cle 9.3.2__tar.gz → 9.3.3__tar.gz

{cle-9.3.2/cle.egg-info → cle-9.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cle
-Version: 9.3.2
+Version: 9.3.3
 Summary: CLE Loads Everything (at least, many binary formats!) and provides a pythonic interface to analyze what they are and what they would look like in memory.
 License-Expression: BSD-2-Clause
 Project-URL: Homepage, https://api.angr.io/projects/cle/en/latest/
@@ -13,13 +13,13 @@ Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: archinfo==9.3.2
+Requires-Dist: archinfo==9.3.3
 Requires-Dist: arpy==1.1.1
 Requires-Dist: cart
 Requires-Dist: minidump>=0.0.10
 Requires-Dist: pefile==2024.8.26
 Requires-Dist: pyelftools>=0.29
-Requires-Dist: pyvex==9.3.2
+Requires-Dist: pyvex==9.3.3
 Requires-Dist: pyxbe~=1.0.3
 Requires-Dist: pyxdia~=0.1; sys_platform != "emscripten"
 Requires-Dist: sortedcontainers>=2.0

{cle-9.3.2 → cle-9.3.3}/cle/__init__.py

@@ -7,7 +7,7 @@ The primary interface to CLE is the Loader class.
 
 from __future__ import annotations
 
-__version__ = "9.3.2"
+__version__ = "9.3.3"
 
 from .address_translator import AT, AddressTranslator
 from .backends import (
@@ -26,6 +26,9 @@ from .backends import (
     ExceptionHandling,
     FunctionHint,
     FunctionHintSource,
+    GoFunction,
+    GoPclntab,
+    GoSymbol,
     Hex,
     Jar,
     MachO,
@@ -40,6 +43,7 @@ from .backends import (
     Soot,
     SRec,
     StaticArchive,
+    STM32Backend,
     Symbol,
     SymbolSubType,
     SymbolType,
@@ -95,6 +99,9 @@ __all__ = [
     "ExceptionHandling",
     "FunctionHint",
     "FunctionHintSource",
+    "GoFunction",
+    "GoPclntab",
+    "GoSymbol",
     "Hex",
     "SRec",
     "Jar",
@@ -108,6 +115,7 @@ __all__ = [
     "Segment",
     "Soot",
     "StaticArchive",
+    "STM32Backend",
     "Universal2",
     "register_backend",
     "ExternObject",

{cle-9.3.2 → cle-9.3.3}/cle/backends/__init__.py

@@ -6,6 +6,7 @@ from .cartfile import CARTFile
 from .cgc import CGC, BackedCGC
 from .coff import Coff
 from .elf import ELF, ELFCore, MetaELF
+from .gopclntab import GoFunction, GoPclntab, GoSymbol
 from .ihex import Hex
 from .java.apk import Apk
 from .java.jar import Jar
@@ -18,6 +19,7 @@ from .region import Region, Section, Segment
 from .regions import Regions
 from .srec import SRec
 from .static_archive import StaticArchive
+from .stm32 import STM32Backend
 from .symbol import Symbol, SymbolSubType, SymbolType
 from .te import TE
 from .uefi_firmware import UefiFirmware
@@ -53,6 +55,7 @@ __all__ = [
     "Soot",
     "XBE",
     "StaticArchive",
+    "STM32Backend",
     "Region",
     "Segment",
     "Section",
@@ -60,6 +63,9 @@ __all__ = [
     "Symbol",
     "SymbolType",
     "SymbolSubType",
+    "GoFunction",
+    "GoPclntab",
+    "GoSymbol",
     "UefiFirmware",
     "TE",
     "Universal2",

{cle-9.3.2 → cle-9.3.3}/cle/backends/coff.py

@@ -53,6 +53,7 @@ class IMAGE_SCN(IntFlag):
     Section Flags (Characteristics field)
     """
 
+    MEM_DISCARDABLE = 0x02000000
     MEM_EXECUTE = 0x20000000
     MEM_READ = 0x40000000
     MEM_WRITE = 0x80000000
@@ -236,13 +237,19 @@ class CoffParser:
         name_encoded = bytes(self.symbols[symbol_idx].Name)
         name_as_dwords = struct.unpack("<II", name_encoded)
         if name_as_dwords[0] == 0:
-            name_encoded = extract_null_terminated_bytestr(self.strings, offset=name_as_dwords[1])
+            return self.get_string(name_as_dwords[1])
         return name_encoded.rstrip(b"\x00").decode("ascii")
 
+    def get_string(self, offset: int) -> str:
+        """
+        Read the string table entry at `offset`, counted from the start of the table.
+        """
+        return extract_null_terminated_bytestr(self.strings, offset=offset).decode("ascii")
+
     def get_section_name(self, section_idx: int) -> str:
         name = bytes(self.sections[section_idx].Name).rstrip(b"\x00").decode("ascii")
         if name.startswith("/"):
-            return self.get_symbol_name(int(name[1:]))
+            return self.get_string(int(name[1:]))
         return name
 
 
@@ -288,13 +295,16 @@ class CoffRelocation(Relocation):
 
     __slots__ = ()
 
-    PACK_FORMAT = "<i"
+    PACK_FORMAT = "<I"
 
     def relocate(self):
         value = self.value
         if value is None:
             log.debug("Unresolved relocation with no symbol.")
             return False
+        # The field holds a fixed-width bit pattern, so the value is truncated to that width
+        # rather than required to fit in it.
+        value &= (1 << (struct.calcsize(self.PACK_FORMAT) * 8)) - 1
         self.owner.memory.store(self.relative_addr, struct.pack(self.PACK_FORMAT, value))
         return True
 
@@ -310,7 +320,8 @@ class CoffRelocationREL32(CoffRelocation):
     def value(self):
         assert self.resolvedby is not None
         org_bytes = self.owner.memory.load(self.relative_addr, 4)
-        org_value = struct.unpack("<I", org_bytes)[0]
+        # The field is a signed displacement, so its addend is too.
+        org_value = struct.unpack("<i", org_bytes)[0]
         return org_value + self.resolvedby.rebased_addr - (self.rebased_addr + 4)
 
 
@@ -351,8 +362,6 @@ class CoffRelocationADDR32NB(CoffRelocation):
 
     __slots__ = ()
 
-    PACK_FORMAT = "<I"
-
     @property
     def value(self) -> int:
         assert self.resolvedby is not None
@@ -397,8 +406,6 @@ class CoffRelocationSECREL(CoffRelocation):
 
     __slots__ = ()
 
-    PACK_FORMAT = "<I"
-
     @property
     def value(self):
         assert isinstance(self.owner, Coff)

{cle-9.3.2 → cle-9.3.3}/cle/backends/elf/elf.py

@@ -24,6 +24,7 @@ from sortedcontainers import SortedDict
 
 from cle.address_translator import AT
 from cle.backends.backend import ExceptionHandling, FunctionHint, FunctionHintSource, register_backend
+from cle.backends.gopclntab import GoPclntab, register_gopclntab_symbols
 from cle.backends.inlined_function import InlinedFunction
 from cle.errors import CLECompatibilityError, CLEError, CLEInvalidBinaryError
 from cle.patched_stream import PatchedStream
@@ -171,6 +172,9 @@ class ELF(MetaELF):
         self.compilation_units: list[CompilationUnit] | None = None
         self.functions_debug_info: dict[int, Subprogram] = {}
 
+        # Go
+        self.gopclntab: GoPclntab | None = None
+
         # misc
         self._entry = self._reader.header.e_entry
         self.is_relocatable = self._reader.header.e_type == "ET_REL"
@@ -238,6 +242,9 @@ class ELF(MetaELF):
                 if os.path.isfile(debug_filename):
                     self.__process_debug_file(debug_filename)
 
+        # Go binaries keep a full function table even when stripped
+        self.gopclntab = register_gopclntab_symbols(self)
+
         # call the methods defined by MetaELF
         self._ppc64_abiv1_entry_fix()
         self._load_plt()
@@ -1289,6 +1296,16 @@ class ELF(MetaELF):
         if isinstance(symtab, sections.NullSection):
             # Oh my god Atmel please stop
             symtab = self._reader.get_section_by_name(".symtab")
+        if symtab is None and section.header.get("sh_type") != "SHT_RELR":
+            # A stripped object can still carry a relocation section whose linked symbol table was stripped away.
+            # Without the table there is nothing that can be registered.
+            # RELR sections are exempt: their entries carry no symbol index.
+            log.warning(
+                "%s: relocation section %s has no symbol table to resolve its entries against; skipping it.",
+                self.binary,
+                section.name,
+            )
+            return
         relocs = []
         for readelf_reloc in section.iter_relocations():
             # Handle packed RELR relocations specially

{cle-9.3.2 → cle-9.3.3}/cle/backends/elf/relocation/arm64.py

@@ -19,6 +19,7 @@ from .generic import (
     GenericTLSDoffsetReloc,
     GenericTLSModIdReloc,
     GenericTLSOffsetReloc,
+    RelocTruncate32Mixin,
 )
 
 log = logging.getLogger(name=__name__)
@@ -66,7 +67,7 @@ class R_AARCH64_TLSDESC(GenericTLSDescriptorReloc):
     RESOLVER_ADDR = 0xFFFF_FFFF_FFFF_FE00
 
 
-class R_AARCH64_PREL32(GenericPCRelativeAddendReloc):
+class R_AARCH64_PREL32(RelocTruncate32Mixin, GenericPCRelativeAddendReloc):
     """
     Relocation Type: 261
     Calculation: (S + A - P)

cle-9.3.3/cle/backends/gopclntab.py

@@ -0,0 +1,313 @@
+"""
+Recovery of Go function symbols from the Go runtime's ``pclntab``.
+
+Every binary produced by the Go linker carries this table (``.gopclntab`` on ELF,
+``__gopclntab`` on Mach-O, embedded in ``.rdata`` on PE). It lists the entry point and the
+name of every function in the image, which makes it the only reliable source of function
+starts for stripped Go binaries.
+
+Only the Go 1.18+ layouts (magic ``0xfffffff0`` and ``0xfffffff1``) are supported. The
+header magic and the ``textStart`` field are deliberately not trusted: obfuscated binaries
+clobber them, so the table is instead accepted or rejected on structural grounds.
+"""
+
+from __future__ import annotations
+
+import logging
+import struct
+from typing import TYPE_CHECKING, NamedTuple
+
+from cle.address_translator import AT
+
+from .symbol import Symbol, SymbolType
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+    from .backend import Backend
+
+log = logging.getLogger(name=__name__)
+
+__all__ = ["GoFunction", "GoPclntab", "GoSymbol", "load_gopclntab", "register_gopclntab_symbols"]
+
+# magic -> minimum Go version that emits it
+GO_PCLNTAB_MAGICS = {
+    0xFFFFFFF1: (1, 20),
+    0xFFFFFFF0: (1, 18),
+}
+
+# Section names that hold nothing but a pclntab.
+PCLNTAB_SECTION_NAMES = frozenset({".gopclntab", "__gopclntab", ".go.pclntab", "__go_pclntab"})
+
+# Sections a pclntab may be embedded in, searched by magic as a fallback.
+_EMBEDDING_SECTION_NAMES = frozenset({".rdata", ".rodata", "__rodata", "__const", "__DATA_CONST"})
+
+# Sections whose presence means "this was built by the Go toolchain".
+_GO_MARKER_SECTION_NAMES = frozenset({".gosymtab", ".typelink", ".itablink", ".noptrdata", ".noptrbss"})
+
+_VALID_PTR_SIZES = (4, 8)
+_VALID_MIN_LC = (1, 2, 4)
+_MAX_NAME_LEN = 4096
+
+
+class GoFunction(NamedTuple):
+    """
+    One entry of the pclntab's function table.
+
+    :ivar addr: Entry point of the function, as a linked virtual address.
+    :ivar size: Distance to the next function; includes inter-function padding.
+    :ivar name: Fully qualified Go name, e.g. ``net/http.(*Server).Serve``.
+    """
+
+    addr: int
+    size: int
+    name: str
+
+
+class GoSymbol(Symbol):
+    """
+    A function symbol recovered from a Go pclntab.
+    """
+
+    def __init__(self, owner: Backend, name: str, relative_addr: int, size: int):
+        super().__init__(owner, name, relative_addr, size, SymbolType.TYPE_FUNCTION)
+
+
+class GoPclntab:
+    """
+    A parsed Go pclntab.
+
+    :ivar magic:        The raw magic word. May be garbage: it is not used for validation.
+    :ivar min_lc:       Minimum instruction length of the target architecture.
+    :ivar ptr_size:     Pointer size, in bytes.
+    :ivar text_start:   The base the function entry offsets are relative to, after recovery.
+    :ivar functions:    The function table, sorted by address.
+    """
+
+    __slots__ = ("magic", "min_lc", "ptr_size", "text_start", "functions")
+
+    def __init__(self, magic: int, min_lc: int, ptr_size: int, text_start: int, functions: list[GoFunction]):
+        self.magic = magic
+        self.min_lc = min_lc
+        self.ptr_size = ptr_size
+        self.text_start = text_start
+        self.functions = functions
+
+    def __repr__(self):
+        return f"<GoPclntab: {len(self.functions)} functions, text at {self.text_start:#x}>"
+
+    @property
+    def go_version(self) -> tuple[int, int] | None:
+        return GO_PCLNTAB_MAGICS.get(self.magic)
+
+    @classmethod
+    def parse(
+        cls,
+        data: bytes,
+        endness: str = "<",
+        text_start_fallback: int | None = None,
+        is_text_addr: Callable[[int], bool] | None = None,
+    ) -> GoPclntab | None:
+        """
+        Parse a pclntab out of ``data``, which must start at the table header.
+
+        Returns None if ``data`` does not structurally look like a pclntab.
+
+        :param data:                The bytes of the table.
+        :param endness:             ``<`` or ``>``.
+        :param text_start_fallback: Address to use when the header's ``textStart`` is unusable.
+        :param is_text_addr:        Predicate deciding whether ``textStart`` points at code.
+        """
+        header = _parse_header(data, endness)
+        if header is None:
+            return None
+        magic, min_lc, ptr_size, nfunc, text_start, funcname_off, pcln_off = header
+
+        if text_start == 0 or (is_text_addr is not None and not is_text_addr(text_start)):
+            if text_start_fallback is None:
+                log.warning("gopclntab: textStart %#x is not code and there is no fallback", text_start)
+                return None
+            log.debug("gopclntab: textStart %#x is not code, using %#x instead", text_start, text_start_fallback)
+            text_start = text_start_fallback
+
+        # nfunc pairs of (entryoff, funcoff), then one final entryoff marking the end of the last function
+        entries = struct.unpack_from(f"{endness}{2 * nfunc + 1}I", data, pcln_off)
+        entry_offs = entries[0::2]
+        func_offs = entries[1::2]
+        if any(a >= b for a, b in zip(entry_offs, entry_offs[1:])):
+            log.debug("gopclntab: function entry offsets are not monotonically increasing")
+            return None
+
+        functions = []
+        for i, func_off in enumerate(func_offs):
+            # the _func struct is entryOff uint32 followed by nameOff int32
+            name_ptr = pcln_off + func_off + 4
+            if name_ptr + 4 > len(data):
+                log.debug("gopclntab: _func %d lies outside the table", i)
+                return None
+            name_off = funcname_off + struct.unpack_from(endness + "i", data, name_ptr)[0]
+            if not funcname_off <= name_off < len(data):
+                log.debug("gopclntab: name of function %d lies outside the table", i)
+                return None
+            end = data.find(b"\0", name_off, name_off + _MAX_NAME_LEN)
+            if end == -1:
+                log.debug("gopclntab: name of function %d is unterminated", i)
+                return None
+            name = data[name_off:end].decode("utf-8", "replace")
+            functions.append(GoFunction(text_start + entry_offs[i], entry_offs[i + 1] - entry_offs[i], name))
+
+        return cls(magic, min_lc, ptr_size, text_start, functions)
+
+
+def _parse_header(data: bytes, endness: str) -> tuple[int, int, int, int, int, int, int] | None:
+    """
+    Validate and decode a pclntab header. Returns
+    ``(magic, min_lc, ptr_size, nfunc, text_start, funcname_off, pcln_off)`` or None.
+
+    The magic is decoded but never checked, so that binaries with a clobbered one still load.
+    """
+    if len(data) < 16:
+        return None
+    magic, _pad, min_lc, ptr_size = struct.unpack_from(endness + "IHBB", data, 0)
+    if ptr_size not in _VALID_PTR_SIZES or min_lc not in _VALID_MIN_LC or _pad != 0:
+        return None
+
+    header_size = 8 + 8 * ptr_size
+    if len(data) < header_size:
+        return None
+    word = endness + ("Q" if ptr_size == 8 else "I")
+    nfunc, nfiles, text_start, funcname_off, cu_off, filetab_off, pctab_off, pcln_off = (
+        struct.unpack_from(word, data, 8 + i * ptr_size)[0] for i in range(8)
+    )
+
+    size = len(data)
+    # the five sub-tables follow the header in a fixed order and all live inside the table
+    offsets = (funcname_off, cu_off, filetab_off, pctab_off, pcln_off)
+    if offsets[0] < header_size or offsets[-1] >= size:
+        return None
+    if any(a > b for a, b in zip(offsets, offsets[1:])):
+        return None
+    # a function costs 8 bytes of functab plus a _func struct, a file name at least 2 bytes
+    if nfunc <= 0 or pcln_off + (2 * nfunc + 1) * 4 > size:
+        return None
+    if nfiles * 2 > size:
+        return None
+
+    return magic, min_lc, ptr_size, nfunc, text_start, funcname_off, pcln_off
+
+
+#
+# Backend integration
+#
+
+
+def _read_section(backend: Backend, section) -> bytes | None:
+    try:
+        if section.memsize == 0 or section.only_contains_uninitialized_data:
+            return None
+        return backend.memory.load(AT.from_lva(section.vaddr, backend).to_rva(), section.memsize)
+    except Exception:  # pylint: disable=broad-except
+        return None
+
+
+def _executable_sections(backend: Backend):
+    return [sec for sec in backend.sections if sec.is_executable and sec.memsize > 0]
+
+
+def _text_start_fallback(execs) -> int | None:
+    """
+    The vaddr of the section holding the executable code, used when ``textStart`` is unusable.
+    """
+    if not execs:
+        return None
+    for sec in execs:
+        if sec.name in (".text", "__text"):
+            return sec.vaddr
+    return min(sec.vaddr for sec in execs)
+
+
+def _looks_like_go(backend: Backend) -> bool:
+    return any(sec.name in _GO_MARKER_SECTION_NAMES or sec.name.startswith(".go.") for sec in backend.sections)
+
+
+def _find_pclntab_data(backend: Backend, endness: str):
+    """
+    Yield candidate ``bytes`` objects, each starting at a possible pclntab header.
+    """
+    embedding = []
+    for section in backend.sections:
+        if section.name in PCLNTAB_SECTION_NAMES:
+            data = _read_section(backend, section)
+            if data is not None:
+                yield data
+        elif section.name in _EMBEDDING_SECTION_NAMES and not section.is_executable:
+            embedding.append(section)
+
+    # PE and Mach-O bury the table in a generic read-only section; find it by magic. Only worth
+    # doing when something else already says this is a Go binary.
+    if not embedding or not _looks_like_go(backend):
+        return
+    magics = [struct.pack(endness + "I", magic) for magic in GO_PCLNTAB_MAGICS]
+    for section in embedding:
+        data = _read_section(backend, section)
+        if data is None:
+            continue
+        for magic in magics:
+            pos = data.find(magic)
+            while pos != -1:
+                yield data[pos:]
+                pos = data.find(magic, pos + 4)
+
+
+def load_gopclntab(backend: Backend) -> GoPclntab | None:
+    """
+    Find and parse the Go pclntab of an already-loaded object. Returns None if there is none.
+    """
+    if not backend.sections:
+        return None
+    endness = ">" if backend.arch is not None and backend.arch.memory_endness == "Iend_BE" else "<"
+
+    execs: list = []
+
+    def is_text_addr(addr: int) -> bool:
+        return any(sec.contains_addr(addr) for sec in execs)
+
+    fallback = None
+    for i, data in enumerate(_find_pclntab_data(backend, endness)):
+        if i == 0:
+            execs = _executable_sections(backend)
+            fallback = _text_start_fallback(execs)
+        tab = GoPclntab.parse(data, endness, text_start_fallback=fallback, is_text_addr=is_text_addr)
+        if tab is not None:
+            return tab
+    return None
+
+
+def register_gopclntab_symbols(backend: Backend) -> GoPclntab | None:
+    """
+    Parse the object's Go pclntab, if it has one, and add a function symbol for every Go
+    function that is not already covered by a symbol table.
+    """
+    try:
+        tab = load_gopclntab(backend)
+    except (struct.error, ValueError):
+        log.warning("Failed to parse the Go pclntab of %s", backend.binary_basename, exc_info=True)
+        return None
+    if tab is None:
+        return None
+
+    covered = {sym.relative_addr for sym in backend.symbols if sym.size and sym.is_function}
+    by_name = getattr(backend, "_symbols_by_name", None)
+    added = 0
+    for func in tab.functions:
+        relative_addr = AT.from_lva(func.addr, backend).to_rva()
+        if relative_addr in covered:
+            continue
+        symbol = GoSymbol(backend, func.name, relative_addr, func.size)
+        backend.symbols.add(symbol)
+        if by_name is not None and func.name and func.name not in by_name:
+            by_name[func.name] = symbol
+        added += 1
+
+    log.info("Recovered %d Go functions from the pclntab of %s (%d new)", len(tab.functions), backend, added)
+    return tab

{cle-9.3.2 → cle-9.3.3}/cle/backends/macho/macho.py

@@ -1041,11 +1041,18 @@ class MachO(Backend):
             # It would allocate 4GB of unneeded memory and also break rebasing
             # because now there is a segment that must be at address 0, while the other segments should be slid
             log.info("Found PAGEZERO, skipping backer for memory conservation")
+        elif seg.memsize == 0:
+            # A segment with vmsize 0 occupies no address space, so it must not be backed no matter how much file
+            # content it has. Debug info kept in the executable rather than a .dSYM is emitted like this: __DWARF has
+            # vmsize 0 and shares its vmaddr with the segment that follows it, so backing it would map the debug info
+            # over that segment.
+            log.info("Segment %r is not mapped at runtime, skipping backer", segname)
         elif seg.filesize > 0:
-            # Append segment data to memory
-            blob = self._read(f, seg.offset, seg.filesize)
-            if seg.filesize < seg.memsize:
-                blob += b"\0" * (seg.memsize - seg.filesize)  # padding
+            # Append segment data to memory. A segment maps memsize bytes and the file contributes at most that many
+            # of them, so anything the file has beyond memsize is not part of the mapping.
+            blob = self._read(f, seg.offset, min(seg.filesize, seg.memsize))
+            if len(blob) < seg.memsize:
+                blob += b"\0" * (seg.memsize - len(blob))  # padding
 
             # The memory of the Backend itself should start at 0, where 0 is the lowest meaningful address
             # In our case this would be the Mach header magic

{cle-9.3.2 → cle-9.3.3}/cle/backends/macho/macho_enums.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from enum import IntEnum
+from enum import IntEnum, IntFlag
 
 
 class LoadCommands(IntEnum):
@@ -70,6 +70,67 @@ class LoadCommands(IntEnum):
     LC_DYLD_CHAINED_FIXUPS = 0x34 | LC_REQ_DYLD
 
 
+class SectionType(IntEnum):
+    """
+    from mach-o/loader.h
+
+    Constants for the low byte of a section's flags field, which says what the section holds.
+    """
+
+    S_REGULAR = 0x0
+    S_ZEROFILL = 0x1
+    S_CSTRING_LITERALS = 0x2
+    S_4BYTE_LITERALS = 0x3
+    S_8BYTE_LITERALS = 0x4
+    S_LITERAL_POINTERS = 0x5
+    S_NON_LAZY_SYMBOL_POINTERS = 0x6
+    S_LAZY_SYMBOL_POINTERS = 0x7
+    S_SYMBOL_STUBS = 0x8
+    S_MOD_INIT_FUNC_POINTERS = 0x9
+    S_MOD_TERM_FUNC_POINTERS = 0xA
+    S_COALESCED = 0xB
+    S_GB_ZEROFILL = 0xC
+    S_INTERPOSING = 0xD
+    S_16BYTE_LITERALS = 0xE
+    S_DTRACE_DOF = 0xF
+    S_LAZY_DYLIB_SYMBOL_POINTERS = 0x10
+    S_THREAD_LOCAL_REGULAR = 0x11
+    S_THREAD_LOCAL_ZEROFILL = 0x12
+    S_THREAD_LOCAL_VARIABLES = 0x13
+    S_THREAD_LOCAL_VARIABLE_POINTERS = 0x14
+    S_THREAD_LOCAL_INIT_FUNCTION_POINTERS = 0x15
+    S_INIT_FUNC_OFFSETS = 0x16
+
+
+class SectionAttributes(IntFlag):
+    """
+    from mach-o/loader.h
+
+    Constants for the section attributes, which occupy the high three bytes of a section's flags field.
+    """
+
+    # section contains only true machine instructions
+    S_ATTR_PURE_INSTRUCTIONS = 0x80000000
+    # section contains coalesced symbols that are not to be in a ranlib table of contents
+    S_ATTR_NO_TOC = 0x40000000
+    # ok to strip static symbols in this section in files with the MH_DYLDLINK flag
+    S_ATTR_STRIP_STATIC_SYMS = 0x20000000
+    # no dead stripping
+    S_ATTR_NO_DEAD_STRIP = 0x10000000
+    # blocks are live if they reference live blocks
+    S_ATTR_LIVE_SUPPORT = 0x08000000
+    # used in code generated by the UNIX C++ compiler for virtual function tables
+    S_ATTR_SELF_MODIFYING_CODE = 0x04000000
+    # a debug section
+    S_ATTR_DEBUG = 0x02000000
+    # section contains some machine instructions
+    S_ATTR_SOME_INSTRUCTIONS = 0x00000400
+    # section has external relocation entries
+    S_ATTR_EXT_RELOC = 0x00000200
+    # section has local relocation entries
+    S_ATTR_LOC_RELOC = 0x00000100
+
+
 class MachoFiletype(IntEnum):
     """
     from mach-o/loader.h