Forensics · 36 tools · nothing uploads

Mach-O info

Read a Mach-O (or fat/universal) binary's header, CPU type, load commands and segments. No disassembly.

Input

Mach-O info reads a binary's magic number, bit width, endianness, CPU type, file type and command count, naming each LC_SEGMENT and LC_SEGMENT_64 command's address and offset. A fat or universal binary instead gets each slice listed by CPU type, offset and size, with only the first slice's header expanded. An unrecognised magic number is refused; nothing is disassembled.

Questions

What does it show for a thin binary?

The magic, bit width and endianness, CPU type, file type, load command count, the full load command list, and every LC_SEGMENT or LC_SEGMENT_64's name and addresses.

What about a fat/universal binary?

It lists every architecture slice with its CPU type, offset and size, then describes the first slice's own header in detail.

What if the magic number is not recognised?

The tool refuses it as not a Mach-O file.

Does it disassemble any code?

No, it only reads the header and the load command table; no instructions are decoded.

What CPU types does it recognise?

A fixed table covering x86, x86_64, ARM, ARM64, PowerPC, PowerPC64, SPARC and a handful of older architectures.

Compare

ToolRuns on the CLILive as you type
Mach-O infoYesNo
PE infoYesNo
MBR / GPT partitionsYesNo

Related Forensics tools