@@ -435,11 +435,11 @@ def _add_segments(
435435 )
436436 )
437437
438- dyld_children_size = 0
438+ linkedit_children_size = 0
439439 if segment_name == "__LINKEDIT" :
440- dyld_children = self ._build_dyld_load_command_children (binary_analysis )
441- segment_children .extend (dyld_children )
442- dyld_children_size = sum (c .size for c in dyld_children )
440+ linkedit_children = self ._build_linkedit_children (binary_analysis )
441+ segment_children .extend (linkedit_children )
442+ linkedit_children_size = sum (c .size for c in linkedit_children )
443443
444444 displayed_section_size = sum (c .size for c in segment_children )
445445
@@ -448,7 +448,7 @@ def _add_segments(
448448 seg_total_size = segment .size
449449
450450 total_section_declared = sum (s .size for s in segment .sections ) if segment .sections else 0
451- segment_overhead = seg_total_size - total_section_declared - dyld_children_size
451+ segment_overhead = seg_total_size - total_section_declared - linkedit_children_size
452452 actual_segment_size = displayed_section_size + max (0 , segment_overhead )
453453
454454 if actual_segment_size > 0 :
@@ -503,37 +503,94 @@ def _build_metadata_components(self, binary_analysis: MachOBinaryAnalysis) -> Li
503503
504504 return metadata_children
505505
506- def _build_dyld_load_command_children (self , binary_analysis : MachOBinaryAnalysis ) -> List [TreemapElement ]:
507- dyld_children : List [TreemapElement ] = []
506+ def _build_linkedit_children (self , binary_analysis : MachOBinaryAnalysis ) -> List [TreemapElement ]:
507+ """Build child elements for the __LINKEDIT segment.
508+
509+ Includes symbol table, string table, function starts, DYLD info, and code signature.
510+ """
511+ linkedit_children : List [TreemapElement ] = []
512+
513+ # Add link edit components (symbol table, string table, function starts)
514+ le = binary_analysis .linkedit_info
515+ if le is not None :
516+ if le .string_table_size > 0 :
517+ linkedit_children .append (
518+ TreemapElement (
519+ name = "String Table" ,
520+ size = le .string_table_size ,
521+ type = TreemapType .EXECUTABLES ,
522+ path = None ,
523+ is_dir = False ,
524+ children = [],
525+ )
526+ )
527+
528+ if le .symbol_table_size > 0 :
529+ linkedit_children .append (
530+ TreemapElement (
531+ name = "Symbol Table" ,
532+ size = le .symbol_table_size ,
533+ type = TreemapType .EXECUTABLES ,
534+ path = None ,
535+ is_dir = False ,
536+ children = [],
537+ )
538+ )
539+
540+ if le .function_starts_size > 0 :
541+ linkedit_children .append (
542+ TreemapElement (
543+ name = "Function Starts" ,
544+ size = le .function_starts_size ,
545+ type = TreemapType .EXECUTABLES ,
546+ path = None ,
547+ is_dir = False ,
548+ children = [],
549+ )
550+ )
551+
552+ # Add DYLD info children
508553 di = binary_analysis .dyld_info
509- if di is None :
510- return dyld_children
554+ if di is not None :
555+ if di .chained_fixups_size > 0 :
556+ linkedit_children .append (
557+ TreemapElement (
558+ name = "Chained Fixups" ,
559+ size = di .chained_fixups_size ,
560+ type = TreemapType .DYLD ,
561+ path = None ,
562+ is_dir = False ,
563+ children = [],
564+ )
565+ )
511566
512- if di .chained_fixups_size > 0 :
513- dyld_children .append (
514- TreemapElement (
515- name = "Chained Fixups" ,
516- size = di .chained_fixups_size ,
517- type = TreemapType .DYLD ,
518- path = None ,
519- is_dir = False ,
520- children = [],
567+ if di .export_trie_size > 0 :
568+ linkedit_children .append (
569+ TreemapElement (
570+ name = "Export Trie" ,
571+ size = di .export_trie_size ,
572+ type = TreemapType .DYLD ,
573+ path = None ,
574+ is_dir = False ,
575+ children = [],
576+ )
521577 )
522- )
523578
524- if di .export_trie_size > 0 :
525- dyld_children .append (
579+ # Add code signature
580+ cs = binary_analysis .code_signature_info
581+ if cs is not None and cs .size > 0 :
582+ linkedit_children .append (
526583 TreemapElement (
527- name = "Export Trie " ,
528- size = di . export_trie_size ,
529- type = TreemapType .DYLD ,
584+ name = "Code Signature " ,
585+ size = cs . size ,
586+ type = TreemapType .CODE_SIGNATURE ,
530587 path = None ,
531588 is_dir = False ,
532589 children = [],
533590 )
534591 )
535592
536- return dyld_children
593+ return linkedit_children
537594
538595 def _add_unmapped_region (self , binary_analysis : MachOBinaryAnalysis , binary_children : List [TreemapElement ]) -> None :
539596 total_accounted = sum (c .size for c in binary_children )
0 commit comments