{"id":16322257,"url":"https://github.com/p-x9/machokit","last_synced_at":"2026-04-18T01:04:12.402Z","repository":{"id":213284103,"uuid":"724508278","full_name":"p-x9/MachOKit","owner":"p-x9","description":"🔬 A Swift library for parsing mach-o files to obtain various information.","archived":false,"fork":false,"pushed_at":"2026-04-17T16:11:22.000Z","size":1257,"stargazers_count":227,"open_issues_count":7,"forks_count":21,"subscribers_count":5,"default_branch":"main","last_synced_at":"2026-04-17T18:18:57.710Z","etag":null,"topics":["binary","ctf","dyld","dyld-shared-cache","dylib","mach-o","macho","parser","reverse-engineering","swift","symbols"],"latest_commit_sha":null,"homepage":"https://p-x9.github.io/MachOKit/documentation/machokit/","language":"Swift","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/p-x9.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-11-28T08:15:31.000Z","updated_at":"2026-04-17T16:36:59.000Z","dependencies_parsed_at":"2024-03-18T13:29:22.175Z","dependency_job_id":"e2eb58e1-4837-4f14-9ac3-85d95a734cb4","html_url":"https://github.com/p-x9/MachOKit","commit_stats":{"total_commits":482,"total_committers":2,"mean_commits":241.0,"dds":0.006224066390041472,"last_synced_commit":"a0f42bcf3ed105c4e442131990702bad2807c549"},"previous_names":["p-x9/machokit"],"tags_count":64,"template":false,"template_full_name":null,"purl":"pkg:github/p-x9/MachOKit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/p-x9%2FMachOKit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/p-x9%2FMachOKit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/p-x9%2FMachOKit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/p-x9%2FMachOKit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/p-x9","download_url":"https://codeload.github.com/p-x9/MachOKit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/p-x9%2FMachOKit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31952208,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-18T00:39:45.007Z","status":"ssl_error","status_checked_at":"2026-04-18T00:39:20.671Z","response_time":62,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["binary","ctf","dyld","dyld-shared-cache","dylib","mach-o","macho","parser","reverse-engineering","swift","symbols"],"created_at":"2024-10-10T22:50:25.568Z","updated_at":"2026-04-18T01:04:12.388Z","avatar_url":"https://github.com/p-x9.png","language":"Swift","funding_links":[],"categories":[],"sub_categories":[],"readme":"# MachOKit\n\nLibrary for parsing MachO files to obtain various information.\n\nIn addition to file reading, parsing of images in memory by `_dyld_get_image_header` is also supported.\n\n\u003c!-- # Badges --\u003e\n\n[![Github issues](https://img.shields.io/github/issues/p-x9/MachOKit)](https://github.com/p-x9/MachOKit/issues)\n[![Github forks](https://img.shields.io/github/forks/p-x9/MachOKit)](https://github.com/p-x9/MachOKit/network/members)\n[![Github stars](https://img.shields.io/github/stars/p-x9/MachOKit)](https://github.com/p-x9/MachOKit/stargazers)\n[![Github top language](https://img.shields.io/github/languages/top/p-x9/MachOKit)](https://github.com/p-x9/MachOKit/)\n\n## Features\n\n- parse load commands\n- symbol list\n- get all cstrings\n- rebase operations\n- binding operations\n- export tries\n- ...\n\n## Usage\n\n### Load from memory\n\nFor reading from memory, use the `MachOImage` structure.\n\nIt can be initialized by using the Mach-O Header pointer obtained by `_dyld_get_image_header`.\n\n```swift\nguard let mh = _dyld_get_image_header(0) else { return }\nlet machO = MachOImage(ptr: mh)\n```\n\nAlternatively, it can be initialized using the name.\n\n```swift\n// /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation\nguard let machO = MachOImage(name: \"Foundation\") else { return }\n```\n\n### Load from file\n\nFor reading from file, use the `MachOFile` structure.\n\nReading from a file can be as follows.\nThere is a case of a Fat file and a single MachO file, so a conditional branching process is required.\n\n```swift\nlet path = \"Path to MachO file\"\nlet url = URL(string: path)\n\nlet file = try MachOKit.loadFromFile(url: url)\n\nswitch file {\ncase .machO(let machOFile): // single MachO file\n    print(machOFile)\ncase .fat(let fatFile): // Fat file\n    let machOFiles = try fatFile.machOFiles()\n    print(machOFiles)\n}\n```\n\n### Main properties and methods\n\nBoth `MachOImage` and `MachOFile` can use essentially the same properties and methods.\nThe available methods are defined in the following file as the `MachORepresentable` protocol.\n\n[MachORepresentable](./Sources/MachOKit/Protocol/MachORepresentable.swift)\n\n### Dyld Cache\n\nLoading of `dyld_shared_cache` is also supported.\n\nThe available methods are defined in the following file as the `DyldCacheRepresentable` protocol.\n\n[DyldCacheRepresentable](./Sources/MachOKit/Protocol/DyldCacheRepresentable.swift)\n\n#### Dyld Cache (File)\n\n```swift\nlet path = \"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e\"\nlet url = URL(fileURLWithPath: path)\n\nlet cache = try! DyldCache(url: url)\n```\n\nIt is also possible to extract machO information contained in `dyld_shared_cache`.\nThe machO extracted is of type `MachOFile`.\nAs with reading from a single MachO file, various analyses are possible.\n\n```swift\nlet machOs = cache.machOFiles()\nfor machO in machOs {\n    print(\n        String(machO.headerStartOffsetInCache, radix: 16),\n        machO.imagePath,\n        machO.header.ncmds\n    )\n}\n\n// 5c000 /usr/lib/libobjc.A.dylib 22\n// 98000 /usr/lib/dyld 15\n// 131000 /usr/lib/system/libsystem_blocks.dylib 24\n// ...\n```\n\n#### Full Dyld Cache (File)\n\nIn addition to `DyldCache`, `FullDyldCache` can be used to handle multiple dyld cache files (main cache and subcaches) as a single unified cache.\n\n```swift\nlet path = \"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e\"\nlet url = URL(fileURLWithPath: path)\n\nlet fullCache = try! FullDyldCache(url: url)\n\n// Access all Mach-O files across main and subcaches\nlet machOs = fullCache.machOFiles()\nfor machO in machOs {\n    print(\n        String(machO.headerStartOffsetInCache, radix: 16),\n        machO.imagePath,\n        machO.header.ncmds\n    )\n}\n```\nThe `FullDyldCache` type provides properties like `mainCache`, `subCaches`, `allCaches`, and `urls` to access each component cache file.\n\n#### Dyld Cache (on memory)\n\nOn the Apple platform, the dyld cache is deployed in memory.\n\n```swift\nvar size = 0\nguard let ptr = _dyld_get_shared_cache_range(\u0026size) else {\n    return\n}\nlet cache = try! DyldCacheLoaded(ptr: ptr)\n```\n\nIt is also possible to extract machO information contained in `dyld_shared_cache`.\nThe machO extracted is of type `MachOImage`.\nAs with reading from a single MachO image, various analyses are possible.\n\n```swift\nlet machOs = cache.machOImages()\nfor machO in machOs {\n    print(\n        String(Int(bitPattern: machO.ptr), radix: 16),\n        machO.path!,\n        machO.header.ncmds\n    )\n}\n\n// 193438000 /usr/lib/libobjc.A.dylib 24\n// 193489000 /usr/lib/dyld 15\n// 193513000 /usr/lib/system/libsystem_blocks.dylib 24\n// ...\n```\n\n### Example Codes\n\nThere are a variety of uses, but most show a basic example that prints output to the Test directory.\n\n#### Load from memory\n\nThe following file contains sample code.\n[MachOPrintTests](./Tests/MachOKitTests/MachOPrintTests.swift)\n\n#### Load from file\n\nThe following file contains sample code.\n[MachOFilePrintTests](./Tests/MachOKitTests/MachOFilePrintTests.swift)\n\n#### Dyld Cache (file)\n\nThe following file contains sample code.\n[DyldCachePrintTests](./Tests/MachOKitTests/DyldCachePrintTests.swift)\n\n#### Dyld Cache (on memory)\n\nThe following file contains sample code.\n[DyldCacheLoadedPrintTests](./Tests/MachOKitTests/DyldCacheLoadedPrintTests.swift)\n\n## Related Projects\n\n- [MachOKitSPM](https://github.com/p-x9/MachOKit-SPM)\n    Pre-built version of MachOKit\n- [SwiftHook](https://github.com/p-x9/swift-hook)\n    ⚓️ A Swift Library for hooking swift methods and functions.\n- [FishHook](https://github.com/p-x9/swift-fishhook)\n    Re-implementation of [facebook/fishhook](https://github.com/facebook/fishhook) with Swift using MachOKit\n- [AntiFishHook](https://github.com/p-x9/swift-anti-fishhook)\n    A Swift library to deactivate fishhook. (Anti-FishHook)\n\n### Other binary type\n- [ELFKit](https://github.com/p-x9/ELFKit)\n    Elf format\n\n## License\n\nMachOKit is released under the MIT License. See [LICENSE](./LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fp-x9%2Fmachokit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fp-x9%2Fmachokit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fp-x9%2Fmachokit/lists"}