inside: Mach-O

elfmz · Nov 20, 2024 · cacccf9 · cacccf9
1 parent 68a6021
commit cacccf9
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/inside/configs/plug/config.ini b/inside/configs/plug/config.ini
@@ -9,6 +9,9 @@ SymbolsDynamic.txt=nm --dynamic $F
 [PE]
 Info.txt=readpe -A $F
 
+[Mach-O]
+Info.txt=exiftool $F
+
 [Disasm_20]
 PPC.s=powerpc-linux-gnu-objdump -d -w -z $F
 PPC_VLE.s=powerpc-eabivle-objdump -d -w -z $F

diff --git a/inside/src/inside.cpp b/inside/src/inside.cpp
@@ -116,6 +116,12 @@ static const char *DetectPlainKind(const char *Name, const unsigned char *Data,
 		&& ext && (strcasecmp(ext, ".exe") == 0 || strcasecmp(ext, ".dll") == 0 || strcasecmp(ext, ".sys") == 0
 			|| strcasecmp(ext, ".drv") == 0 || strcasecmp(ext, ".ocx") == 0 || strcasecmp(ext, ".efi") == 0)) {
 		return "PE";
+
+	} else if (DataSize >= 8 && (Data[0] == 0xfe && Data[1] == 0xed && Data[2] == 0xfa && Data[3] == 0xce) ||
+        (Data[0] == 0xce && Data[1] == 0xfa && Data[2] == 0xed && Data[3] == 0xfe) ||
+        (Data[0] == 0xca && Data[1] == 0xfe && Data[2] == 0xba && Data[3] == 0xbe)) {
+        return "Mach-O";
+
 	}
 
 	return nullptr;