macho 文件查看常用命令

命令匯總

  1. file XXX
    查看macho文件架構信息和是否是動態(tài)庫
ZBMAC:Frameworks XXX$ file /usr/lib/dyld
/usr/lib/dyld: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit dynamic linker x86_64] [i386:Mach-O dynamic linker i386]
/usr/lib/dyld (for architecture x86_64):    Mach-O 64-bit dynamic linker x86_64
/usr/lib/dyld (for architecture i386):  Mach-O dynamic linker i386

從上面信息可以看出來宣蔚,dyld是一個dynamic linker(動態(tài)庫),支持i386和 x86_64

2.lipo -info XXX
查看macho文件架構信息

ZBMAC:Frameworks XXX$ lipo -info  /usr/lib/dyld
Architectures in the fat file: /usr/lib/dyld are: x86_64 i386 

從上面信息可以看出來寒跳,dyld支持i386和 x86_64架構

3.lipo XXX -thin arm64 -output XXX_arm64
提取arm64架構文件

4.ar -t XXX_arm64
查看提取arm64架構下,文件組成竹椒,打印.o文件集合

ZBMAC:Frameworks XXX$ ar -t XXX_arm64
A.o
B.o
C.o

5.ar xv XXX_arm64
提取arm64架構下冯袍,文件組成,會生成一個.o文件的集合碾牌。

6.ar rcs arm64 XXX文件夾/*.o
將上一步的所有.o文件合成一個 arm64架構康愤,這一步主要是用于瘦身的時候,刪除某個.o文件以后舶吗,重新組合其它.o文件征冷。

7.ar -d -sv arm64 XXX.o
刪除arm64架構中,某個.o文件誓琼。

8.otool -L XXX
查看macho文件依賴動態(tài)庫

ZBMAC:Frameworks XXX$ otool -L /usr/lib/libobjc.dylib
/usr/lib/libobjc.dylib:
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /usr/lib/libc++abi.dylib (compatibility version 1.0.0, current version 400.8.0)
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 400.9.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.0.0)

從上面信息可以看出來检激,libobjc.dylib依賴libobjc.A.dylib 、libc++abi.dylib 腹侣、libc++.1.dylib叔收、libSystem.B.dylib這四個動態(tài)庫

9.otool -l Taobao4iPhone | grep crypt
查看macho文件是否被加密

ZBMAC:Taobao4iPhone.app XXX$ otool -l  Taobao4iPhone | grep crypt 
     cryptoff 16384
    cryptsize 53575680
      cryptid 0
     cryptoff 16384
    cryptsize 58785792
      cryptid 0

如果cryptid 為1,則表示是加密的傲隶,為0則是未加密饺律,從上面信心可以看出macho文件未加密,因為我的macho文件是下載的越獄ipa跺株,如果從appstore下載的复濒,cryptid內(nèi)容為1,為加密的乒省。

10.otool -v -s __DATA __objc_selrefs XXX
查看macho文件中巧颈,被引用的方法,這個可以結合linkmap中的方法袖扛,分析出可執(zhí)行文件中砸泛,無用的方法。

11.otool -v -s __DATA __objc_classlist XXX
查看macho中所有OC類

  1. otool -v -s __DATA __objc_classrefs XXX
    查看macho中引用的OC類

13.grep -r -n "XXX" ./
查看目錄中包含XXX的文件

淘寶實例

如何獲取macho文件蛆封,可以查看這篇文章 iOS 如何完全抓取出ipa包內(nèi)的所有圖片資源唇礁,把ipa包解壓出來,里面就有macho文件娶吞。

下面我們以淘寶的macho文件為例垒迂,我用的淘寶8.4.0版本,查看相關信息:
1.架構信息

ZBMAC:Taobao4iPhone.app XXX$ file Taobao4iPhone
Taobao4iPhone: Mach-O universal binary with 2 architectures: [arm_v7:Mach-O executable arm_v7] [arm64]
Taobao4iPhone (for architecture armv7): Mach-O executable arm_v7
Taobao4iPhone (for architecture arm64): Mach-O 64-bit executable arm64

以上信息可以看出妒蛇,淘寶支持arm_v7和arm64架構

2.淘寶依賴庫信息

ZBMAC:Taobao4iPhone.app XXX$ otool -L Taobao4iPhone
Taobao4iPhone (architecture armv7):
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 400.9.1)
    /usr/lib/libc++abi.dylib (compatibility version 1.0.0, current version 400.7.0)
    /usr/lib/libicucore.A.dylib (compatibility version 1.0.0, current version 59.1.0)
    /usr/lib/libresolv.9.dylib (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libxml2.2.dylib (compatibility version 10.0.0, current version 10.9.0)
    /usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)
    @rpath/ALSharedExtension.framework/ALSharedExtension (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AVFoundation.framework/AVFoundation (compatibility version 1.0.0, current version 2.0.0)
    /System/Library/Frameworks/AVKit.framework/AVKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Accelerate.framework/Accelerate (compatibility version 1.0.0, current version 4.0.0)
    /System/Library/Frameworks/AdSupport.framework/AdSupport (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AddressBook.framework/AddressBook (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AddressBookUI.framework/AddressBookUI (compatibility version 1.0.0, current version 33.0.0)
    /System/Library/Frameworks/AssetsLibrary.framework/AssetsLibrary (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AudioToolbox.framework/AudioToolbox (compatibility version 1.0.0, current version 492.0.0)
    /System/Library/Frameworks/CFNetwork.framework/CFNetwork (compatibility version 1.0.0, current version 887.0.0)
    /System/Library/Frameworks/CoreAudio.framework/CoreAudio (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreBluetooth.framework/CoreBluetooth (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreData.framework/CoreData (compatibility version 1.0.0, current version 847.1.0)
    /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1443.0.0)
    /System/Library/Frameworks/CoreGraphics.framework/CoreGraphics (compatibility version 64.0.0, current version 1125.2.1)
    /System/Library/Frameworks/CoreImage.framework/CoreImage (compatibility version 1.0.0, current version 5.0.0)
    /System/Library/Frameworks/CoreLocation.framework/CoreLocation (compatibility version 1.0.0, current version 2235.0.2)
    /System/Library/Frameworks/CoreMedia.framework/CoreMedia (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreMotion.framework/CoreMotion (compatibility version 1.0.0, current version 2235.0.2)
    /System/Library/Frameworks/CoreTelephony.framework/CoreTelephony (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/CoreText.framework/CoreText (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreVideo.framework/CoreVideo (compatibility version 1.2.0, current version 1.5.0)
    /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1444.12.0)
    /System/Library/Frameworks/GLKit.framework/GLKit (compatibility version 1.0.0, current version 92.0.0)
    /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
    /System/Library/Frameworks/ImageIO.framework/ImageIO (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore (compatibility version 1.0.0, current version 604.1.38)
    /System/Library/Frameworks/LocalAuthentication.framework/LocalAuthentication (compatibility version 1.0.0, current version 425.1.13)
    /System/Library/Frameworks/MapKit.framework/MapKit (compatibility version 1.0.0, current version 14.0.0)
    /System/Library/Frameworks/MediaPlayer.framework/MediaPlayer (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MessageUI.framework/MessageUI (compatibility version 1.0.0, current version 3445.0.12)
    /System/Library/Frameworks/Metal.framework/Metal (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MobileCoreServices.framework/MobileCoreServices (compatibility version 1.0.0, current version 822.8.0)
    /System/Library/Frameworks/MultipeerConnectivity.framework/MultipeerConnectivity (compatibility version 1.0.0, current version 146.0.0)
    /System/Library/Frameworks/OpenGLES.framework/OpenGLES (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Photos.framework/Photos (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/QuartzCore.framework/QuartzCore (compatibility version 1.2.0, current version 1.11.0)
    /System/Library/Frameworks/SafariServices.framework/SafariServices (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Security.framework/Security (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/Social.framework/Social (compatibility version 1.0.0, current version 87.0.0)
    /System/Library/Frameworks/StoreKit.framework/StoreKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration (compatibility version 1.0.0, current version 963.0.0)
    /System/Library/Frameworks/UIKit.framework/UIKit (compatibility version 1.0.0, current version 3694.4.18)
    /System/Library/Frameworks/VideoToolbox.framework/VideoToolbox (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Contacts.framework/Contacts (compatibility version 0.0.0, current version 0.0.0)
    /System/Library/Frameworks/ContactsUI.framework/ContactsUI (compatibility version 1.0.0, current version 33.0.0)
    /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlight (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MetalPerformanceShaders.framework/MetalPerformanceShaders (compatibility version 1.0.0, current version 88.2.0)
    /System/Library/Frameworks/UserNotifications.framework/UserNotifications (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/WatchConnectivity.framework/WatchConnectivity (compatibility version 1.0.0, current version 157.0.0)
    /System/Library/Frameworks/WebKit.framework/WebKit (compatibility version 1.0.0, current version 604.1.38)
    @rpath/TBSharedFramework.framework/TBSharedFramework (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.0.0)
    /System/Library/Frameworks/EventKit.framework/EventKit (compatibility version 1.0.0, current version 100.0.0)
    /System/Library/Frameworks/HealthKit.framework/HealthKit (compatibility version 1.0.0, current version 1.0.0)
Taobao4iPhone (architecture arm64):
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 400.9.1)
    /usr/lib/libc++abi.dylib (compatibility version 1.0.0, current version 400.7.0)
    /usr/lib/libicucore.A.dylib (compatibility version 1.0.0, current version 59.1.0)
    /usr/lib/libresolv.9.dylib (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libxml2.2.dylib (compatibility version 10.0.0, current version 10.9.0)
    /usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)
    @rpath/ALSharedExtension.framework/ALSharedExtension (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AVFoundation.framework/AVFoundation (compatibility version 1.0.0, current version 2.0.0)
    /System/Library/Frameworks/AVKit.framework/AVKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Accelerate.framework/Accelerate (compatibility version 1.0.0, current version 4.0.0)
    /System/Library/Frameworks/AdSupport.framework/AdSupport (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AddressBook.framework/AddressBook (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AddressBookUI.framework/AddressBookUI (compatibility version 1.0.0, current version 33.0.0)
    /System/Library/Frameworks/AssetsLibrary.framework/AssetsLibrary (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/AudioToolbox.framework/AudioToolbox (compatibility version 1.0.0, current version 492.0.0)
    /System/Library/Frameworks/CFNetwork.framework/CFNetwork (compatibility version 1.0.0, current version 887.0.0)
    /System/Library/Frameworks/CoreAudio.framework/CoreAudio (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreBluetooth.framework/CoreBluetooth (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreData.framework/CoreData (compatibility version 1.0.0, current version 847.1.0)
    /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1443.0.0)
    /System/Library/Frameworks/CoreGraphics.framework/CoreGraphics (compatibility version 64.0.0, current version 1125.2.1)
    /System/Library/Frameworks/CoreImage.framework/CoreImage (compatibility version 1.0.0, current version 5.0.0)
    /System/Library/Frameworks/CoreLocation.framework/CoreLocation (compatibility version 1.0.0, current version 2235.0.2)
    /System/Library/Frameworks/CoreMedia.framework/CoreMedia (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreMotion.framework/CoreMotion (compatibility version 1.0.0, current version 2235.0.2)
    /System/Library/Frameworks/CoreTelephony.framework/CoreTelephony (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/CoreText.framework/CoreText (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/CoreVideo.framework/CoreVideo (compatibility version 1.2.0, current version 1.5.0)
    /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1444.12.0)
    /System/Library/Frameworks/GLKit.framework/GLKit (compatibility version 1.0.0, current version 92.0.0)
    /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
    /System/Library/Frameworks/ImageIO.framework/ImageIO (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore (compatibility version 1.0.0, current version 604.1.38)
    /System/Library/Frameworks/LocalAuthentication.framework/LocalAuthentication (compatibility version 1.0.0, current version 425.1.13)
    /System/Library/Frameworks/MapKit.framework/MapKit (compatibility version 1.0.0, current version 14.0.0)
    /System/Library/Frameworks/MediaPlayer.framework/MediaPlayer (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MessageUI.framework/MessageUI (compatibility version 1.0.0, current version 3445.0.12)
    /System/Library/Frameworks/Metal.framework/Metal (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MobileCoreServices.framework/MobileCoreServices (compatibility version 1.0.0, current version 822.8.0)
    /System/Library/Frameworks/MultipeerConnectivity.framework/MultipeerConnectivity (compatibility version 1.0.0, current version 146.0.0)
    /System/Library/Frameworks/OpenGLES.framework/OpenGLES (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Photos.framework/Photos (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/QuartzCore.framework/QuartzCore (compatibility version 1.2.0, current version 1.11.0)
    /System/Library/Frameworks/SafariServices.framework/SafariServices (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Security.framework/Security (compatibility version 1.0.0, current version 0.0.0)
    /System/Library/Frameworks/Social.framework/Social (compatibility version 1.0.0, current version 87.0.0)
    /System/Library/Frameworks/StoreKit.framework/StoreKit (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration (compatibility version 1.0.0, current version 963.0.0)
    /System/Library/Frameworks/UIKit.framework/UIKit (compatibility version 1.0.0, current version 3694.4.18)
    /System/Library/Frameworks/VideoToolbox.framework/VideoToolbox (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/Contacts.framework/Contacts (compatibility version 0.0.0, current version 0.0.0)
    /System/Library/Frameworks/ContactsUI.framework/ContactsUI (compatibility version 1.0.0, current version 33.0.0)
    /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlight (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/MetalPerformanceShaders.framework/MetalPerformanceShaders (compatibility version 1.0.0, current version 88.2.0)
    /System/Library/Frameworks/UserNotifications.framework/UserNotifications (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/Frameworks/WatchConnectivity.framework/WatchConnectivity (compatibility version 1.0.0, current version 157.0.0)
    /System/Library/Frameworks/WebKit.framework/WebKit (compatibility version 1.0.0, current version 604.1.38)
    @rpath/TBSharedFramework.framework/TBSharedFramework (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.0.0)
    /System/Library/Frameworks/EventKit.framework/EventKit (compatibility version 1.0.0, current version 100.0.0)
    /System/Library/Frameworks/HealthKit.framework/HealthKit (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libcompression.dylib (compatibility version 1.0.0, current version 1.0.0)

以上依賴庫中机断,/System/Library/和/usr/lib/路徑均為系統(tǒng)動態(tài)庫,@rpath/為自己封裝到ipa中的動態(tài)庫绣夺。

最后編輯于
?著作權歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
  • 序言:七十年代末吏奸,一起剝皮案震驚了整個濱河市,隨后出現(xiàn)的幾起案子陶耍,更是在濱河造成了極大的恐慌奋蔚,老刑警劉巖,帶你破解...
    沈念sama閱讀 211,265評論 6 490
  • 序言:濱河連續(xù)發(fā)生了三起死亡事件烈钞,死亡現(xiàn)場離奇詭異泊碑,居然都是意外死亡,警方通過查閱死者的電腦和手機毯欣,發(fā)現(xiàn)死者居然都...
    沈念sama閱讀 90,078評論 2 385
  • 文/潘曉璐 我一進店門馒过,熙熙樓的掌柜王于貴愁眉苦臉地迎上來,“玉大人酗钞,你說我怎么就攤上這事腹忽。” “怎么了砚作?”我有些...
    開封第一講書人閱讀 156,852評論 0 347
  • 文/不壞的土叔 我叫張陵窘奏,是天一觀的道長。 經(jīng)常有香客問我葫录,道長着裹,這世上最難降的妖魔是什么? 我笑而不...
    開封第一講書人閱讀 56,408評論 1 283
  • 正文 為了忘掉前任米同,我火速辦了婚禮求冷,結果婚禮上,老公的妹妹穿的比我還像新娘窍霞。我一直安慰自己匠题,他們只是感情好,可當我...
    茶點故事閱讀 65,445評論 5 384
  • 文/花漫 我一把揭開白布但金。 她就那樣靜靜地躺著韭山,像睡著了一般。 火紅的嫁衣襯著肌膚如雪冷溃。 梳的紋絲不亂的頭發(fā)上钱磅,一...
    開封第一講書人閱讀 49,772評論 1 290
  • 那天,我揣著相機與錄音似枕,去河邊找鬼盖淡。 笑死,一個胖子當著我的面吹牛凿歼,可吹牛的內(nèi)容都是我干的褪迟。 我是一名探鬼主播冗恨,決...
    沈念sama閱讀 38,921評論 3 406
  • 文/蒼蘭香墨 我猛地睜開眼,長吁一口氣:“原來是場噩夢啊……” “哼味赃!你這毒婦竟也來了掀抹?” 一聲冷哼從身側(cè)響起,我...
    開封第一講書人閱讀 37,688評論 0 266
  • 序言:老撾萬榮一對情侶失蹤心俗,失蹤者是張志新(化名)和其女友劉穎傲武,沒想到半個月后,有當?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體城榛,經(jīng)...
    沈念sama閱讀 44,130評論 1 303
  • 正文 獨居荒郊野嶺守林人離奇死亡揪利,尸身上長有42處帶血的膿包…… 初始之章·張勛 以下內(nèi)容為張勛視角 年9月15日...
    茶點故事閱讀 36,467評論 2 325
  • 正文 我和宋清朗相戀三年,在試婚紗的時候發(fā)現(xiàn)自己被綠了狠持。 大學時的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片疟位。...
    茶點故事閱讀 38,617評論 1 340
  • 序言:一個原本活蹦亂跳的男人離奇死亡,死狀恐怖工坊,靈堂內(nèi)的尸體忽然破棺而出献汗,到底是詐尸還是另有隱情,我是刑警寧澤王污,帶...
    沈念sama閱讀 34,276評論 4 329
  • 正文 年R本政府宣布罢吃,位于F島的核電站,受9級特大地震影響昭齐,放射性物質(zhì)發(fā)生泄漏尿招。R本人自食惡果不足惜,卻給世界環(huán)境...
    茶點故事閱讀 39,882評論 3 312
  • 文/蒙蒙 一阱驾、第九天 我趴在偏房一處隱蔽的房頂上張望就谜。 院中可真熱鬧,春花似錦里覆、人聲如沸丧荐。這莊子的主人今日做“春日...
    開封第一講書人閱讀 30,740評論 0 21
  • 文/蒼蘭香墨 我抬頭看了看天上的太陽虹统。三九已至,卻和暖如春隧甚,著一層夾襖步出監(jiān)牢的瞬間车荔,已是汗流浹背。 一陣腳步聲響...
    開封第一講書人閱讀 31,967評論 1 265
  • 我被黑心中介騙來泰國打工戚扳, 沒想到剛下飛機就差點兒被人妖公主榨干…… 1. 我叫王不留忧便,地道東北人。 一個月前我還...
    沈念sama閱讀 46,315評論 2 360
  • 正文 我出身青樓帽借,卻偏偏與公主長得像珠增,于是被迫代替她去往敵國和親超歌。 傳聞我的和親對象是個殘疾皇子,可洞房花燭夜當晚...
    茶點故事閱讀 43,486評論 2 348

推薦閱讀更多精彩內(nèi)容