents of this load command who's extreloff, nextrel,
  // locreloff and nlocrel fields are non-zero indicates that the relocation
  // entries of non-merged sections are not referenced through the section
  // structures (and the reloff and nreloc fields in the section headers are
  // set to zero).
  //
  // Since the relocation entries are not accessed through the section headers
  // this requires the r_address field to be something other than a section
  // offset to identify the item to be relocated.  In this case r_address is
  // set to the offset from the vmaddr of the first LC_SEGMENT command.
  // For MH_SPLIT_SEGS images r_address is set to the the offset from the
  // vmaddr of the first read-write LC_SEGMENT command.
  //
  // The relocation entries are grouped by module and the module table
  // entries have indexes and counts into them for the group of external
  // relocation entries for that the module.
  //
  // For sections that are merged across modules there must not be any
  // remaining external relocation entries for them (for merged sections
  // remaining relocation entries must be local).
  //
 
  UINT32    ExternalRelocationsOffset;
  UINT32    NumExternalRelocations;
 
  //
  // All the local relocation entries are grouped together (they are not
  // grouped by their module since they are only used if the object is moved
  // from it staticly link edited address).
  //
 
  UINT32    LocalRelocationsOffset; 
  UINT32    NumOfLocalRelocations;  
} MACH_DYSYMTAB_COMMAND;
 
//
// An indirect symbol table entry is simply a 32bit index into the symbol table
// to the symbol that the pointer or stub is refering to.  Unless it is for a
// non-lazy symbol pointer section for a defined symbol which strip(1) as
// removed.  In which case it has the value INDIRECT_SYMBOL_LOCAL.  If the
// symbol was also absolute INDIRECT_SYMBOL_ABS is or'ed with that.
//
#define MACH_INDIRECT_SYMBOL_LOCAL  0x80000000U
#define MACH_INDIRECT_SYMBOL_ABS    0x40000000U
 
typedef struct {
  UINT32    SubImagesIndex       : 8;  
  UINT32    TableOfContentsIndex : 24; 
} TWOLEVEL_HINT;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32           Offset;     
  UINT32           NumHints;   
  TWOLEVEL_HINT    Hints[];
} MACH_TWO_LEVEL_HINTS_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32    Checksum;          
} MACH_PREBIND_CHECKSUM_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT8    Uuid[16]; 
} MACH_UUID_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  MACH_LOAD_COMMAND_STRING    Path; 
} MACH_RUN_PATH_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32    DataOffset;          
  UINT32    DataSize;            
} MACH_LINKEDIT_DATA_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32    CryptOffset;
  UINT32    CryptSize;
  UINT32    CryptId;
} MACH_ENCRYPTION_INFO_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32    CryptOffset;
  UINT32    CryptSize;
  UINT32    CryptId;
  UINT32    Pad;
} MACH_ENCRYPTION_INFO_COMMAND_64;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32    Version;             
  UINT32    SdkVersion;          
} MACH_VERSION_MIN_COMMAND;
 
typedef struct {
  UINT32    Tool;    
  UINT32    Version; 
} MACH_BUILD_VERSION_TOOL;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32                     Platform;   
  UINT32                     MinOs;      
  UINT32                     SdkVersion; 
  UINT32                     NumTools;   
  MACH_BUILD_VERSION_TOOL    Tools[];
} MACH_BUILD_VERSION_COMMAND;
 
#define MACH_PLATFORM_MACOS             1U
#define MACH_PLATFORM_IOS               2U
#define MACH_PLATFORM_TVOS              3U
#define MACH_PLATFORM_WATCHOS           4U
#define MACH_PLATFORM_BRIDGEOS          5U
#define MACH_PLATFORM_MACCATALYST       6U
#define MACH_PLATFORM_IOSSIMULATOR      7U
#define MACH_PLATFORM_TVOSSIMULATOR     8U
#define MACH_PLATFORM_WATCHOSSIMULATOR  9U
#define MACH_PLATFORM_DRIVERKIT         10U
 
#define MACH_TOOL_CLANG  1U
#define MACH_TOOL_SWIFT  2U
#define MACH_TOOL_LD     3U
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  //
  // Dyld rebases an image whenever dyld loads it at an address different
  // from its preferred address.  The rebase information is a stream
  // of byte sized opcodes whose symbolic names start with REBASE_OPCODE_.
  // Conceptually the rebase information is a table of tuples:
  //    <seg-index, seg-offset, type>
  // The opcodes are a compressed way to encode the table by only
  // encoding when a column changes.  In addition simple patterns
  // like "every n'th offset for m times" can be encoded in a few
  // bytes.
  //
  UINT32    RebaseOffset; 
  UINT32    RebaseSize;   
  //
  // Dyld binds an image during the loading process, if the image
  // requires any pointers to be initialized to symbols in other images.
  // The bind information is a stream of byte sized
  // opcodes whose symbolic names start with BIND_OPCODE_.
  // Conceptually the bind information is a table of tuples:
  //    <seg-index, seg-offset, type, symbol-library-ordinal, symbol-name,
  //     addend>
  // The opcodes are a compressed way to encode the table by only
  // encoding when a column changes.  In addition simple patterns
  // like for runs of pointers initialzed to the same value can be
  // encoded in a few bytes.
  //
  UINT32    BindingInfoOffset; 
  UINT32    BindingInfoSize;   
  //
  // Some C++ programs require dyld to unique symbols so that all
  // images in the process use the same copy of some code/data.
  // This step is done after binding. The content of the weak_bind
  // info is an opcode stream like the bind_info.  But it is sorted
  // alphabetically by symbol name.  This enable dyld to walk
  // all images with weak binding information in order and look
  // for collisions.  If there are no collisions, dyld does
  // no updating.  That means that some fixups are also encoded
  // in the bind_info.  For instance, all calls to "operator new"
  // are first bound to libstdc++.dylib using the information
  // in bind_info.  Then if some image overrides operator new
  // that is detected when the weak_bind information is processed
  // and the call to operator new is then rebound.
  //
  UINT32    WeakBindingInfoOffset; 
  UINT32    WeakBindingInfoSize;   
  //
  // Some uses of external symbols do not need to be bound immediately.
  // Instead they can be lazily bound on first use.  The lazy_bind
  // are contains a stream of BIND opcodes to bind all lazy symbols.
  // Normal use is that dyld ignores the lazy_bind section when
  // loading an image.  Instead the static linker arranged for the
  // lazy pointer to initially point to a helper function which
  // pushes the offset into the lazy_bind area for the symbol
  // needing to be bound, then jumps to dyld which simply adds
  // the offset to lazy_bind_off to get the information on what
  // to bind.
  //
  UINT32    LazyBindingInfoOffset; 
  UINT32    LazyBindingInfoSize;   
  //
  // The symbols exported by a dylib are encoded in a trie.  This
  // is a compact representation that factors out common prefixes.
  // It also reduces LINKEDIT pages in RAM because it encodes all
  // information (name, address, flags) in one small, contiguous range.
  // The export area is a stream of nodes.  The first node sequentially
  // is the start node for the trie.
  //
  // Nodes for a symbol start with a uleb128 that is the length of
  // the exported symbol information for the string so far.
  // If there is no exported symbol, the node starts with a zero byte.
  // If there is exported info, it follows the length.
  //
  // First is a uleb128 containing flags. Normally, it is followed by
  // a uleb128 encoded offset which is location of the content named
  // by the symbol from the mach_header for the image.  If the flags
  // is EXPORT_SYMBOL_FLAGS_REEXPORT, then following the flags is
  // a uleb128 encoded library ordinal, then a zero terminated
  // UTF8 string.  If the string is zero length, then the symbol
  // is re-export from the specified dylib with the same name.
  // If the flags is EXPORT_SYMBOL_FLAGS_STUB_AND_RESOLVER, then following
  // the flags is two uleb128s: the stub offset and the resolver offset.
  // The stub is used by non-lazy pointers.  The resolver is used
  // by lazy pointers and must be called to get the actual address to use.
  //
  // After the optional exported symbol information is a byte of
  // how many edges (0-255) that this node has leaving it,
  // followed by each edge.
  // Each edge is a zero terminated UTF8 of the addition chars
  // in the symbol, followed by a uleb128 offset for the node that
  // edge points to.
  //
  UINT32    ExportSymbolsOffset; 
  UINT32    ExportSymbolsSize;   
} MACH_DYLD_INFO_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32    NumStrings;          
  CHAR8     Strings[];
} MACH_LINKER_OPTION_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT32    Offset;          
  UINT32    Size;            
} MACH_SYMBOL_SEGMENT_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  CHAR8    Strings[];
} MACH_IDENTIFICATION_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  MACH_LOAD_COMMAND_STRING    Name;          
  UINT32                      HeaderAddress; 
} MACH_FIXED_VM_FILE_COMMAND;
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT64                      VirtualAddress; 
  UINT64                      FileOffset;     
  MACH_LOAD_COMMAND_STRING    EntryId;        
  UINT32                      Reserved;       
  CHAR8                       Payload[];      
} MACH_FILESET_ENTRY_COMMAND;
 
typedef struct {
  UINT64    Target     : 30, 
            CacheLevel :  2, 
            Diversity  : 16,
            AddrDiv    :  1,
            Key        :  2,
            Next       : 12, 
            IsAuth     :  1; 
} MACH_DYLD_CHAINED_PTR_64_KERNEL_CACHE_REBASE;
 
// header of the LC_DYLD_CHAINED_FIXUPS payload
typedef struct {
  UINT32    FixupsVersion; 
  UINT32    StartsOffset;  
  UINT32    ImportsOffset; 
  UINT32    SymbolsOffset; 
  UINT32    ImportsCount;  
  UINT32    ImportsFormat; 
  UINT32    SymbolsFormat; 
} MACHO_DYLD_CHAINED_FIXUPS_HEADER;
 
typedef struct {
  UINT32    NumSegments;
  UINT32    SegInfoOffset[]; 
} MACH_DYLD_CHAINED_STARTS_IN_IMAGE;
 
typedef struct {
  UINT32    Size;            
  UINT16    PageSize;        
  UINT16    PointerFormat;   
  UINT64    SegmentOffset;   
  UINT32    MaxValidPointer; 
  UINT16    PageCount;       
  UINT16    PageStart[];     
  // UINT16 ChainStarts[];    ///< some 32-bit formats may require multiple starts per page.
} MACH_DYLD_CHAINED_STARTS_IN_SEGMENT;
 
enum {
  MACH_DYLD_CHAINED_PTR_ARM64E              =  1,  
  MACH_DYLD_CHAINED_PTR_64                  =  2,  
  MACH_DYLD_CHAINED_PTR_32                  =  3,
  MACH_DYLD_CHAINED_PTR_32_CACHE            =  4,
  MACH_DYLD_CHAINED_PTR_32_FIRMWARE         =  5,
  MACH_DYLD_CHAINED_PTR_64_OFFSET           =  6,  
  MACH_DYLD_CHAINED_PTR_ARM64E_OFFSET       =  7,  
  MACH_DYLD_CHAINED_PTR_ARM64E_KERNEL       =  7,  
  MACH_DYLD_CHAINED_PTR_64_KERNEL_CACHE     =  8,
  MACH_DYLD_CHAINED_PTR_ARM64E_USERLAND     =  9,  
  MACH_DYLD_CHAINED_PTR_ARM64E_FIRMWARE     = 10,  
  MACH_DYLD_CHAINED_PTR_X86_64_KERNEL_CACHE = 11,  
  MACH_DYLD_CHAINED_PTR_ARM64E_USERLAND24   = 12   
};
 
enum {
  MACH_DYLD_CHAINED_PTR_START_NONE  = 0xFFFF,  
  MACH_DYLD_CHAINED_PTR_START_MULTI = 0x8000,  
  MACH_DYLD_CHAINED_PTR_START_LAST  = 0x8000,  
};
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT64    EntryOffset;          
  UINT64    StackSize;            
} MACH_ENTRY_POINT_COMMAND;
 
#define MACH_SOURCE_VERSION_A_MASK  0xFFFFFF0000000000U
#define MACH_SOURCE_VERSION_B_MASK  0x000000FFC0000000U
#define MACH_SOURCE_VERSION_V_MASK  0x000000003FF00000U
#define MACH_SOURCE_VERSION_D_MASK  0x00000000000FFC00U
#define MACH_SOURCE_VERSION_E_MASK  0x00000000000003FFU
 
#define MACH_SOURCE_VERSION_A(Version)  (((Version) & MACH_SOURCE_VERSION_A_MASK) >> 40U)
#define MACH_SOURCE_VERSION_B(Version)  (((Version) & MACH_SOURCE_VERSION_B_MASK) >> 30U)
#define MACH_SOURCE_VERSION_C(Version)  (((Version) & MACH_SOURCE_VERSION_V_MASK) >> 20U)
#define MACH_SOURCE_VERSION_D(Version)  (((Version) & MACH_SOURCE_VERSION_D_MASK) >> 10U)
#define MACH_SOURCE_VERSION_E(Version)  ((Version)  & MACH_SOURCE_VERSION_E_MASK)
 
typedef struct {
  MACH_LOAD_COMMAND_HDR_
  UINT64    Version;          
} MACH_SOURCE_VERSION_COMMAND;
 
typedef union {
  MACH_LOAD_COMMAND                  *Hdr;
  MACH_SEGMENT_COMMAND               *Segment;
  MACH_SEGMENT_COMMAND_64            *Segment64;
  MACH_FIXED_VM_LIB_COMMAND          *VmLib;
  MACH_DYLIB_COMMAND                 *Dylib;
  MACH_SUB_FRAMEWORK_COMMAND         *SubFramework;
  MACH_SUB_CLIENT_COMMAND            *SubClient;
  MACH_SUB_UMBRELLA_COMMAND          *SubUmbrella;
  MACH_SUB_LIBRARY_COMMAND           *SubLibrary;
  MACH_PREBOUND_DYLIB_COMMAND        *PreboundDyLib;
  MACH_DYLINKER_COMMAND              *Dylinker;
  MACH_THREAD_COMMAND                *Thread;
  MACH_ROUTINES_COMMAND              *Routines;
  MACH_ROUTINES_COMMAND_64           *Routines64;
  MACH_SYMTAB_COMMAND                *Symtab;
  MACH_DYSYMTAB_COMMAND              *Dysymtab;
  MACH_TWO_LEVEL_HINTS_COMMAND       *TwoLevelHints;
  MACH_PREBIND_CHECKSUM_COMMAND      *PrebindChecksum;
  MACH_UUID_COMMAND                  *Uuid;
  MACH_RUN_PATH_COMMAND              *RunPath;
  MACH_LINKEDIT_DATA_COMMAND         *LinkeditData;
  MACH_ENCRYPTION_INFO_COMMAND       *EncryptionInfo;
  MACH_ENCRYPTION_INFO_COMMAND_64    *EncryptionInfo64;
  MACH_VERSION_MIN_COMMAND           *VersionMin;
  MACH_BUILD_VERSION_COMMAND         *BuildVersion;
  MACH_DYLD_INFO_COMMAND             *DyldInfo;
  MACH_LINKER_OPTION_COMMAND         *LinkerOption;
  MACH_SYMBOL_SEGMENT_COMMAND        *SymbolSegment;
  MACH_IDENTIFICATION_COMMAND        *Identification;
  MACH_FIXED_VM_FILE_COMMAND         *FixedVmFile;
  MACH_LINKEDIT_DATA_COMMAND         *DyldExportsTrie;
  MACH_LINKEDIT_DATA_COMMAND         *DyldChainedFixups;
  MACH_FILESET_ENTRY_COMMAND         *FilesetEntry;
  VOID                               *Pointer;
  UINTN                              Address;
} MACH_LOAD_COMMAND_PTR;
 
#undef MACH_LOAD_COMMAND_HDR_
 
enum {
  MachHeaderFileTypeObject            = 1,
  MachHeaderFileTypeExecute           = 2,
  MachHeaderFileTypeFixedVmLib        = 3,
  MachHeaderFileTypeCore              = 4,
  MachHeaderFileTypePreload           = 5,
  MachHeaderFileTypeDylib             = 6,
  MachHeaderFileTypeDynamicLinker     = 7,
  MachHeaderFileTypeBundle            = 8,
  MachHeaderFileTypeDynamicLinkerStub = 9,
  MachHeaderFileTypeDsym              = 10,
  MachHeaderFileTypeKextBundle        = 11,
  //
  // A file composed of other Mach-Os to be run in the same userspace sharing
  // a single linkedit. Used by 11.0 kernelcache.
  //
  MachHeaderFileTypeFileSet = 12,
};
 
typedef UINT32 MACH_HEADER_FILE_TYPE;
 
//
// Constants for the Flags field of the MACH_HEADER struct
//
#define MACH_HEADER_FLAG_NO_UNDEFINED_REFERENCES          BIT0
#define MACH_HEADER_FLAG_INCREMENTAL_LINK                 BIT1
#define MACH_HEADER_FLAG_DYNAMIC_LINKER_LINK              BIT2
#define MACH_HEADER_FLAG_BINARY_DATA_LOAD                 BIT3
#define MACH_HEADER_FLAG_PREBOUND                         BIT4
#define MACH_HEADER_FLAG_SPLIT_SEGMENTS                   BIT5
#define MACH_HEADER_FLAG_LAZY_INITIALIZATION              BIT6
#define MACH_HEADER_FLAG_TWO_LEVEL                        BIT7
#define MACH_HEADER_FLAG_FORCE_FLAT                       BIT8
#define MACH_HEADER_FLAG_NO_MULTIPLE_DEFINITIONS          BIT9
#define MACH_HEADER_FLAG_NO_FIX_PREBINDING                BIT10
#define MACH_HEADER_FLAG_PREBINDABLE                      BIT11
#define MACH_HEADER_FLAG_ALL_MODULES_BOUND                BIT12
#define MACH_HEADER_FLAG_SUBSECTIONS_VIA_SYNBOLS          BIT13
#define MACH_HEADER_FLAG_CANONICAL                        BIT14
#define MACH_HEADER_FLAG_WEAK_DEFINES                     BIT15
#define MACH_HEADER_FLAG_BINDS_TO_WEAK                    BIT16
#define MACH_HEADER_FLAG_ALLOW_STACK_EXECUTION            BIT17
#define MACH_HEADER_FLAG_ROOT_SAFE                        BIT18
#define MACH_HEADER_FLAG_SET_UID_SAFE                     BIT19
#define MACH_HEADER_FLAG_NO_REEXPORTED_DYLIBS             BIT20
#define MACH_HEADER_FLAG_POSITION_INDEPENDENT_EXECUTABLE  BIT21
#define MACH_HEADER_FLAG_DEAD_STRIPPABLE_DYLIB            BIT22
#define MACH_HEADER_FLAG_HAS_TLV_DESCRIPTORS              BIT23
#define MACH_HEADER_FLAG_NO_HEAP_EXECUTION                BIT24
#define MACH_HEADER_FLAG_APP_EXTENSION_SAFE               BIT25
#define MACH_HEADER_FLAG_NLIST_OUTOFSYNC_WITH_DYLDINFO    BIT26
#define MACH_HEADER_FLAG_SIM_SUPPORT                      BIT27
#define MACH_HEADER_FLAG_DYLIB_IN_CACHE                   BIT31
 
typedef UINT32 MACH_HEADER_FLAGS;
 
//
// Constant for the magic field of the MACH_HEADER (32-bit architectures)
//
#define MACH_HEADER_SIGNATURE         0xFEEDFACE 
#define MACH_HEADER_INVERT_SIGNATURE  0xCEFAEDFE 
 
typedef struct {
  UINT32                   Signature;    
  MACH_CPU_TYPE            CpuType;      
  MACH_CPU_SUBTYPE         CpuSubtype;   
  MACH_HEADER_FILE_TYPE    FileType;     
  UINT32                   NumCommands;  
  UINT32                   CommandsSize; 
  MACH_HEADER_FLAGS        Flags;        
  MACH_LOAD_COMMAND        Commands[];
} MACH_HEADER;
 
//
// Constant for the magic field of the MACH_HEADER_64 (64-bit architectures)
//
#define MACH_HEADER_64_SIGNATURE         0xFEEDFACF 
#define MACH_HEADER_64_INVERT_SIGNATURE  0xCFFAEDFE 
 
typedef struct {
  UINT32                   Signature;    
  MACH_CPU_TYPE            CpuType;      
  MACH_CPU_SUBTYPE         CpuSubtype;   
  MACH_HEADER_FILE_TYPE    FileType;     
  UINT32                   NumCommands;  
  UINT32                   CommandsSize; 
  MACH_HEADER_FLAGS        Flags;        
  UINT32                   Reserved;     
  MACH_LOAD_COMMAND        Commands[];
} MACH_HEADER_64;
 
typedef union {
  UINT32            Signature;
  MACH_HEADER       Header32;
  MACH_HEADER_64    Header64;
} MACH_HEADER_ANY;
 
//
// Symbols
//
 
typedef struct {
  union {
    UINT32    Address32;   
    UINT32    StringIndex; 
  } UnifiedName;
  UINT8     Type;       
  UINT8     Section;    
  INT16     Descriptor; 
  UINT32    Value;      
} MACH_NLIST;
 
typedef struct {
  union {
    UINT32    StringIndex; 
  } UnifiedName;
  UINT8     Type;       
  UINT8     Section;    
  UINT16    Descriptor; 
  UINT64    Value;      
} MACH_NLIST_64;
 
typedef union {
  MACH_NLIST       Symbol32;
  MACH_NLIST_64    Symbol64;
} MACH_NLIST_ANY;
 
//
// Symbols with a index into the string table of zero (n_un.n_strx == 0) are
// defined to have a null, "", name.  Therefore all string indexes to non null
// names must not have a zero string index.  This is bit historical information
// that has never been well documented.
//
 
//
// The n_type field really contains four fields:
//  unsigned char N_STAB:3,
//          N_PEXT:1,
//          N_TYPE:3,
//          N_EXT:1;
// which are used via the following masks.
//
#define MACH_N_TYPE_STAB  0xE0U  
#define MACH_N_TYPE_PEXT  0x10U  
#define MACH_N_TYPE_TYPE  0x0EU  
#define MACH_N_TYPE_EXT   0x01U  
 
//
// Only symbolic debugging entries have some of the N_STAB bits set and if any
// of these bits are set then it is a symbolic debugging entry (a stab).  In
// which case then the values of the n_type field (the entire field) are given
// in <mach-o/stab.h>
//
 
//
// Values for N_TYPE bits of the n_type field.
//
#define MACH_N_TYPE_UNDF  0x0U    
#define MACH_N_TYPE_ABS   0x2U    
#define MACH_N_TYPE_SECT  0xEU    
#define MACH_N_TYPE_PBUD  0xCU    
#define MACH_N_TYPE_INDR  0xAU    
 
//
// If the type is N_INDR then the symbol is defined to be the same as another
// symbol.  In this case the n_value field is an index into the string table
// of the other symbol's name.  When the other symbol is defined then they both
// take on the defined type and value.
//
 
//
// If the type is N_SECT then the n_sect field contains an ordinal of the
// section the symbol is defined in.  The sections are numbered from 1 and
// refer to sections in order they appear in the load commands for the file
// they are in.  This means the same ordinal may very well refer to different
// sections in different files.
//
// The n_value field for all symbol table entries (including N_STAB's) gets
// updated by the link editor based on the value of its n_sect field and where
// the section n_sect references gets relocated.  If the value of the n_sect
// field is NO_SECT then its n_value field is not changed by the link editor.
//
#define NO_SECT   0    
#define MAX_SECT  255  
 
//
// STAB
//
 
//
// Symbolic debugger symbols.  The comments give the conventional use for
//
//   .stabs "n_name", n_type, n_sect, n_desc, n_value
//
// where n_type is the defined constant and not listed in the comment.  Other
// fields not listed are zero. n_sect is the section ordinal the entry is
// refering to.
//
#define MACH_N_GSYM     0x20U 
#define MACH_N_FNAME    0x22U 
#define MACH_N_FUN      0x24U 
#define MACH_N_STSYM    0x26U 
#define MACH_N_LCSYM    0x28U 
#define MACH_N_BNSYM    0x2EU 
#define MACH_N_AST      0x32U 
#define MACH_N_OPT      0x3CU 
#define MACH_N_RSYM     0x40U 
#define MACH_N_SLINE    0x44U 
#define MACH_N_ENSYM    0x4EU 
#define MACH_N_SSYM     0x60U 
#define MACH_N_SO       0x64U 
#define MACH_N_OSO      0x66U 
#define MACH_N_LSYM     0x80U 
#define MACH_N_BINCL    0x82U 
#define MACH_N_SOL      0x84U 
#define MACH_N_PARAMS   0x86U 
#define MACH_N_VERSION  0x88U 
#define MACH_N_OLEVEL   0x8AU 
#define MACH_N_PSYM     0xA0U 
#define MACH_N_EINCL    0xA2U 
#define MACH_N_ENTRY    0xA4U 
#define MACH_N_LBRAC    0xC0U 
#define MACH_N_EXCL     0xC2U 
#define MACH_N_RBRAC    0xE0U 
#define MACH_N_BCOMM    0xE2U 
#define MACH_N_ECOMM    0xE4U 
#define MACH_N_ECOML    0xE8U 
#define MACH_N_LENG     0xFEU 
 
//
// The bit 0x0020 of the n_desc field is used for two non-overlapping purposes
// and has two different symbolic names, N_NO_DEAD_STRIP and N_DESC_DISCARDED.
//
 
#define MACH_N_NO_DEAD_STRIP  0x0020U
#define MACH_N_DESC_DISCARDED  0x0020U
#define MACH_N_WEAK_REF  0x0040U
#define MACH_N_WEAK_DEF  0x0080U
#define MACH_N_REF_TO_WEAK  0x0080U
#define MACH_N_ARM_THUMB_DEF  0x0008U
#define MACH_N_SYMBOL_RESOLVER  0x0100U
#define MACH_N_ALT_ENTRY  0x0200U
#define MACH_N_PC  0x30U
 
//
// Relocations
//
 
typedef struct {
  INT32     Address;           
  UINT32    SymbolNumber : 24; 
  UINT32    PcRelative   : 1;  
  UINT32    Size         : 2;  
  UINT32    Extern       : 1;  
  UINT32    Type         : 4;  
} MACH_RELOCATION_INFO;
 
#define MACH_RELOC_ABSOLUTE  0U    
 
//
// The r_address is not really the address as its name indicates but an
// offset.  In 4.3BSD a.out objects this offset is from the start of the
// "segment" for which relocation entry is for (text or data).  For Mach-O
// object files it is also an offset but from the start of the "section" for
// which the relocation entry is for.  See comments in <mach-o/loader.h> about
// the r_address field in images for used with the dynamic linker.
//
// In 4.3BSD a.out objects if r_extern is zero then r_symbolnum is an ordinal
// for the segment the symbol being relocated is in.  These ordinals are the
// symbol types N_TEXT, N_DATA, N_BSS or N_ABS.  In Mach-O object files these
// ordinals refer to the sections in the object file in the order their section
// structures appear in the headers of the object file they are in.  The first
// section has the ordinal 1, the second 2, and so on.  This means that the
// same ordinal in two different object files could refer to two different
// sections.  And further could have still different ordinals when combined
// by the link-editor.  The value MACH_RELOC_ABSOLUTE is used for relocation entries for
// absolute symbols which need no further relocation.
//
 
//
// For RISC machines some of the references are split across two instructions
// and the instruction does not contain the complete value of the reference.
// In these cases a second, or paired relocation entry, follows each of these
// relocation entries, using a PAIR r_type, which contains the other part of
// the reference not contained in the instruction.  This other part is stored
// in the pair's r_address field.  The exact number of bits of the other part
// of the reference store in the r_address field is dependent on the particular
// relocation type for the particular architecture.
//
 
#define MACH_RELOC_SCATTERED  0x80000000U
 
typedef struct {
 #if defined (MACH_LITTLE_ENDIAN)
  UINT32    Address    : 24; 
  UINT32    Type       : 4;  
  UINT32    Size       : 2;  
  UINT32    PcRelative : 1;  
  UINT32    Scattered  : 1;  
  INT32     Value;           
 #elif defined (MACH_BIG_ENDIAN)
  UINT32    Scattered  : 1;  
  UINT32    PcRelative : 1;  
  UINT32    Size       : 2;  
  UINT32    Type       : 4;  
  UINT32    Address    : 24; 
  INT32     Value;           
 #else
  #error "No endianness information was provided!"
 #endif
} MACH_SCATTERED_RELOCATION_INFO;
 
enum {
  MachGenericRelocVanilla,             
  MachGenericRelocPair,                
  MachGenericRelocSectDiff,
  MachGenericRelocPreboundLazyPointer, 
  MachGenericRelocLocalSectDiff,
  MachGenericRelocThreadLocalVariables 
};
 
enum {
  MachX8664RelocUnsigned,            
  MachX8664RelocSigned,              
  MachX8664RelocBranch,              
  MachX8664RelocGotLoad,             
  MachX8664RelocGot,                 
  MachX8664RelocSubtractor,          
  MachX8664RelocSigned1,             
  MachX8664RelocSigned2,             
  MachX8664RelocSigned4,             
  MachX8664RelocThreadLocalVariable  
};
 
#endif // APPLE_MACHO_IMAGE_H