#------------------------------------------------------------------------------ # $File: cafebabe,v 1.28 2022/07/01 23:24:47 christos Exp $ # Cafe Babes unite! # # Since Java bytecode and Mach-O universal binaries have the same magic number, # the test must be performed in the same "magic" sequence to get both right. # The long at offset 4 in a Mach-O universal binary tells the number of # architectures; the short at offset 4 in a Java bytecode file is the JVM minor # version and the short at offset 6 is the JVM major version. Since there are only # only 18 labeled Mach-O architectures at current, and the first released # Java class format was version 43.0, we can safely choose any number # between 18 and 39 to test the number of architectures against # (and use as a hack). Let's not use 18, because the Mach-O people # might add another one or two as time goes by... # ### JAVA START ### # Reference: http://en.wikipedia.org/wiki/Java_class_file # Update: Joerg Jenderek 0 belong 0xcafebabe >4 ubelong >30 compiled Java class data, !:mime application/x-java-applet #!:mime application/java-byte-code !:ext class >>6 ubeshort x version %d. >>4 ubeshort x \b%d # for debugging purpose version as hexadecimal to compare with Mach-O universal binary #>>4 ubelong x (%#8.8x) # Which is which? # https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html #>>4 belong 0x002b (Java 0.?) #>>4 belong 0x032d (Java 1.0) #>>4 belong 0x032d (Java 1.1) >>4 belong 0x002e (Java 1.2) >>4 belong 0x002f (Java 1.3) >>4 belong 0x0030 (Java 1.4) >>4 belong 0x0031 (Java 1.5) >>4 belong 0x0032 (Java 1.6) >>4 belong 0x0033 (Java 1.7) >>4 belong 0x0034 (Java 1.8) >>4 belong 0x0035 (Java SE 9) >>4 belong 0x0036 (Java SE 10) >>4 belong 0x0037 (Java SE 11) >>4 belong 0x0038 (Java SE 12) >>4 belong 0x0039 (Java SE 13) >>4 belong 0x003A (Java SE 14) >>4 belong 0x003B (Java SE 15) >>4 belong 0x003C (Java SE 16) >>4 belong 0x003D (Java SE 17) >>4 belong 0x003E (Java SE 18) >>4 belong 0x003F (Java SE 19) >>4 belong 0x0040 (Java SE 20) # pool count unequal zero #>>8 beshort x \b, pool count %#x # pool table #>>10 ubequad x \b, pool %#16.16llx... 0 belong 0xcafed00d JAR compressed with pack200, >5 byte x version %d. >4 byte x \b%d !:mime application/x-java-pack200 0 belong 0xcafed00d JAR compressed with pack200, >5 byte x version %d. >4 byte x \b%d !:mime application/x-java-pack200 ### JAVA END ### ### MACH-O START ### # URL: https://en.wikipedia.org/wiki/Mach-O 0 name mach-o \b [ # for debugging purpose CPU type as hexadecimal #>0 ubequad x CPU=%16.16llx # display CPU type as string like: i386 x86_64 ... armv7 armv7k ... >0 use mach-o-cpu \b # for debugging purpose print offset to 1st mach_header like: # 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h #>8 ubelong x at %#x offset >(8.L) indirect x \b: >0 belong x \b] # Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/ # include/mach-o/fat.h # include/mach/machine.h 0 belong 0xcafebabe >4 belong 1 Mach-O universal binary with 1 architecture: !:mime application/x-mach-binary >>8 use mach-o \b # nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020 >4 ubelong >1 >>4 ubelong <20 Mach-O universal binary with %d architectures: !:mime application/x-mach-binary >>>8 use mach-o \b >>>4 ubelong >1 >>>>28 use mach-o \b >>>4 ubelong >2 >>>>48 use mach-o \b >>>4 ubelong >3 >>>>68 use mach-o \b >>>4 ubelong >4 >>>>88 use mach-o \b >>>4 ubelong >5 >>>>108 use mach-o \b ### MACH-O END ###