#------------------------------------------------------------ # $File: mach,v 1.29 2021/04/26 15:56:00 christos Exp $ # Mach has two magic numbers, 0xcafebabe and 0xfeedface. # Unfortunately the first, cafebabe, is shared with # Java ByteCode, so they are both handled in the file "cafebabe". # The "feedface" ones are handled herein. #------------------------------------------------------------ # if set, it's for the 64-bit version of the architecture # yes, this is separate from the low-order magic number bit # it's also separate from the "64-bit libraries" bit in the # upper 8 bits of the CPU subtype # Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/ # include/mach-o/loader.h # display CPU type as string like: i386 x86_64 ... armv7 armv7k ... 0 name mach-o-cpu >0 belong&0xff000000 0 # # 32-bit ABIs. # # 1 vax >>0 belong&0x00ffffff 1 >>>4 belong&0x00ffffff 0 vax >>>4 belong&0x00ffffff 1 vax11/780 >>>4 belong&0x00ffffff 2 vax11/785 >>>4 belong&0x00ffffff 3 vax11/750 >>>4 belong&0x00ffffff 4 vax11/730 >>>4 belong&0x00ffffff 5 uvaxI >>>4 belong&0x00ffffff 6 uvaxII >>>4 belong&0x00ffffff 7 vax8200 >>>4 belong&0x00ffffff 8 vax8500 >>>4 belong&0x00ffffff 9 vax8600 >>>4 belong&0x00ffffff 10 vax8650 >>>4 belong&0x00ffffff 11 vax8800 >>>4 belong&0x00ffffff 12 uvaxIII >>>4 belong&0x00ffffff >12 vax subarchitecture=%d >>0 belong&0x00ffffff 2 romp >>0 belong&0x00ffffff 3 architecture=3 >>0 belong&0x00ffffff 4 ns32032 >>0 belong&0x00ffffff 5 ns32332 >>0 belong&0x00ffffff 6 m68k # 7 x86 >>0 belong&0x00ffffff 7 >>>4 belong&0x0000000f 3 i386 >>>4 belong&0x0000000f 4 i486 >>>>4 belong&0x00fffff0 0 >>>>4 belong&0x00fffff0 0x80 \bsx >>>4 belong&0x0000000f 5 i586 >>>4 belong&0x0000000f 6 >>>>4 belong&0x00fffff0 0 p6 >>>>4 belong&0x00fffff0 0x10 pentium_pro >>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 >>>>4 belong&0x00fffff0 0x30 pentium_2_m3 >>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 >>>>4 belong&0x00fffff0 0x50 pentium_2_m5 >>>>4 belong&0x00fffff0 >0x50 pentium_2_m%#x >>>4 belong&0x0000000f 7 celeron >>>>4 belong&0x00fffff0 0x00 \b_m%#x >>>>4 belong&0x00fffff0 0x10 \b_m%#x >>>>4 belong&0x00fffff0 0x20 \b_m%#x >>>>4 belong&0x00fffff0 0x30 \b_m%#x >>>>4 belong&0x00fffff0 0x40 \b_m%#x >>>>4 belong&0x00fffff0 0x50 \b_m%#x >>>>4 belong&0x00fffff0 0x60 >>>>4 belong&0x00fffff0 0x70 \b_mobile >>>>4 belong&0x00fffff0 >0x70 \b_m%#x >>>4 belong&0x0000000f 8 pentium_3 >>>>4 belong&0x00fffff0 0x00 >>>>4 belong&0x00fffff0 0x10 \b_m >>>>4 belong&0x00fffff0 0x20 \b_xeon >>>>4 belong&0x00fffff0 >0x20 \b_m%#x >>>4 belong&0x0000000f 9 pentiumM >>>>4 belong&0x00fffff0 0x00 >>>>4 belong&0x00fffff0 >0x00 \b_m%#x >>>4 belong&0x0000000f 10 pentium_4 >>>>4 belong&0x00fffff0 0x00 >>>>4 belong&0x00fffff0 0x10 \b_m >>>>4 belong&0x00fffff0 >0x10 \b_m%#x >>>4 belong&0x0000000f 11 itanium >>>>4 belong&0x00fffff0 0x00 >>>>4 belong&0x00fffff0 0x10 \b_2 >>>>4 belong&0x00fffff0 >0x10 \b_m%#x >>>4 belong&0x0000000f 12 xeon >>>>4 belong&0x00fffff0 0x00 >>>>4 belong&0x00fffff0 0x10 \b_mp >>>>4 belong&0x00fffff0 >0x10 \b_m%#x >>>4 belong&0x0000000f >12 ia32 family=%d >>>>4 belong&0x00fffff0 0x00 >>>>4 belong&0x00fffff0 >0x00 model=%x >>0 belong&0x00ffffff 8 mips >>>4 belong&0x00ffffff 1 R2300 >>>4 belong&0x00ffffff 2 R2600 >>>4 belong&0x00ffffff 3 R2800 >>>4 belong&0x00ffffff 4 R2000a >>>4 belong&0x00ffffff 5 R2000 >>>4 belong&0x00ffffff 6 R3000a >>>4 belong&0x00ffffff 7 R3000 >>>4 belong&0x00ffffff >7 subarchitecture=%d >>0 belong&0x00ffffff 9 ns32532 >>0 belong&0x00ffffff 10 mc98000 >>0 belong&0x00ffffff 11 hppa >>>4 belong&0x00ffffff 0 7100 >>>4 belong&0x00ffffff 1 7100LC >>>4 belong&0x00ffffff >1 subarchitecture=%d >>0 belong&0x00ffffff 12 arm >>>4 belong&0x00ffffff 0 >>>4 belong&0x00ffffff 1 subarchitecture=%d >>>4 belong&0x00ffffff 2 subarchitecture=%d >>>4 belong&0x00ffffff 3 subarchitecture=%d >>>4 belong&0x00ffffff 4 subarchitecture=%d >>>4 belong&0x00ffffff 5 \bv4t >>>4 belong&0x00ffffff 6 \bv6 >>>4 belong&0x00ffffff 7 \bv5tej >>>4 belong&0x00ffffff 8 \bxscale >>>4 belong&0x00ffffff 9 \bv7 >>>4 belong&0x00ffffff 10 \bv7f >>>4 belong&0x00ffffff 11 \bv7s >>>4 belong&0x00ffffff 12 \bv7k >>>4 belong&0x00ffffff 13 \bv8 >>>4 belong&0x00ffffff 14 \bv6m >>>4 belong&0x00ffffff 15 \bv7m >>>4 belong&0x00ffffff 16 \bv7em >>>4 belong&0x00ffffff >16 subarchitecture=%d # 13 m88k >>0 belong&0x00ffffff 13 >>>4 belong&0x00ffffff 0 mc88000 >>>4 belong&0x00ffffff 1 mc88100 >>>4 belong&0x00ffffff 2 mc88110 >>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d >>0 belong&0x00ffffff 14 SPARC >>0 belong&0x00ffffff 15 i860g >>0 belong&0x00ffffff 16 alpha >>0 belong&0x00ffffff 17 rs6000 >>0 belong&0x00ffffff 18 ppc >>>4 belong&0x00ffffff 0 >>>4 belong&0x00ffffff 1 \b_601 >>>4 belong&0x00ffffff 2 \b_602 >>>4 belong&0x00ffffff 3 \b_603 >>>4 belong&0x00ffffff 4 \b_603e >>>4 belong&0x00ffffff 5 \b_603ev >>>4 belong&0x00ffffff 6 \b_604 >>>4 belong&0x00ffffff 7 \b_604e >>>4 belong&0x00ffffff 8 \b_620 >>>4 belong&0x00ffffff 9 \b_750 >>>4 belong&0x00ffffff 10 \b_7400 >>>4 belong&0x00ffffff 11 \b_7450 >>>4 belong&0x00ffffff 100 \b_970 >>>4 belong&0x00ffffff >100 subarchitecture=%d >>0 belong&0x00ffffff >18 architecture=%d >0 belong&0xff000000 0x01000000 # # 64-bit ABIs. # >>0 belong&0x00ffffff 0 64-bit architecture=%d >>0 belong&0x00ffffff 1 64-bit architecture=%d >>0 belong&0x00ffffff 2 64-bit architecture=%d >>0 belong&0x00ffffff 3 64-bit architecture=%d >>0 belong&0x00ffffff 4 64-bit architecture=%d >>0 belong&0x00ffffff 5 64-bit architecture=%d >>0 belong&0x00ffffff 6 64-bit architecture=%d >>0 belong&0x00ffffff 7 x86_64 >>>4 belong&0x00ffffff 0 subarchitecture=%d >>>4 belong&0x00ffffff 1 subarchitecture=%d >>>4 belong&0x00ffffff 2 subarchitecture=%d >>>4 belong&0x00ffffff 3 >>>4 belong&0x00ffffff 4 \b_arch1 >>>4 belong&0x00ffffff 8 \b_haswell >>>4 belong&0x00ffffff >4 subarchitecture=%d >>0 belong&0x00ffffff 8 64-bit architecture=%d >>0 belong&0x00ffffff 9 64-bit architecture=%d >>0 belong&0x00ffffff 10 64-bit architecture=%d >>0 belong&0x00ffffff 11 64-bit architecture=%d >>0 belong&0x00ffffff 12 arm64 >>>4 belong&0x00ffffff 0 >>>4 belong&0x00ffffff 1 \bv8 >>>4 belong&0x00ffffff 2 \be >>>>7 ubyte&0xff >0 (caps: >>>>7 ubyte&0xff <0x80 %#02x >>>>7 ubyte&0xc0 0x80 PAC >>>>>7 ubyte&0x3f x \b%02d >>>>7 ubyte&0xc0 0xc0 PAK >>>>>7 ubyte&0x3f x \b%02d >>>>7 ubyte&0xff x \b) >>>4 belong&0x00ffffff >2 subarchitecture=%d >>0 belong&0x00ffffff 13 64-bit architecture=%d >>0 belong&0x00ffffff 14 64-bit architecture=%d >>0 belong&0x00ffffff 15 64-bit architecture=%d >>0 belong&0x00ffffff 16 64-bit architecture=%d >>0 belong&0x00ffffff 17 64-bit architecture=%d >>0 belong&0x00ffffff 18 ppc64 >>>4 belong&0x00ffffff 0 >>>4 belong&0x00ffffff 1 \b_601 >>>4 belong&0x00ffffff 2 \b_602 >>>4 belong&0x00ffffff 3 \b_603 >>>4 belong&0x00ffffff 4 \b_603e >>>4 belong&0x00ffffff 5 \b_603ev >>>4 belong&0x00ffffff 6 \b_604 >>>4 belong&0x00ffffff 7 \b_604e >>>4 belong&0x00ffffff 8 \b_620 >>>4 belong&0x00ffffff 9 \b_650 >>>4 belong&0x00ffffff 10 \b_7400 >>>4 belong&0x00ffffff 11 \b_7450 >>>4 belong&0x00ffffff 100 \b_970 >>>4 belong&0x00ffffff >100 subarchitecture=%d >>0 belong&0x00ffffff >18 64-bit architecture=%d >0 belong&0xff000000 0x02000000 # # 64_32-bit ABIs. # >>0 belong&0x00ffffff 0 64_32-bit architecture=%d >>0 belong&0x00ffffff 1 64_32-bit architecture=%d >>0 belong&0x00ffffff 2 64_32-bit architecture=%d >>0 belong&0x00ffffff 3 64_32-bit architecture=%d >>0 belong&0x00ffffff 4 64_32-bit architecture=%d >>0 belong&0x00ffffff 5 64_32-bit architecture=%d >>0 belong&0x00ffffff 6 64_32-bit architecture=%d >>0 belong&0x00ffffff 7 64_32-bit architecture=%d >>0 belong&0x00ffffff 8 64_32-bit architecture=%d >>0 belong&0x00ffffff 9 64_32-bit architecture=%d >>0 belong&0x00ffffff 10 64_32-bit architecture=%d >>0 belong&0x00ffffff 11 64_32-bit architecture=%d >>0 belong&0x00ffffff 12 64_32-bit arm >>>4 belong&0x00ffffff 0 >>>4 belong&0x00ffffff 1 \bv8 >>>4 belong&0x00ffffff >1 subarchitecture=%d >>0 belong&0x00ffffff 13 64_32-bit architecture=%d >>0 belong&0x00ffffff 14 64_32-bit architecture=%d >>0 belong&0x00ffffff 15 64_32-bit architecture=%d >>0 belong&0x00ffffff 16 64_32-bit architecture=%d >>0 belong&0x00ffffff 17 64_32-bit architecture=%d >>0 belong&0x00ffffff 18 64_32-bit architecture=%d >>0 belong&0x00ffffff >18 64_32-bit architecture=%d 0 name mach-o-be >0 byte 0xcf 64-bit >4 use mach-o-cpu >12 belong 1 object # GRR: Does not work for Mach-O with 2 architectures; instead display oo #!:ext o !:ext o/ >12 belong 2 executable # the executables normally have no file extension like perl, # but exceptions like perl5.18 perl5.16 !:ext 16/18/ >12 belong 3 fixed virtual memory shared library >12 belong 4 core >12 belong 5 preload executable >12 belong 6 dynamically linked shared library # GRR: Does not work for Mach-O with 2 architectures; instead display dylibdylib #!:ext dylib !:ext dylib/ >12 belong 7 dynamic linker >12 belong 8 bundle # normally name extension bundle; but exceptions like: AMDil_r700.dylib !:ext bundle/dylib/ >12 belong 9 dynamically linked shared library stub >12 belong 10 dSYM companion file >12 belong 11 kext bundle >12 belong >11 >>12 belong x filetype=%d >24 belong >0 \b, flags:< >>24 belong &0x00000001 \bNOUNDEFS >>24 belong &0x00000002 \b|INCRLINK >>24 belong &0x00000004 \b|DYLDLINK >>24 belong &0x00000008 \b|BINDATLOAD >>24 belong &0x00000010 \b|PREBOUND >>24 belong &0x00000020 \b|SPLIT_SEGS >>24 belong &0x00000040 \b|LAZY_INIT >>24 belong &0x00000080 \b|TWOLEVEL >>24 belong &0x00000100 \b|FORCE_FLAT >>24 belong &0x00000200 \b|NOMULTIDEFS >>24 belong &0x00000400 \b|NOFIXPREBINDING >>24 belong &0x00000800 \b|PREBINDABLE >>24 belong &0x00001000 \b|ALLMODSBOUND >>24 belong &0x00002000 \b|SUBSECTIONS_VIA_SYMBOLS >>24 belong &0x00004000 \b|CANONICAL >>24 belong &0x00008000 \b|WEAK_DEFINES >>24 belong &0x00010000 \b|BINDS_TO_WEAK >>24 belong &0x00020000 \b|ALLOW_STACK_EXECUTION >>24 belong &0x00040000 \b|ROOT_SAFE >>24 belong &0x00080000 \b|SETUID_SAFE >>24 belong &0x00100000 \b|NO_REEXPORTED_DYLIBS >>24 belong &0x00200000 \b|PIE >>24 belong &0x00400000 \b|DEAD_STRIPPABLE_DYLIB >>24 belong &0x00800000 \b|HAS_TLV_DESCRIPTORS >>24 belong &0x01000000 \b|NO_HEAP_EXECUTION >>24 belong &0x02000000 \b|APP_EXTENSION_SAFE >>24 belong &0x04000000 \b|NLIST_OUTOFSYNC_WITH_DYLDINFO >>24 belong &0x08000000 \b|SIM_SUPPORT >>24 belong &0x80000000 \b|DYLIB_IN_CACHE >>24 belong x \b> # 0 lelong&0xfffffffe 0xfeedface Mach-O !:strength +1 !:mime application/x-mach-binary >0 use \^mach-o-be 0 belong&0xfffffffe 0xfeedface Mach-O !:strength +1 !:mime application/x-mach-binary >0 use mach-o-be