Add support for Mach-O files

nightlark commented 10 months ago

This may be a bit of a larger task, but should be relatively straightforward. Look into the Mach-O file format, and extract whatever information could be interesting (see the ELF and PE file extraction code for ideas).

macOS/BSD might both benefit from support for Mach-O files.

In addition to the above, other things that could be looked into include:

macOS also uses directories ending in .app as a container for programs, which should have some additional metadata files (*.plist perhaps?), in addition to .pkg installers potentially having information of interest
BSD distributions might have their own packaging file format that contains metadata that could be extracted

nightlark commented 5 months ago

One request that came up -- if possible capture signing certificate information from codesign/notarization that is attached to Mach-O files.

Czatar commented 3 months ago

I've started some work on this task, and whoever will continue this can pick up from here.

What's left to be done before merging is:

Decide whether to differentiate machine type integers. Specifically, Lines 52 and 53 are based on these CPU types
Add user configurable option for including exports and bindings and signature contents
Make sure everything relevant is extracted from LIEF
Determine relationships for MACHO files (might be another PR)
Decide whether to split these into cases

LLNL / Surfactant

Add support for Mach-O files #60