1 2#------------------------------------------------------------------------------ 3# $File: cafebabe,v 1.27 2021/04/26 15:56:00 christos Exp $ 4# Cafe Babes unite! 5# 6# Since Java bytecode and Mach-O universal binaries have the same magic number, 7# the test must be performed in the same "magic" sequence to get both right. 8# The long at offset 4 in a Mach-O universal binary tells the number of 9# architectures; the short at offset 4 in a Java bytecode file is the JVM minor 10# version and the short at offset 6 is the JVM major version. Since there are only 11# only 18 labeled Mach-O architectures at current, and the first released 12# Java class format was version 43.0, we can safely choose any number 13# between 18 and 39 to test the number of architectures against 14# (and use as a hack). Let's not use 18, because the Mach-O people 15# might add another one or two as time goes by... 16# 17### JAVA START ### 18# Reference: http://en.wikipedia.org/wiki/Java_class_file 19# Update: Joerg Jenderek 200 belong 0xcafebabe 21>4 ubelong >30 compiled Java class data, 22!:mime application/x-java-applet 23#!:mime application/java-byte-code 24!:ext class 25>>6 ubeshort x version %d. 26>>4 ubeshort x \b%d 27# for debugging purpose version as hexadecimal to compare with Mach-O universal binary 28#>>4 ubelong x (%#8.8x) 29# Which is which? 30# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html 31#>>4 belong 0x002b (Java 0.?) 32#>>4 belong 0x032d (Java 1.0) 33#>>4 belong 0x032d (Java 1.1) 34>>4 belong 0x002e (Java 1.2) 35>>4 belong 0x002f (Java 1.3) 36>>4 belong 0x0030 (Java 1.4) 37>>4 belong 0x0031 (Java 1.5) 38>>4 belong 0x0032 (Java 1.6) 39>>4 belong 0x0033 (Java 1.7) 40>>4 belong 0x0034 (Java 1.8) 41>>4 belong 0x0035 (Java SE 9) 42>>4 belong 0x0036 (Java SE 10) 43>>4 belong 0x0037 (Java SE 11) 44>>4 belong 0x0038 (Java SE 12) 45>>4 belong 0x0039 (Java SE 13) 46>>4 belong 0x003A (Java SE 14) 47# pool count unequal zero 48#>>8 beshort x \b, pool count %#x 49# pool table 50#>>10 ubequad x \b, pool %#16.16llx... 51 520 belong 0xcafed00d JAR compressed with pack200, 53>5 byte x version %d. 54>4 byte x \b%d 55!:mime application/x-java-pack200 56 57 580 belong 0xcafed00d JAR compressed with pack200, 59>5 byte x version %d. 60>4 byte x \b%d 61!:mime application/x-java-pack200 62 63### JAVA END ### 64### MACH-O START ### 65# URL: https://en.wikipedia.org/wiki/Mach-O 66 670 name mach-o \b [ 68# for debugging purpose CPU type as hexadecimal 69#>0 ubequad x CPU=%16.16llx 70# display CPU type as string like: i386 x86_64 ... armv7 armv7k ... 71>0 use mach-o-cpu \b 72# for debugging purpose print offset to 1st mach_header like: 73# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h 74#>8 ubelong x at %#x offset 75>(8.L) indirect x \b: 76>0 belong x \b] 77 78# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/ 79# include/mach-o/fat.h 80# include/mach/machine.h 810 belong 0xcafebabe 82>4 belong 1 Mach-O universal binary with 1 architecture: 83!:mime application/x-mach-binary 84>>8 use mach-o \b 85# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020 86>4 ubelong >1 87>>4 ubelong <20 Mach-O universal binary with %d architectures: 88!:mime application/x-mach-binary 89>>>8 use mach-o \b 90>>>4 ubelong >1 91>>>>28 use mach-o \b 92>>>4 ubelong >2 93>>>>48 use mach-o \b 94>>>4 ubelong >3 95>>>>68 use mach-o \b 96>>>4 ubelong >4 97>>>>88 use mach-o \b 98>>>4 ubelong >5 99>>>>108 use mach-o \b 100 101### MACH-O END ### 102