010 editor MachOTemplate.bt 模板一处笔误


typedef struct {
    char section_name[16];
    char segment_name[16];
    uint64 address ;
    uint64 size ;
    uint64 offset;     //  这个错了。 应该是 uint32 offset;
    uint32 section_alignment;
    uint32 relocation_entry_offset;
    uint32 number_of_relocation_entries;
    uint32 flags ;
    uint32 reserved1;
    uint32 reserved2;
} Section64 ;

分析某mac后台进程发现对应不上,翻了一下mach-o头文件才发现,正确的应该为


typedef struct {
    char section_name[16];
    char segment_name[16];
    uint64 address ;
    uint64 size ;
    uint32 offset;
    uint32 section_alignment;
    uint32 relocation_entry_offset;
    uint32 number_of_relocation_entries;
    uint32 flags ;
    uint32 reserved1;
    uint32 reserved2;
} Section64 ;
posted @ 2015-11-24 10:10  tieyan  阅读(280)  评论(0编辑  收藏  举报