macho

About

Mach-O file parser.

Installation

brew install --HEAD macmade/tap/macho

Usage

Usage: macho [OPTIONS] [PATH] ...

Supports regular and Fat Mach-O files as well as dyld cache files.
Multiple files can be passed at once.

Options:
    
    -h / --help         Shows this help dialog.
    -i / --info         Prints the detailed Mach-O structure.
    -l / --libs         Prints the list of linked libraries.
    -f / --symbols      Prints the list of symbols.
    -s / --str          Prints the list of strings from __cstring,
                        __oslogstring and __ustring.
    -c / --objc-class   Prints the list of Objective-C classes from
                        __objc_classname.
    -m / --objc-method  Prints the list of Objective-C methods
                        from __objc_methname.
    -d / --data         Prints the file data.

Example output

$ macho --info /System/Library/Frameworks/Foundation.framework/Foundation

Mach-O file: Foundation
{
    CPU:      x86-64 - Generic
    Type:     MH_DYLIB - Dynamically bound shared library
    Flags:    0x02000085
    {
        MH_NOUNDEFS:           No undefined references
        MH_DYLDLINK:           Input for the dynamic linker
        MH_TWOLEVEL:           Using two-level name space bindings
        MH_APP_EXTENSION_SAFE: Can be used in application extensions
    }
    Commands: 33
    {
        LC_SEGMENT_64:
        {
            Name:        __TEXT
            VM address:  0x0000000000000000
            VM size:     3.96 MB
            File offset: 0x0000000000000000
            File size:   3.96 MB
            Max prot:    0x00000005
            Init prot:   0x00000005
            Flags:       0x00000000
            Sections:    20
            {
                Section64:
                {
                    Section:           __text
                    Segment:           __TEXT
                    Address:           0x0000000000001E70
                    Size:              0x0000000000305038
                    Offset:            0x00001E70
                    Alignment:         0x00000004
                    Relocation offset: 0x00000000
                    Relocation count:  0x00000000
                    Flags:             S_REGULAR
                    {
                        S_ATTR_PURE_INSTRUCTIONS
                        S_ATTR_SOME_INSTRUCTIONS
                    }
                }
                Section64:
                {
                    Section:           __stubs
                    Segment:           __TEXT
                    Address:           0x0000000000306EA8
                    Size:              0x00000000000025EC
                    Offset:            0x00306EA8
                    Alignment:         0x00000001
                    Relocation offset: 0x00000000
                    Relocation count:  0x00000000
                    Flags:             S_SYMBOL_STUBS
                    {
                        S_ATTR_PURE_INSTRUCTIONS
                        S_ATTR_SOME_INSTRUCTIONS
                    }
                }
                Section64:
                {
                    Section:           __stub_helper
                    Segment:           __TEXT
                    Address:           0x0000000000309494
                    Size:              0x0000000000003F44
                    Offset:            0x00309494
                    Alignment:         0x00000002
                    Relocation offset: 0x00000000
                    Relocation count:  0x00000000
                    Flags:             S_REGULAR
                    {
                        S_ATTR_PURE_INSTRUCTIONS
                        S_ATTR_SOME_INSTRUCTIONS
                    }
                }
                Section64:
                {
                    Section:           __const
                    Segment:           __TEXT
                    Address:           0x000000000030D3E0
                    Size:              0x000000000000B0D0
                    Offset:            0x0030D3E0
                    Alignment:         0x00000004
                    Relocation offset: 0x00000000
                    Relocation count:  0x00000000
                    Flags:             S_REGULAR
                }
                Section64:
                {
                    Section:           __cstring
                    Segment:           __TEXT
                    Address:           0x00000000003184B0
                    Size:              0x00000000000402FA
                    Offset:            0x003184B0
                    Alignment:         0x00000004
                    Relocation offset: 0x00000000
                    Relocation count:  0x00000000
                    Flags:             S_CSTRING_LITERALS
                }
                Section64:
                {
                    Section:           __gcc_except_tab
                    Segment:           __TEXT
                    Address:           0x00000000003587AC
                    Size:              0x000000000000587C
                    Offset:            0x003587AC
                    Alignment:         0x00000002
                    Relocation offset: 0x00000000
                    Relocation count:  0x00000000
                    Flags:             S_REGULAR
                }
                Section64:
                {
                    Section:           __oslogstring
                    Segment:           __TEXT
                    Address:           0x000000000035E030
                    Size:              0x0000000000006AF9
                    Offset:            0x0035E030
                    Alignment:         0x00000004
                    Relocation offset: 0x00000000
                    Relocation count:  0x00000000
                    Flags:             S_CSTRING_LITERALS
                }
                Section64:
                {
                    Section:           __ustring
                    Segment:           __TEXT
                    Address:           0x0000000000364B2A
                    Size:              0x0000000000000404
                    Offset:            0x00364B2A
                    Alignment:         0x00000001
                    Relocation offset: 0x00000000
                    Relocation count:  0x00000000
                    Flags:             S_REGULAR
                }
                Section64:
                {
                    Section:           __dof_NSXPCList
                    Segment:           __TEXT
                    Address:           0x0000000000364F2E
                    Size:              0x00000000000002E9
                    Offset:            0x00364F2E
                    Alignment:         0x00000000
                    Relocation offset: 0x00000000
                    Relocation count:  0x00000000
                    Flags:             S_DTRACE_DOF
                }
                Section64:
                {
                    Section:           __dof_NSXPCList0
                    Segment:           __TEXT
                    Address:           0x0000000000365217
                    Size:              0x000000000000060B
                    Offset:            0x00365217
                    Alignment:         0x00000000
                    Relocation offset: 0x00000000
                    Relocation count:  0x00000000
                    Flags:             S_DTRACE_DOF
                }
                Section64:
                {
                    Section:           __dof_NSProgres
                    Segment:           __TEXT
                    Address:           0x0000000000365822
                    Size:              0x000000000000115B
                    Offset:            0x00365822
                    Alignment:         0x00000000
                    Relocation offset: 0x00000000
                    Relocation count:  0x00000000
                    Flags:             S_DTRACE_DOF
                }
                Section64:
                {
                    Section:           __dof_NSXPCConn
                    Segment:           __TEXT
                    Address:           0x000000000036697D
                    Size:              0x00000000000021AA
                    Offset:            0x0036697D
                    Alignment:         0x00000000
                    Relocation offset: 0x00000000
                    Relocation