heruix / macho-loader

load macho files in memory without touching the Disk

Macho loader - Mac OS x64

this code work with mini FPC core librarys <Bare Bones> for Mac OS
the generated files main & libtest.dylib is 8kb <each> only .

< load macho from memory with socket connection >

The macho loader requires access to some system functions
(e.g., NSCreateObjectFileImageFromMemory, NSLinkModule)

that are provided by libdyld.dylib. As we don't know the address of libdyld.dylib in memory .

• we first walk to the very top of the stack.

• We then start walking downwards on the stack and we inspect
  every pointer we find.

• The trick is that the offset inside of libdyld.dylib must be
  present as it's placed there by the dynamic linker as the
  return function when main returns.

• We find the offset, we resolve the functions and from then on,
  it's standard loading of macho bundle .

the main logic start at "Core/loadfunctions.pas" in loadall() .

this works only with x64 macho files .

Requirements

• FreePascal Compiler >= v3
• Mac OS
• nodejs >> for the server.js - or make your own :P

How to Build

• Just run ./Build.sh after installing FreePascal
• run node server.js
• run ./main

that's all - see you soon guys

Oh Contact : <Coldzer0 [at] protonmail.ch>