010 editor MachOTemplate.bt 模板一处笔误
typedef struct {
char section_name[16];
char segment_name[16];
uint64 address ;
uint64 size ;
uint64 offset; // 这个错了。 应该是 uint32 offset;
uint32 section_alignment;
uint32 relocation_entry_offset;
uint32 number_of_relocation_entries;
uint32 flags ;
uint32 reserved1;
uint32 reserved2;
} Section64 ;
分析某mac后台进程发现对应不上,翻了一下mach-o头文件才发现,正确的应该为
typedef struct {
char section_name[16];
char segment_name[16];
uint64 address ;
uint64 size ;
uint32 offset;
uint32 section_alignment;
uint32 relocation_entry_offset;
uint32 number_of_relocation_entries;
uint32 flags ;
uint32 reserved1;
uint32 reserved2;
} Section64 ;