Class: MACH

MACH

This is a description of the MACH class.

new MACH()

Methods

(static) calculateEntropy()

See:

(static) calculateMD5()

See:

(static) compare()

See:

(static) compareEP()

See:

(static) compareOverlay()

See:

(static) findByte()

See:

(static) findDword()

See:

(static) findSignature()

See:

(static) findString()

See:

(static) findWord()

See:

(static) getEntryPointOffset() → {Int64}

Get the offset of the entry point.
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) getFileBaseName()

See:

(static) getFileCompleteSuffix()

See:

(static) getFileDirectory()

See:

(static) getFileSuffix()

See:

(static) getGeneralOptions() → {String}

Get a string in the form of "MACHtypeMACHmode". For example "EXE32" or "DYLIB64".
Returns:
Type
String

(static) getLibraryCurrentVersion(sLibrary) → {String}

Get the current version of a library.
Parameters:
Name Type Description
sLibrary String The name of the library.
Returns:
Type
String

(static) getNumberOfPrograms() → {Int}

Get the number of programs in the program header table(pht).
Returns:
Type
Int

(static) getNumberOfSections() → {Int}

Get the number of sections.
Returns:
Type
Int

(static) getNumberOfSections() → {Int}

Get the number of sections.
Returns:
Type
Int

(static) getNumberOfSegments() → {Int}

Get the number of segments.
Returns:
Type
Int

(static) getOverlayOffset() → {Int}

Get the file offset of the overlay.
Returns:
Type
Int

(static) getOverlaySize() → {Int}

Get the size of the overlay.
Returns:
Type
Int

(static) getSectionFileOffset(nSection) → {UInt}

Get the file offset of a section.
Parameters:
Name Type Description
nSection Int Section number.
Returns:
Type
UInt

(static) getSectionFileSize(nSection) → {UInt}

Get the file size of a section.
Parameters:
Name Type Description
nSection Int Section number.
Returns:
Type
UInt

(static) getSectionName(nSection) → {UInt}

Get the name of a section.
Parameters:
Name Type Description
nSection Int Section number.
Returns:
Type
UInt

(static) getSectionNumber(sSectionName) → {Int}

Get the number of a section with a specific name.
Parameters:
Name Type Description
sSectionName String Section name.
Returns:
0-based section number, or -1 if there is no section with that name.
Type
Int

(static) getSegmentFileOffset(nSection) → {UInt}

Get the file offset of a segment.
Parameters:
Name Type Description
nSection Int Section number.
Returns:
Type
UInt

(static) getSegmentFileSize(nSection) → {UInt}

Get the file size of a segment.
Parameters:
Name Type Description
nSection Int Section number.
Returns:
Type
UInt

(static) getSegmentName(nSection) → {UInt}

Get the name of a segment.
Parameters:
Name Type Description
nSection Int Section number.
Returns:
Type
UInt

(static) getSignature()

See:

(static) getSize()

See:

(static) getString()

See:

(static) isLibraryPresent(sLibraryName) → {Bool}

Check if there is a library with a specific name in the import table.
Parameters:
Name Type Description
sLibraryName String The name of the library.
Returns:
Type
Bool

(static) isOverlayPresent() → {Bool}

Check if an overlay is present.
Returns:
Type
Bool

(static) isSectionNamePresent(sSectionName) → {Bool}

Check if a section exists with a specific name or matches a regular expression.
Parameters:
Name Type Description
sSectionName String Section name or pattern.
Returns:
Type
Bool

(static) isSignaturePresent()

See:

(static) OffsetToRVA(nOffset) → {Int64}

Convert a file offset to a relative virtual address (RVA).
Parameters:
Name Type Description
nOffset UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) OffsetToVA(nOffset) → {Int64}

Convert a file offset to a virtual address (VA).
Parameters:
Name Type Description
nOffset UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) readByte()

See:

(static) readDword()

See:

(static) readWord()

See:

(static) RVAToOffset(nRVA) → {Int64}

Convert a relative virtual address (RVA) to a file offset.
Parameters:
Name Type Description
nRVA UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) swapBytes()

See:

(static) VAToOffset(nVA) → {Int64}

Convert a virtual address (VA) to a file offset.
Parameters:
Name Type Description
nVA UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64