Mach-O file parser.
brew install --HEAD macmade/tap/macho
Usage: macho [OPTIONS] [PATH] ...Supports regular and Fat Mach-O files as well as dyld cache files.Multiple files can be passed at once.Options: -h / --help Shows this help dialog. -i / --info Prints the detailed Mach-O structure. -l / --libs Prints the list of linked libraries. -f / --symbols Prints the list of symbols. -s / --str Prints the list of strings from __cstring, __oslogstring and __ustring. -c / --objc-class Prints the list of Objective-C classes from __objc_classname. -m / --objc-method Prints the list of Objective-C methods from __objc_methname. -d / --data Prints the file data.
$ macho --info /System/Library/Frameworks/Foundation.framework/FoundationMach-O file: Foundation{ CPU: x86-64 - Generic Type: MH_DYLIB - Dynamically bound shared library Flags: 0x02000085 { MH_NOUNDEFS: No undefined references MH_DYLDLINK: Input for the dynamic linker MH_TWOLEVEL: Using two-level name space bindings MH_APP_EXTENSION_SAFE: Can be used in application extensions } Commands: 33 { LC_SEGMENT_64: { Name: __TEXT VM address: 0x0000000000000000 VM size: 3.96 MB File offset: 0x0000000000000000 File size: 3.96 MB Max prot: 0x00000005 Init prot: 0x00000005 Flags: 0x00000000 Sections: 20 { Section64: { Section: __text Segment: __TEXT Address: 0x0000000000001E70 Size: 0x0000000000305038 Offset: 0x00001E70 Alignment: 0x00000004 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR { S_ATTR_PURE_INSTRUCTIONS S_ATTR_SOME_INSTRUCTIONS } } Section64: { Section: __stubs Segment: __TEXT Address: 0x0000000000306EA8 Size: 0x00000000000025EC Offset: 0x00306EA8 Alignment: 0x00000001 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_SYMBOL_STUBS { S_ATTR_PURE_INSTRUCTIONS S_ATTR_SOME_INSTRUCTIONS } } Section64: { Section: __stub_helper Segment: __TEXT Address: 0x0000000000309494 Size: 0x0000000000003F44 Offset: 0x00309494 Alignment: 0x00000002 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR { S_ATTR_PURE_INSTRUCTIONS S_ATTR_SOME_INSTRUCTIONS } } Section64: { Section: __const Segment: __TEXT Address: 0x000000000030D3E0 Size: 0x000000000000B0D0 Offset: 0x0030D3E0 Alignment: 0x00000004 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __cstring Segment: __TEXT Address: 0x00000000003184B0 Size: 0x00000000000402FA Offset: 0x003184B0 Alignment: 0x00000004 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_CSTRING_LITERALS } Section64: { Section: __gcc_except_tab Segment: __TEXT Address: 0x00000000003587AC Size: 0x000000000000587C Offset: 0x003587AC Alignment: 0x00000002 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __oslogstring Segment: __TEXT Address: 0x000000000035E030 Size: 0x0000000000006AF9 Offset: 0x0035E030 Alignment: 0x00000004 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_CSTRING_LITERALS } Section64: { Section: __ustring Segment: __TEXT Address: 0x0000000000364B2A Size: 0x0000000000000404 Offset: 0x00364B2A Alignment: 0x00000001 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __dof_NSXPCList Segment: __TEXT Address: 0x0000000000364F2E Size: 0x00000000000002E9 Offset: 0x00364F2E Alignment: 0x00000000 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_DTRACE_DOF } Section64: { Section: __dof_NSXPCList0 Segment: __TEXT Address: 0x0000000000365217 Size: 0x000000000000060B Offset: 0x00365217 Alignment: 0x00000000 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_DTRACE_DOF } Section64: { Section: __dof_NSProgres Segment: __TEXT Address: 0x0000000000365822 Size: 0x000000000000115B Offset: 0x00365822 Alignment: 0x00000000 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_DTRACE_DOF } Section64: { Section: __dof_NSXPCConn Segment: __TEXT Address: 0x000000000036697D Size: 0x00000000000021AA Offset: 0x0036697D Alignment: 0x00000000 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_DTRACE_DOF } Section64: { Section: __dof_Cocoa_Lay Segment: __TEXT Address: 0x0000000000368B27 Size: 0x0000000000000500 Offset: 0x00368B27 Alignment: 0x00000000 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_DTRACE_DOF } Section64: { Section: __dof_NSXPCProx Segment: __TEXT Address: 0x0000000000369027 Size: 0x000000000000075E Offset: 0x00369027 Alignment: 0x00000000 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_DTRACE_DOF } Section64: { Section: __dof_NSProcess Segment: __TEXT Address: 0x0000000000369785 Size: 0x0000000000000343 Offset: 0x00369785 Alignment: 0x00000000 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_DTRACE_DOF } Section64: { Section: __unwind_info Segment: __TEXT Address: 0x0000000000369AC8 Size: 0x000000000000BE7C Offset: 0x00369AC8 Alignment: 0x00000002 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __eh_frame Segment: __TEXT Address: 0x0000000000375948 Size: 0x0000000000003228 Offset: 0x00375948 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __objc_classname Segment: __TEXT Address: 0x0000000000378B70 Size: 0x0000000000006021 Offset: 0x00378B70 Alignment: 0x00000000 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_CSTRING_LITERALS } Section64: { Section: __objc_methname Segment: __TEXT Address: 0x000000000037EB91 Size: 0x000000000003CBE8 Offset: 0x0037EB91 Alignment: 0x00000000 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_CSTRING_LITERALS } Section64: { Section: __objc_methtype Segment: __TEXT Address: 0x00000000003BB779 Size: 0x000000000000A887 Offset: 0x003BB779 Alignment: 0x00000000 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_CSTRING_LITERALS } } } LC_SEGMENT_64: { Name: __DATA VM address: 0x00000000003C6000 VM size: 1.04 MB File offset: 0x00000000003C6000 File size: 1.04 MB Max prot: 0x00000003 Init prot: 0x00000003 Flags: 0x00000000 Sections: 26 { Section64: { Section: __nl_symbol_ptr Segment: __DATA Address: 0x00000000003C6000 Size: 0x0000000000000008 Offset: 0x003C6000 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_NON_LAZY_SYMBOL_POINTERS } Section64: { Section: __got Segment: __DATA Address: 0x00000000003C6008 Size: 0x0000000000000B80 Offset: 0x003C6008 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_NON_LAZY_SYMBOL_POINTERS } Section64: { Section: __la_symbol_ptr Segment: __DATA Address: 0x00000000003C6B88 Size: 0x0000000000003290 Offset: 0x003C6B88 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_LAZY_SYMBOL_POINTERS } Section64: { Section: __const Segment: __DATA Address: 0x00000000003C9E20 Size: 0x000000000000DD78 Offset: 0x003C9E20 Alignment: 0x00000004 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __cfstring Segment: __DATA Address: 0x00000000003D7B98 Size: 0x000000000002DE40 Offset: 0x003D7B98 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __objc_classlist Segment: __DATA Address: 0x00000000004059D8 Size: 0x00000000000019A0 Offset: 0x004059D8 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR { S_ATTR_NO_DEAD_STRIP } } Section64: { Section: __objc_nlclslist Segment: __DATA Address: 0x0000000000407378 Size: 0x0000000000000018 Offset: 0x00407378 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR { S_ATTR_NO_DEAD_STRIP } } Section64: { Section: __objc_catlist Segment: __DATA Address: 0x0000000000407390 Size: 0x00000000000000F0 Offset: 0x00407390 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR { S_ATTR_NO_DEAD_STRIP } } Section64: { Section: __objc_nlcatlist Segment: __DATA Address: 0x0000000000407480 Size: 0x0000000000000008 Offset: 0x00407480 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR { S_ATTR_NO_DEAD_STRIP } } Section64: { Section: __objc_protolist Segment: __DATA Address: 0x0000000000407488 Size: 0x0000000000000190 Offset: 0x00407488 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __objc_imageinfo Segment: __DATA Address: 0x0000000000407618 Size: 0x0000000000000008 Offset: 0x00407618 Alignment: 0x00000002 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __objc_const Segment: __DATA Address: 0x0000000000407620 Size: 0x0000000000096820 Offset: 0x00407620 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __objc_selrefs Segment: __DATA Address: 0x000000000049DE40 Size: 0x000000000000B4F8 Offset: 0x0049DE40 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_LITERAL_POINTERS { S_ATTR_NO_DEAD_STRIP } } Section64: { Section: __objc_protorefs Segment: __DATA Address: 0x00000000004A9338 Size: 0x00000000000000B0 Offset: 0x004A9338 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __objc_classrefs Segment: __DATA Address: 0x00000000004A93E8 Size: 0x0000000000001718 Offset: 0x004A93E8 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR { S_ATTR_NO_DEAD_STRIP } } Section64: { Section: __objc_superrefs Segment: __DATA Address: 0x00000000004AAB00 Size: 0x0000000000001278 Offset: 0x004AAB00 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR { S_ATTR_NO_DEAD_STRIP } } Section64: { Section: __objc_ivar Segment: __DATA Address: 0x00000000004ABD78 Size: 0x0000000000004860 Offset: 0x004ABD78 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __objc_data Segment: __DATA Address: 0x00000000004B05D8 Size: 0x0000000000010040 Offset: 0x004B05D8 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __data Segment: __DATA Address: 0x00000000004C0620 Size: 0x0000000000002968 Offset: 0x004C0620 Alignment: 0x00000004 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __crash_info Segment: __DATA Address: 0x00000000004C2F88 Size: 0x0000000000000040 Offset: 0x004C2F88 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __objc_arraydata Segment: __DATA Address: 0x00000000004C2FC8 Size: 0x00000000000004A0 Offset: 0x004C2FC8 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __objc_arrayobj Segment: __DATA Address: 0x00000000004C3468 Size: 0x00000000000001C8 Offset: 0x004C3468 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __objc_intobj Segment: __DATA Address: 0x00000000004C3630 Size: 0x00000000000008B8 Offset: 0x004C3630 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __objc_dictobj Segment: __DATA Address: 0x00000000004C3EE8 Size: 0x0000000000000028 Offset: 0x004C3EE8 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_REGULAR } Section64: { Section: __common Segment: __DATA Address: 0x00000000004C3F10 Size: 0x0000000000000080 Offset: 0x00000000 Alignment: 0x00000003 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_ZEROFILL } Section64: { Section: __bss Segment: __DATA Address: 0x00000000004C3F90 Size: 0x0000000000000FC0 Offset: 0x00000000 Alignment: 0x00000004 Relocation offset: 0x00000000 Relocation count: 0x00000000 Flags: S_ZEROFILL } } } LC_SEGMENT_64: { Name: __LINKEDIT VM address: 0x00000000004C5000 VM size: 2.41 MB File offset: 0x00000000004C4000 File size: 2.41 MB Max prot: 0x00000001 Init prot: 0x00000001 Flags: 0x00000000 } LC_ID_DYLIB: Foundation LC_DYLD_INFO_ONLY: { Rebase offset: 0x004C4000 Rebase size: 0x000060A0 Binding offset: 0x004CA0A0 Binding size: 0x00003DE0 Weak binding offset: 0x00000000 Weak binding size: 0x00000000 Lazy binding offset: 0x004CDE80 Lazy binding size: 0x0000C4B0 Export offset: 0x004DA330 Export size: 0x000167F0 } LC_SYMTAB: { Symbol offset: 0x00518DB0 Symbol size: 0x00008439 String offset: 0x005A0994 String size: 0x0015D508 } LC_DYSYMTAB: { Symbol offset: 0x00000000 Symbol size: 0x00006FE4 String offset: 0x00006FE4 String size: 0x00000B7F } LC_UUID: 1FA28BAB-7296-3A9-8E1E-E62A7D233DB8 LC_BUILD_VERSION: { Platform: macOS Min OS: 10.15.0 SDK: 10.15.4 Tools: { LD: 556.4.0 } } LC_BUILD_VERSION: { Platform: Mac Catalyst Min OS: 13.4.0 SDK: 13.4.0 Tools: { LD: 556.4.0 } } LC_SOURCE_VERSION: 1676.105.0.0.0 LC_SEGMENT_SPLIT_INFO: { Data offset: 0x004F0B20 Data size: 0x00022108 } LC_REEXPORT_DYLIB: libobjc.A.dylib LC_REEXPORT_DYLIB: CoreFoundation LC_LOAD_DYLIB: libauto.dylib LC_LOAD_DYLIB: libfakelink.dylib LC_LOAD_DYLIB: libcompression.dylib LC_LOAD_DYLIB: DiskArbitration LC_LOAD_DYLIB: libarchive.2.dylib LC_LOAD_DYLIB: libDiagnosticMessagesClient.dylib LC_LOAD_DYLIB: libicucore.A.dylib LC_LOAD_DYLIB: libxml2.2.dylib LC_LOAD_DYLIB: libz.1.dylib LC_LOAD_DYLIB: SystemConfiguration LC_LOAD_DYLIB: CoreServices LC_LOAD_DYLIB: liblangid.dylib LC_LOAD_DYLIB: IOKit LC_LOAD_DYLIB: libCRFSuite.dylib LC_LOAD_DYLIB: libSystem.B.dylib LC_LOAD_DYLIB: CFNetwork LC_FUNCTION_STARTS: { Data offset: 0x00512C28 Data size: 0x00005CC0 } LC_DATA_IN_CODE: { Data offset: 0x005188E8 Data size: 0x000004C8 } LC_CODE_SIGNATURE: { Data offset: 0x006FDEA0 Data size: 0x00012750 } }}
Project is released under the terms of the MIT License.
Owner: Jean-David Gadina - XS-LabsWeb: www.xs-labs.comBlog: www.noxeos.comTwitter: @macmadeGitHub: github.com/macmadeLinkedIn: ch.linkedin.com/in/macmade/StackOverflow: stackoverflow.com/users/182676/macmade
