Skip to content
MachoFileResolveAddress

MachoFileResolveAddress

Description

Look up the symbol whose value is closest-not-greater than vaddr and within a reasonable function span (next symbol’s value or the segment end).

vaddr is the file-relative virtual address: for a runtime IP in a PIE binary, subtract the slide first.

Success

Returns a pointer to the matching MachoSymbol.

Failure

Returns NULL.

Usage example (Cross-references)

Usage examples (Cross-references)
    
        // Address at the function start.
        const MachoSymbol *s  = MachoFileResolveAddress(&m, 0x100000010ull);
        bool               ok = s && s->name && ZstrCompare(s->name, "my_function") == 0;
    
        // Address just past the start, still inside the function body.
        s  = MachoFileResolveAddress(&m, 0x100000020ull);
        ok = ok && s && ZstrCompare(s->name, "my_function") == 0;
    
        // Address below the symbol value: no match.
        s  = MachoFileResolveAddress(&m, 0x100000000ull);
        ok = ok && s == NULL;
        u64 vaddr        = runtime_addr - slide;
    
        const MachoSymbol *sym = MachoFileResolveAddress(&m, vaddr);
        bool               ok  = sym != NULL && sym->name != NULL &&
                  ZstrFindSubstring(sym->name, "test_macho_resolves_running_binary_symbol") != NULL;
    
        // (1) Main file's LC_SYMTAB.
        const MachoSymbol *s = MachoFileResolveAddress(&entry->main, file_relative);
        if (s && s->name && s->name[0]) {
            *out_name = s->name;
        // (2) Sidecar dSYM's LC_SYMTAB.
        if (entry_open_dsym(entry, self->allocator)) {
            s = MachoFileResolveAddress(&entry->dsym, file_relative);
            if (s && s->name && s->name[0]) {
                *out_name = s->name;
    // matched stabs with all three bits set -- N_SO / N_FUN / N_OSO /
    // etc. were getting through and polluting lookups).
    const MachoSymbol *MachoFileResolveAddress(const MachoFile *self, u64 vaddr) {
        if (!self || self->symbols.length == 0)
            return NULL;
Last updated on