GitHub - gdbinit/ExtractMachO: IDA plugin to extract Mach-O binaries located in the disassembly or data

gdbinit / ExtractMachO Public

Notifications You must be signed in to change notification settings
Fork 17
Star 56

IDA plugin to extract Mach-O binaries located in the disassembly or data

56 stars 17 forks Branches Tags Activity

Notifications

Name		Name	Last commit message	Last commit date
Latest commit History 46 Commits
ExtractMachO.xcodeproj		ExtractMachO.xcodeproj
ExtractMachO.dev		ExtractMachO.dev
ExtractMachO64.dev		ExtractMachO64.dev
Makefile		Makefile
README		README
extractmacho.cpp		extractmacho.cpp
extractmacho.h		extractmacho.h
extractors.cpp		extractors.cpp
extractors.h		extractors.h
loader.h		loader.h
mac_includes.h		mac_includes.h
uthash.h		uthash.h
validate.cpp		validate.cpp
validate.h		validate.h

Repository files navigation

 ___________         __                        __   
 \_   _____/__  ____/  |_____________    _____/  |_ 
   |    __)_\  \/  /\   __\_  __ \__  \ _/ ___\   __\
   |        \>    <  |  |  |  | \// __ \\  \___|  |  
  /_______  /__/\_ \ |__|  |__|  (____  /\___  >__|  
          \/      \/                  \/     \/      
    _____                .__              ________   
   /     \ _____    ____ |  |__           \_____  \  
  /  \ /  \\__  \ _/ ___\|  |  \   ______  /   |   \ 
 /    Y    \/ __ \\  \___|   Y  \ /_____/ /    |    \
 \____|__  (____  /\___  >___|  /         \_______  /
         \/     \/     \/     \/                  \/ 
  v1.1

 (c) 2012, fG! - [email protected] - http://reverse.put.as

This is a very simple IDA plugin to extract all Mach-O binaries contained anywhere in the disassembly.

It supports 32 and 64bits binaries, and also fat binaries, Intel, PPC and ARM!

The default behavior is to search all the IDA database for Mach-O binaries.

If you position the cursor at a Mach-O binary start address (Mach-O magic values 0xFEEDFACE or 0xFEEDFACF),
it will ask if you want to dump that specific binary. If you say no, it will fallback to default behavior.

Tested with IDA 6.3 Mac OS X version.

To compile for OS X use the Makefile or the XCode Project.
The Makefile is easier to use since you just need to set the __EA64__ environment variable if you want to compile
to IDA 64bits version.

You will need to edit the Makefile or the XCode project and set the paths to the SDK.
Refer to http://reverse.put.as/2011/10/31/how-to-create-ida-cc-plugins-with-xcode/ for XCode.
Set the environment variable __EA64__ if you want the plugin for IDA 64bits.

For Windows, DEVC++ project file is included for IDA 32 and 64 bits versions.
You will need to edit the DEVC++ project and set the paths to the SDK and plugin binary output.
Please refer to http://www.binarypool.com/idapluginwriting/ for more information.
You should do a Rebuild All in DEVC++ (especially if you switch from 32 to 64 project or vice-versa).

No default shortcut is set. 
Edit IDAP_hotkey at extractmacho.cpp to your own preference if you wish so.

Bug reports, fixes and patches are welcome: [email protected]
or github.com/gdbinit/extractmacho

IDA BUGS:
Another bug is related to the PLUGIN_UNL flag. It is used to "Unload the plugin immediately after calling 'run'.".
If this option is set, it crashes the Windows version. Mac version seems do to fine with it.

That's it! Enjoy :-)

fG!

v0.1 - Initial version that supports 32 and 64bits isolated binaries.
v0.2 - Support for fat binaries and ability to search all IDA database for binaries to be extracted.
       Now it's able to extract 32bit kernel extensions, which use MH_OBJECT file format.
v1.0 - Add report capabilities.
       Cleanups and small fixes.
v1.1 - Add PPC and ARM extraction support!