Unclear installation instructions

[andermoran]

I added the project to my current xcode project and created a new workspace. I opened the workspace and can build my project. However the first line of the example let memoryMap = try! MKMemoryMap(contentsOfFile: URL(fileURLWithPath: "/System/Library/Frameworks/Foundation.framework/Foundation"))

gives me an error:

ld: warning: Auto-Linking supplied '/Users/andermoran/Desktop/Detective-C/MachOKit.framework/MachOKit', file was built for arm64 which is not the architecture being linked (x86_64): /Users/andermoran/Desktop/Detective-C/MachOKit.framework/MachOKit Undefined symbols for architecture x86_64: "_OBJC_CLASS_$_MKMemoryMap", referenced from: objc-class-ref in ViewController.o ld: symbol(s) not found for architecture x86_64 clang: error: linker command failed with exit code 1 (use -v to see invocation)

could you clarify how this is supposed to be implemented? Also some Objective-C code example would be nice :)

[DeVaukz]

Hey @andermoran

I'll work on flushing out the Installation instructions. The major step that's currently missing is that you must add the MachOKit framework target as a Target Dependency of your application (Select your application target and look under the Build Phases tab). This will tell Xcode to build the MachOKit framework for whatever platform+arch your application is building for.

[DeVaukz]

Installation instructions expanded in 9c1251a.

[andermoran]

Still having issues with it. What's the fastest way to contact you? I need to get this working ASAP as I'm trying to use it for a school project!

[DeVaukz]

Hey @andermoran

What's the latest issue? There is not a lot of information in your original post, but it looks like you built the MachOKit framework and then added that to your project, instead of adding the MachOKit Xcode project.

I was able to create a new macOS application Xcode project, drop in MachOKit.xcodeproj, add MachOKit framework as an embedded binary, and start using MachOKit from the new project without any problems. I'm also working on another project - Mach-O Explorer - that uses Mach-O Kit, if you want to see a working example of this setup.

Xcode subprojects are well understood and are used in many projects. Try searching for "Xcode subproject" in your favorite search engine.

Lastly, double check that you included the --recursive option when cloning Mach-O Kit, as shown in the ReadMe. This is very important.

[andermoran]

It works but maybe also include that they need to import MachOKit in their file! Also does this work on iOS binaries that are decrypted?

[andermoran]

Can you put an example of you using your kit in Objective-C?

[DeVaukz]

Mach-O Kit should parse unencrypted binaries from all Apple platforms (macOS, iOS, tvOS, watchOS, and their respective simulators) but almost all testing thus far has been with macOS binaries.

[DeVaukz]

Here is the Objective-C Metadata example from the ReadMe, in Objective-C

    MKMemoryMap *memoryMap = [MKMemoryMap memoryMapWithContentsOfFile:[NSURL fileURLWithPath:@"/Applications/Calculator.app/Contents/MacOS/Calculator"] error:nil];
    
    // Instantiate an instance of MKMachOImage to begin parsing the Calculator binary
    MKMachOImage *macho;
    {
        MKFatBinary *fat = [[MKFatBinary alloc] initWithMemoryMap:memoryMap error:nil];
        if (fat) {
            // It's a FAT binary, find the x86_64 slice
            for (MKFatArch *slice in fat.architectures) {
                if (slice.cputype == CPU_TYPE_X86_64) {
                    // Instantiate an instance of MKMachOImage to parse the slice
                    macho = [[MKMachOImage alloc] initWithName:"calculator" flags:0 atAddress:slice.offset inMapping:memoryMap error:nil];
                    break;
                }
            }
        } else {
            // Not a FAT binary
            macho = [[MKMachOImage alloc] initWithName:"calculator" flags:0 atAddress:0 inMapping:memoryMap error:nil];
        }
        NSAssert(macho != nil, @"Failed to initialize MKMachOImage");
    }
    
    // Find the MKObjCClassListSection
    for (MKSection *section in macho.sections.allValues) {
        // Mach-O Kit instantiates a specialized subclass of MKSection when it encounters a section containing Objective-C class list metadata
        if ([section isKindOfClass:MKObjCClassListSection.class]) {
            MKObjCClassListSection *classListSection = (MKObjCClassListSection*)section;
            // Print all the class names
            for (MKPointerNode *clsPointer in classListSection.elements) {
                // The __objc_(n)classlist sections are just a list of pointers to class structures in the data section
                MKObjCClass *cls = clsPointer.pointee.value;
                // The pointer to the class name is stored in the class data
                MKObjCClassData *clsData = cls.classData.pointee.value;
                // Finally, the name is a pointer to a string in the strings section
                MKCString *clsName = clsData.name.pointee.value;
                
                NSLog(@"%@", clsName);
            }
        }
    }