@@ -127,11 +127,24 @@ impl Module {
127127 }
128128 #[ cfg( feature = "alloc" ) ]
129129 ( PointerSize :: Bit64 , BinaryFormat :: MachO ) => {
130- const SIG_MONO_64_MACHO : Signature < 3 > = Signature :: new ( "48 8B 3D" ) ;
131- let scan_address: Address = SIG_MONO_64_MACHO
132- . scan_process_range ( process, ( root_domain_function_address, 0x100 ) ) ?
133- + 3 ;
134- scan_address + 0x4 + process. read :: < i32 > ( scan_address) . ok ( ) ?
130+ const SIG_MONO_X86_64_MACHO : Signature < 3 > = Signature :: new ( "48 8B 3D" ) ;
131+ // 57 0f 00 d0 adrp x23,(page + 0x1ea000)
132+ // e0 da 47 f9 ldr x0,[x23, #0xfb0]=>(page + 0x1eafb0)
133+ const SIG_MONO_ARM_64_MACHO : Signature < 8 > =
134+ Signature :: new ( "57 0F 00 D0 E0 DA 47 F9" ) ;
135+ if let Some ( scan_address) = SIG_MONO_X86_64_MACHO
136+ . scan_process_range ( process, ( root_domain_function_address, 0x100 ) )
137+ . map ( |a| a + 3 )
138+ {
139+ scan_address + 0x4 + process. read :: < i32 > ( scan_address) . ok ( ) ?
140+ } else if let Some ( scan_address) = SIG_MONO_ARM_64_MACHO
141+ . scan_process_range ( process, ( root_domain_function_address, 0x100 ) )
142+ {
143+ let page = scan_address. value ( ) & 0xfffffffffffff000 ;
144+ ( page + 0x1eafb0 ) . into ( )
145+ } else {
146+ return None ;
147+ }
135148 }
136149 ( PointerSize :: Bit32 , BinaryFormat :: PE ) => {
137150 const SIG_32_1 : Signature < 2 > = Signature :: new ( "FF 35" ) ;
0 commit comments