1 2#------------------------------------------------------------ 3# $File: mach,v 1.28 2020/12/12 20:01:47 christos Exp $ 4# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 5# Unfortunately the first, cafebabe, is shared with 6# Java ByteCode, so they are both handled in the file "cafebabe". 7# The "feedface" ones are handled herein. 8#------------------------------------------------------------ 9# if set, it's for the 64-bit version of the architecture 10# yes, this is separate from the low-order magic number bit 11# it's also separate from the "64-bit libraries" bit in the 12# upper 8 bits of the CPU subtype 13 14# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/ 15# include/mach-o/loader.h 16# display CPU type as string like: i386 x86_64 ... armv7 armv7k ... 170 name mach-o-cpu 18>0 belong&0xff000000 0 19# 20# 32-bit ABIs. 21# 22# 1 vax 23>>0 belong&0x00ffffff 1 24>>>4 belong&0x00ffffff 0 vax 25>>>4 belong&0x00ffffff 1 vax11/780 26>>>4 belong&0x00ffffff 2 vax11/785 27>>>4 belong&0x00ffffff 3 vax11/750 28>>>4 belong&0x00ffffff 4 vax11/730 29>>>4 belong&0x00ffffff 5 uvaxI 30>>>4 belong&0x00ffffff 6 uvaxII 31>>>4 belong&0x00ffffff 7 vax8200 32>>>4 belong&0x00ffffff 8 vax8500 33>>>4 belong&0x00ffffff 9 vax8600 34>>>4 belong&0x00ffffff 10 vax8650 35>>>4 belong&0x00ffffff 11 vax8800 36>>>4 belong&0x00ffffff 12 uvaxIII 37>>>4 belong&0x00ffffff >12 vax subarchitecture=%d 38>>0 belong&0x00ffffff 2 romp 39>>0 belong&0x00ffffff 3 architecture=3 40>>0 belong&0x00ffffff 4 ns32032 41>>0 belong&0x00ffffff 5 ns32332 42>>0 belong&0x00ffffff 6 m68k 43# 7 x86 44>>0 belong&0x00ffffff 7 45>>>4 belong&0x0000000f 3 i386 46>>>4 belong&0x0000000f 4 i486 47>>>>4 belong&0x00fffff0 0 48>>>>4 belong&0x00fffff0 0x80 \bsx 49>>>4 belong&0x0000000f 5 i586 50>>>4 belong&0x0000000f 6 51>>>>4 belong&0x00fffff0 0 p6 52>>>>4 belong&0x00fffff0 0x10 pentium_pro 53>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 54>>>>4 belong&0x00fffff0 0x30 pentium_2_m3 55>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 56>>>>4 belong&0x00fffff0 0x50 pentium_2_m5 57>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%x 58>>>4 belong&0x0000000f 7 celeron 59>>>>4 belong&0x00fffff0 0x00 \b_m0x%x 60>>>>4 belong&0x00fffff0 0x10 \b_m0x%x 61>>>>4 belong&0x00fffff0 0x20 \b_m0x%x 62>>>>4 belong&0x00fffff0 0x30 \b_m0x%x 63>>>>4 belong&0x00fffff0 0x40 \b_m0x%x 64>>>>4 belong&0x00fffff0 0x50 \b_m0x%x 65>>>>4 belong&0x00fffff0 0x60 66>>>>4 belong&0x00fffff0 0x70 \b_mobile 67>>>>4 belong&0x00fffff0 >0x70 \b_m0x%x 68>>>4 belong&0x0000000f 8 pentium_3 69>>>>4 belong&0x00fffff0 0x00 70>>>>4 belong&0x00fffff0 0x10 \b_m 71>>>>4 belong&0x00fffff0 0x20 \b_xeon 72>>>>4 belong&0x00fffff0 >0x20 \b_m0x%x 73>>>4 belong&0x0000000f 9 pentiumM 74>>>>4 belong&0x00fffff0 0x00 75>>>>4 belong&0x00fffff0 >0x00 \b_m0x%x 76>>>4 belong&0x0000000f 10 pentium_4 77>>>>4 belong&0x00fffff0 0x00 78>>>>4 belong&0x00fffff0 0x10 \b_m 79>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 80>>>4 belong&0x0000000f 11 itanium 81>>>>4 belong&0x00fffff0 0x00 82>>>>4 belong&0x00fffff0 0x10 \b_2 83>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 84>>>4 belong&0x0000000f 12 xeon 85>>>>4 belong&0x00fffff0 0x00 86>>>>4 belong&0x00fffff0 0x10 \b_mp 87>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 88>>>4 belong&0x0000000f >12 ia32 family=%d 89>>>>4 belong&0x00fffff0 0x00 90>>>>4 belong&0x00fffff0 >0x00 model=%x 91>>0 belong&0x00ffffff 8 mips 92>>>4 belong&0x00ffffff 1 R2300 93>>>4 belong&0x00ffffff 2 R2600 94>>>4 belong&0x00ffffff 3 R2800 95>>>4 belong&0x00ffffff 4 R2000a 96>>>4 belong&0x00ffffff 5 R2000 97>>>4 belong&0x00ffffff 6 R3000a 98>>>4 belong&0x00ffffff 7 R3000 99>>>4 belong&0x00ffffff >7 subarchitecture=%d 100>>0 belong&0x00ffffff 9 ns32532 101>>0 belong&0x00ffffff 10 mc98000 102>>0 belong&0x00ffffff 11 hppa 103>>>4 belong&0x00ffffff 0 7100 104>>>4 belong&0x00ffffff 1 7100LC 105>>>4 belong&0x00ffffff >1 subarchitecture=%d 106>>0 belong&0x00ffffff 12 arm 107>>>4 belong&0x00ffffff 0 108>>>4 belong&0x00ffffff 1 subarchitecture=%d 109>>>4 belong&0x00ffffff 2 subarchitecture=%d 110>>>4 belong&0x00ffffff 3 subarchitecture=%d 111>>>4 belong&0x00ffffff 4 subarchitecture=%d 112>>>4 belong&0x00ffffff 5 \bv4t 113>>>4 belong&0x00ffffff 6 \bv6 114>>>4 belong&0x00ffffff 7 \bv5tej 115>>>4 belong&0x00ffffff 8 \bxscale 116>>>4 belong&0x00ffffff 9 \bv7 117>>>4 belong&0x00ffffff 10 \bv7f 118>>>4 belong&0x00ffffff 11 \bv7s 119>>>4 belong&0x00ffffff 12 \bv7k 120>>>4 belong&0x00ffffff 13 \bv8 121>>>4 belong&0x00ffffff 14 \bv6m 122>>>4 belong&0x00ffffff 15 \bv7m 123>>>4 belong&0x00ffffff 16 \bv7em 124>>>4 belong&0x00ffffff >16 subarchitecture=%d 125# 13 m88k 126>>0 belong&0x00ffffff 13 127>>>4 belong&0x00ffffff 0 mc88000 128>>>4 belong&0x00ffffff 1 mc88100 129>>>4 belong&0x00ffffff 2 mc88110 130>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d 131>>0 belong&0x00ffffff 14 SPARC 132>>0 belong&0x00ffffff 15 i860g 133>>0 belong&0x00ffffff 16 alpha 134>>0 belong&0x00ffffff 17 rs6000 135>>0 belong&0x00ffffff 18 ppc 136>>>4 belong&0x00ffffff 0 137>>>4 belong&0x00ffffff 1 \b_601 138>>>4 belong&0x00ffffff 2 \b_602 139>>>4 belong&0x00ffffff 3 \b_603 140>>>4 belong&0x00ffffff 4 \b_603e 141>>>4 belong&0x00ffffff 5 \b_603ev 142>>>4 belong&0x00ffffff 6 \b_604 143>>>4 belong&0x00ffffff 7 \b_604e 144>>>4 belong&0x00ffffff 8 \b_620 145>>>4 belong&0x00ffffff 9 \b_750 146>>>4 belong&0x00ffffff 10 \b_7400 147>>>4 belong&0x00ffffff 11 \b_7450 148>>>4 belong&0x00ffffff 100 \b_970 149>>>4 belong&0x00ffffff >100 subarchitecture=%d 150>>0 belong&0x00ffffff >18 architecture=%d 151>0 belong&0xff000000 0x01000000 152# 153# 64-bit ABIs. 154# 155>>0 belong&0x00ffffff 0 64-bit architecture=%d 156>>0 belong&0x00ffffff 1 64-bit architecture=%d 157>>0 belong&0x00ffffff 2 64-bit architecture=%d 158>>0 belong&0x00ffffff 3 64-bit architecture=%d 159>>0 belong&0x00ffffff 4 64-bit architecture=%d 160>>0 belong&0x00ffffff 5 64-bit architecture=%d 161>>0 belong&0x00ffffff 6 64-bit architecture=%d 162>>0 belong&0x00ffffff 7 x86_64 163>>>4 belong&0x00ffffff 0 subarchitecture=%d 164>>>4 belong&0x00ffffff 1 subarchitecture=%d 165>>>4 belong&0x00ffffff 2 subarchitecture=%d 166>>>4 belong&0x00ffffff 3 167>>>4 belong&0x00ffffff 4 \b_arch1 168>>>4 belong&0x00ffffff 8 \b_haswell 169>>>4 belong&0x00ffffff >4 subarchitecture=%d 170>>0 belong&0x00ffffff 8 64-bit architecture=%d 171>>0 belong&0x00ffffff 9 64-bit architecture=%d 172>>0 belong&0x00ffffff 10 64-bit architecture=%d 173>>0 belong&0x00ffffff 11 64-bit architecture=%d 174>>0 belong&0x00ffffff 12 arm64 175>>>4 belong&0x00ffffff 0 176>>>4 belong&0x00ffffff 1 \bv8 177>>>4 belong&0x00ffffff 2 \be 178>>>>7 ubyte&0xff >0 (caps: 179>>>>7 ubyte&0xff <0x80 0x%02x 180>>>>7 ubyte&0xc0 0x80 PAC 181>>>>>7 ubyte&0x3f x \b%02d 182>>>>7 ubyte&0xc0 0xc0 PAK 183>>>>>7 ubyte&0x3f x \b%02d 184>>>>7 ubyte&0xff x \b) 185>>>4 belong&0x00ffffff >2 subarchitecture=%d 186>>0 belong&0x00ffffff 13 64-bit architecture=%d 187>>0 belong&0x00ffffff 14 64-bit architecture=%d 188>>0 belong&0x00ffffff 15 64-bit architecture=%d 189>>0 belong&0x00ffffff 16 64-bit architecture=%d 190>>0 belong&0x00ffffff 17 64-bit architecture=%d 191>>0 belong&0x00ffffff 18 ppc64 192>>>4 belong&0x00ffffff 0 193>>>4 belong&0x00ffffff 1 \b_601 194>>>4 belong&0x00ffffff 2 \b_602 195>>>4 belong&0x00ffffff 3 \b_603 196>>>4 belong&0x00ffffff 4 \b_603e 197>>>4 belong&0x00ffffff 5 \b_603ev 198>>>4 belong&0x00ffffff 6 \b_604 199>>>4 belong&0x00ffffff 7 \b_604e 200>>>4 belong&0x00ffffff 8 \b_620 201>>>4 belong&0x00ffffff 9 \b_650 202>>>4 belong&0x00ffffff 10 \b_7400 203>>>4 belong&0x00ffffff 11 \b_7450 204>>>4 belong&0x00ffffff 100 \b_970 205>>>4 belong&0x00ffffff >100 subarchitecture=%d 206>>0 belong&0x00ffffff >18 64-bit architecture=%d 207>0 belong&0xff000000 0x02000000 208# 209# 64_32-bit ABIs. 210# 211>>0 belong&0x00ffffff 0 64_32-bit architecture=%d 212>>0 belong&0x00ffffff 1 64_32-bit architecture=%d 213>>0 belong&0x00ffffff 2 64_32-bit architecture=%d 214>>0 belong&0x00ffffff 3 64_32-bit architecture=%d 215>>0 belong&0x00ffffff 4 64_32-bit architecture=%d 216>>0 belong&0x00ffffff 5 64_32-bit architecture=%d 217>>0 belong&0x00ffffff 6 64_32-bit architecture=%d 218>>0 belong&0x00ffffff 7 64_32-bit architecture=%d 219>>0 belong&0x00ffffff 8 64_32-bit architecture=%d 220>>0 belong&0x00ffffff 9 64_32-bit architecture=%d 221>>0 belong&0x00ffffff 10 64_32-bit architecture=%d 222>>0 belong&0x00ffffff 11 64_32-bit architecture=%d 223>>0 belong&0x00ffffff 12 64_32-bit arm 224>>>4 belong&0x00ffffff 0 225>>>4 belong&0x00ffffff 1 \bv8 226>>>4 belong&0x00ffffff >1 subarchitecture=%d 227>>0 belong&0x00ffffff 13 64_32-bit architecture=%d 228>>0 belong&0x00ffffff 14 64_32-bit architecture=%d 229>>0 belong&0x00ffffff 15 64_32-bit architecture=%d 230>>0 belong&0x00ffffff 16 64_32-bit architecture=%d 231>>0 belong&0x00ffffff 17 64_32-bit architecture=%d 232>>0 belong&0x00ffffff 18 64_32-bit architecture=%d 233>>0 belong&0x00ffffff >18 64_32-bit architecture=%d 234 2350 name mach-o-be 236>0 byte 0xcf 64-bit 237>4 use mach-o-cpu 238>12 belong 1 object 239# GRR: Does not work for Mach-O with 2 architectures; instead display oo 240#!:ext o 241!:ext o/ 242>12 belong 2 executable 243# the executables normally have no file extension like perl, 244# but exceptions like perl5.18 perl5.16 245!:ext 16/18/ 246>12 belong 3 fixed virtual memory shared library 247>12 belong 4 core 248>12 belong 5 preload executable 249>12 belong 6 dynamically linked shared library 250# GRR: Does not work for Mach-O with 2 architectures; instead display dylibdylib 251#!:ext dylib 252!:ext dylib/ 253>12 belong 7 dynamic linker 254>12 belong 8 bundle 255# normally name extension bundle; but exceptions like: AMDil_r700.dylib 256!:ext bundle/dylib/ 257>12 belong 9 dynamically linked shared library stub 258>12 belong 10 dSYM companion file 259>12 belong 11 kext bundle 260>12 belong >11 261>>12 belong x filetype=%d 262>24 belong >0 \b, flags:< 263>>24 belong &0x00000001 \bNOUNDEFS 264>>24 belong &0x00000002 \b|INCRLINK 265>>24 belong &0x00000004 \b|DYLDLINK 266>>24 belong &0x00000008 \b|BINDATLOAD 267>>24 belong &0x00000010 \b|PREBOUND 268>>24 belong &0x00000020 \b|SPLIT_SEGS 269>>24 belong &0x00000040 \b|LAZY_INIT 270>>24 belong &0x00000080 \b|TWOLEVEL 271>>24 belong &0x00000100 \b|FORCE_FLAT 272>>24 belong &0x00000200 \b|NOMULTIDEFS 273>>24 belong &0x00000400 \b|NOFIXPREBINDING 274>>24 belong &0x00000800 \b|PREBINDABLE 275>>24 belong &0x00001000 \b|ALLMODSBOUND 276>>24 belong &0x00002000 \b|SUBSECTIONS_VIA_SYMBOLS 277>>24 belong &0x00004000 \b|CANONICAL 278>>24 belong &0x00008000 \b|WEAK_DEFINES 279>>24 belong &0x00010000 \b|BINDS_TO_WEAK 280>>24 belong &0x00020000 \b|ALLOW_STACK_EXECUTION 281>>24 belong &0x00040000 \b|ROOT_SAFE 282>>24 belong &0x00080000 \b|SETUID_SAFE 283>>24 belong &0x00100000 \b|NO_REEXPORTED_DYLIBS 284>>24 belong &0x00200000 \b|PIE 285>>24 belong &0x00400000 \b|DEAD_STRIPPABLE_DYLIB 286>>24 belong &0x00800000 \b|HAS_TLV_DESCRIPTORS 287>>24 belong &0x01000000 \b|NO_HEAP_EXECUTION 288>>24 belong &0x02000000 \b|APP_EXTENSION_SAFE 289>>24 belong &0x04000000 \b|NLIST_OUTOFSYNC_WITH_DYLDINFO 290>>24 belong &0x08000000 \b|SIM_SUPPORT 291>>24 belong &0x80000000 \b|DYLIB_IN_CACHE 292>>24 belong x \b> 293 294# 2950 lelong&0xfffffffe 0xfeedface Mach-O 296!:strength +1 297!:mime application/x-mach-binary 298>0 use \^mach-o-be 299 3000 belong&0xfffffffe 0xfeedface Mach-O 301!:strength +1 302!:mime application/x-mach-binary 303>0 use mach-o-be 304