- Author
- Gregory Anders
- Published
- 16 January 2022
- Kind
- Personal blog post, part 1 of a series, with hands-on shell commands
- Original
- gpanders.com/blog/exploring-mach-o-part-1/
- Subject
- Systems and hardware
- Themes
- Close to the machine, Getting good
What it is
Gregory Anders writes a learning log about the Mach-O file format used by macOS. This is part 1 of 4. The author says they knew almost nothing about the format beforehand.
What it says
- The smallest program only calls the exit syscall, which the author writes in ARM64 assembly.
- The exit syscall number is 1, found by disassembly and confirmed in an SDK header.
- Linking failed until the author added a global symbol, alignment and a libSystem path.
- The finished program exits with code 42, and objdump shows the same three instructions.
- The author says the 64-bit Mach-O header is a simple 32-byte structure.
- The magic number is 0xfeedface for 32-bit files and 0xfeedfacf for 64-bit files.
What evidence it gives
The post shows shell transcripts of assembling, linking, disassembling and running a three-line program. It also quotes an SDK header and an archived Apple reference. All output comes from one machine.
Interests and limits
This is a personal learning post, not a reference. It stops before any parsing, which is left to part 2. Only one tiny ARM64 binary is examined. The post says the Apple reference is old and partly wrong.