Macho

from Wikipedia, the free encyclopedia

Mach-O , for Mach Object , describes the standard binary executable programs , libraries and dumps among many MACH-based UNIX - operating systems such as OPEN STEP (originally Next Step), FreeBSD or macOS (originally under the name of Mac OS X).

It was developed from 1985 at Carnegie Mellon University , CMU for short, for the MACH operating system. It is particularly widespread among NeXTStep and its further development macOS and Apple systems based on it, such as iOS and iPadOS . With Universal Binaries , under NeXTStep Multi-Architecture Binaries , the format was also expanded to include multi-processor architecture capability.

construction

A Mach-O file essentially consists of three parts:

  • Header information, English header
    • Magic
    • various flags
    • Number and size of the load commands
  • Load commands
    • Metadata
    • Offset addresses of the segments
  • Segments, segments
    • up to 255 sections, sections

Header

The Mach header is a 32- bit area at the beginning of a Mach-O binary file. The following code is from osfmk/mach-o/loader.hof XNU , the kernel of macOS. 

struct mach_header {
       unsigned long   magic;          /* mach magic number identifier */
       cpu_type_t      cputype;        /* cpu specifier */
       cpu_subtype_t   cpusubtype;     /* machine specifier */
       unsigned long   filetype;       /* type of file */
       unsigned long   ncmds;          /* number of load commands */
       unsigned long   sizeofcmds;     /* the size of all the load commands */
       unsigned long   flags;          /* flags */
};

An example of a Mach header from any program file:

Offset
(hex) 		Length
(dec) 		content example
00 4th make magic number identifier 0xCFFAEDFE → MH_CIGAM_64
04 4th CPU type 0x01000007 → CPU_TYPE_X86_64 = CPU_TYPE_I386 | CPU_ARCH_ABI64
08 4th CPU subtype, machine specifier 0x80000003 → CPU_SUBTYPE_X86_ALL | CPU_SUBTYPE_LIB64
12 4th File type 0x00000002 → MH_EXECUTE
16 4th Number of load commands 0x00000010
20th 4th Size of all load commands 0x00000510 bytes
24 4th Flags 0x00200085→ u. a.MH_DYLDLINK | MH_NOUNDEFS

See also

Individual evidence

  1. ^ William Woodruff: Mach-O Internals. (PDF; 307 KB) February 10, 2016, p. 10 (English).;
  2. ↑ https://stackoverflow.com/questions/27669766/how-to-read-mach-o-header-from-object-file