2023-08-06 16:12:15 +00:00
|
|
|
|
|
|
|
|
#------------------------------------------------------------------------------
|
2023-08-08 11:16:24 +00:00
|
|
|
# $File: cafebabe,v 1.28 2022/07/01 23:24:47 christos Exp $
|
2023-08-06 16:12:15 +00:00
|
|
|
# Cafe Babes unite!
|
|
|
|
|
#
|
|
|
|
|
# Since Java bytecode and Mach-O universal binaries have the same magic number,
|
|
|
|
|
# the test must be performed in the same "magic" sequence to get both right.
|
|
|
|
|
# The long at offset 4 in a Mach-O universal binary tells the number of
|
|
|
|
|
# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
|
|
|
|
|
# version and the short at offset 6 is the JVM major version. Since there are only
|
|
|
|
|
# only 18 labeled Mach-O architectures at current, and the first released
|
|
|
|
|
# Java class format was version 43.0, we can safely choose any number
|
|
|
|
|
# between 18 and 39 to test the number of architectures against
|
|
|
|
|
# (and use as a hack). Let's not use 18, because the Mach-O people
|
|
|
|
|
# might add another one or two as time goes by...
|
|
|
|
|
#
|
|
|
|
|
### JAVA START ###
|
|
|
|
|
# Reference: http://en.wikipedia.org/wiki/Java_class_file
|
|
|
|
|
# Update: Joerg Jenderek
|
|
|
|
|
0 belong 0xcafebabe
|
|
|
|
|
>4 ubelong >30 compiled Java class data,
|
|
|
|
|
!:mime application/x-java-applet
|
|
|
|
|
#!:mime application/java-byte-code
|
|
|
|
|
!:ext class
|
|
|
|
|
>>6 ubeshort x version %d.
|
|
|
|
|
>>4 ubeshort x \b%d
|
|
|
|
|
# for debugging purpose version as hexadecimal to compare with Mach-O universal binary
|
|
|
|
|
#>>4 ubelong x (%#8.8x)
|
|
|
|
|
# Which is which?
|
|
|
|
|
# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html
|
|
|
|
|
#>>4 belong 0x002b (Java 0.?)
|
|
|
|
|
#>>4 belong 0x032d (Java 1.0)
|
|
|
|
|
#>>4 belong 0x032d (Java 1.1)
|
|
|
|
|
>>4 belong 0x002e (Java 1.2)
|
|
|
|
|
>>4 belong 0x002f (Java 1.3)
|
|
|
|
|
>>4 belong 0x0030 (Java 1.4)
|
|
|
|
|
>>4 belong 0x0031 (Java 1.5)
|
|
|
|
|
>>4 belong 0x0032 (Java 1.6)
|
|
|
|
|
>>4 belong 0x0033 (Java 1.7)
|
|
|
|
|
>>4 belong 0x0034 (Java 1.8)
|
|
|
|
|
>>4 belong 0x0035 (Java SE 9)
|
|
|
|
|
>>4 belong 0x0036 (Java SE 10)
|
|
|
|
|
>>4 belong 0x0037 (Java SE 11)
|
|
|
|
|
>>4 belong 0x0038 (Java SE 12)
|
|
|
|
|
>>4 belong 0x0039 (Java SE 13)
|
|
|
|
|
>>4 belong 0x003A (Java SE 14)
|
2023-08-08 11:16:24 +00:00
|
|
|
>>4 belong 0x003B (Java SE 15)
|
|
|
|
|
>>4 belong 0x003C (Java SE 16)
|
|
|
|
|
>>4 belong 0x003D (Java SE 17)
|
|
|
|
|
>>4 belong 0x003E (Java SE 18)
|
|
|
|
|
>>4 belong 0x003F (Java SE 19)
|
|
|
|
|
>>4 belong 0x0040 (Java SE 20)
|
2023-08-06 16:12:15 +00:00
|
|
|
# pool count unequal zero
|
|
|
|
|
#>>8 beshort x \b, pool count %#x
|
|
|
|
|
# pool table
|
|
|
|
|
#>>10 ubequad x \b, pool %#16.16llx...
|
|
|
|
|
|
|
|
|
|
0 belong 0xcafed00d JAR compressed with pack200,
|
|
|
|
|
>5 byte x version %d.
|
|
|
|
|
>4 byte x \b%d
|
|
|
|
|
!:mime application/x-java-pack200
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
0 belong 0xcafed00d JAR compressed with pack200,
|
|
|
|
|
>5 byte x version %d.
|
|
|
|
|
>4 byte x \b%d
|
|
|
|
|
!:mime application/x-java-pack200
|
|
|
|
|
|
|
|
|
|
### JAVA END ###
|
|
|
|
|
### MACH-O START ###
|
|
|
|
|
# URL: https://en.wikipedia.org/wiki/Mach-O
|
|
|
|
|
|
|
|
|
|
0 name mach-o \b [
|
|
|
|
|
# for debugging purpose CPU type as hexadecimal
|
|
|
|
|
#>0 ubequad x CPU=%16.16llx
|
|
|
|
|
# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
|
|
|
|
|
>0 use mach-o-cpu \b
|
|
|
|
|
# for debugging purpose print offset to 1st mach_header like:
|
|
|
|
|
# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
|
|
|
|
|
#>8 ubelong x at %#x offset
|
|
|
|
|
>(8.L) indirect x \b:
|
|
|
|
|
>0 belong x \b]
|
|
|
|
|
|
|
|
|
|
# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/
|
|
|
|
|
# include/mach-o/fat.h
|
|
|
|
|
# include/mach/machine.h
|
|
|
|
|
0 belong 0xcafebabe
|
|
|
|
|
>4 belong 1 Mach-O universal binary with 1 architecture:
|
|
|
|
|
!:mime application/x-mach-binary
|
|
|
|
|
>>8 use mach-o \b
|
|
|
|
|
# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
|
|
|
|
|
>4 ubelong >1
|
|
|
|
|
>>4 ubelong <20 Mach-O universal binary with %d architectures:
|
|
|
|
|
!:mime application/x-mach-binary
|
|
|
|
|
>>>8 use mach-o \b
|
|
|
|
|
>>>4 ubelong >1
|
|
|
|
|
>>>>28 use mach-o \b
|
|
|
|
|
>>>4 ubelong >2
|
|
|
|
|
>>>>48 use mach-o \b
|
|
|
|
|
>>>4 ubelong >3
|
|
|
|
|
>>>>68 use mach-o \b
|
|
|
|
|
>>>4 ubelong >4
|
|
|
|
|
>>>>88 use mach-o \b
|
|
|
|
|
>>>4 ubelong >5
|
|
|
|
|
>>>>108 use mach-o \b
|
|
|
|
|
|
|
|
|
|
### MACH-O END ###
|
