Created
September 15, 2025 12:59
-
-
Save pronebird/2fa009a383fb76359f7a8856dd022b15 to your computer and use it in GitHub Desktop.
Playground for dumping text section with __launchd_plist
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import Cocoa | |
| import MachO | |
| if let handle = dlopen("/Applications/App.app/Contents/MacOS/some.helper.binary", RTLD_LAZY) { | |
| defer { dlclose(handle) } | |
| if let ptr = dlsym(handle, MH_EXECUTE_SYM) { | |
| let mhExecHeaderPtr = ptr.assumingMemoryBound(to: mach_header_64.self) | |
| var size: UInt = 0 | |
| if let plistSection = getsectiondata( | |
| mhExecHeaderPtr, | |
| "__TEXT", | |
| "__launchd_plist", | |
| &size) { | |
| let plistSectionStr = String.init(cString: plistSection) | |
| print("\(plistSectionStr)") | |
| } else { | |
| print("Text section not found") | |
| } | |
| } else { | |
| print("Cannot dlsym") | |
| } | |
| } else { | |
| print("Cannot dlopen!") | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment