Editing Mach-O (section)

== Mach-O header ==

{|class="wikitable"
|+ Mach-O File header<ref name="loader.h">{{github|https://github.com/apple/darwin-xnu/blob/main/EXTERNAL_HEADERS/mach-o/loader.h}}</ref>
|-
! Offset !! Bytes !! Description
|-
|  0 || 4 || Magic number
|-
|  4 || 4 || CPU type
|-
|  8 || 4 || CPU subtype
|-
| 12 || 4 || File type
|-
| 16 || 4 || Number of load commands
|-
| 20 || 4 || Size of load commands
|-
| 24 || 4 || Flags
|-
| 28 || 4 || Reserved (64-bit only)
|}

The magic number for 32-bit code is {{code|0xfeedface}} while the magic number for 64-bit architectures is {{code|0xfeedfacf}}.

The reserved value is only present in 64-bit Mach-O files. It is reserved for future use or extension of the 64-bit header.

The CPU type indicates the instruction set architecture for the code. If the file is for the 64-bit version of the instruction set architecture, the CPU type value has the {{code|0x01000000}} bit set.

The CPU type values are as follows:<ref name="machine.h">{{github|https://github.com/opensource-apple/cctools/blob/master/include/mach/machine.h}}</ref>

{|class="wikitable"
|+ CPU type
|-
! Value !! CPU Type
|-
|  0x00000001 || [[VAX]]
|-
|  0x00000002 || [[IBM ROMP|ROMP]]
|-
|  0x00000004 || [[NS32000#32032|NS32032]]
|-
|  0x00000005 || [[NS32000#32332, 32532|NS32332]]
|-
|  0x00000006 || [[Motorola 68000 series|MC680x0]]
|-
|  0x00000007 || [[x86]]
|-
|  0x00000008 || [[MIPS architecture|MIPS]]
|-
|  0x00000009 || [[NS32000#32332, 32532|NS32352]]
|-
|  0x0000000B || [[PA-RISC|HP-PA]]
|-
|  0x0000000C || [[ARM architecture family|ARM]]
|-
|  0x0000000D || [[Motorola 88000|MC88000]]
|-
|  0x0000000E || [[SPARC]]
|-
|  0x0000000F || [[Intel i860|i860]] (big-endian)
|-
|  0x00000010 || [[Intel i860|i860]] (little-endian) or maybe [[DEC Alpha]]<ref>{{Cite web |title=darwin-xnu/osfmk/mach/machine.h at 2ff845c2e033bd0ff64b5b6aa6063a1f8f65aa32 · apple/darwin-xnu |url=https://github.com/apple/darwin-xnu/blob/2ff845c2e033bd0ff64b5b6aa6063a1f8f65aa32/osfmk/mach/machine.h#L160 |access-date=2024-12-24 |website=GitHub |language=en}}</ref>
|-
|  0x00000011 || [[IBM RS/6000|RS/6000]]
|-
|  0x00000012 || [[PowerPC]] / MC98000
|}

Each CPU type has a set of CPU subtype values, indicating a particular model of that CPU type for which the code is intended. Newer models of a CPU type may support instructions, or other features, not supported by older CPU models, so that code compiled or written for a newer model might contain instructions that are [[illegal instruction]]s on an older model, causing that code to [[Interrupt|trap]] or otherwise fail to operate correctly when run on an older model.  Code intended for an older model will run on newer models without problems.

If the CPU type is ARM then the subtypes are as follows:<ref name="machine.h" />

{|class="wikitable"
|+ CPU subtype ARM
|-
! Value !! CPU version
|-
| 0x00000000 || All ARM processors.
|-
| 0x00000001 || Optimized for ARM-A500 ARCH or newer.
|-
| 0x00000002 || Optimized for ARM-A500 or newer.
|-
| 0x00000003 || Optimized for ARM-A440 or newer.
|-
| 0x00000004 || Optimized for ARM-M4 or newer.
|-
| 0x00000005 || Optimized for ARM-V4T or newer.
|-
| 0x00000006 || Optimized for ARM-V6 or newer.
|-
| 0x00000007 || Optimized for ARM-V5TEJ or newer.
|-
| 0x00000008 || Optimized for ARM-XSCALE or newer.
|-
| 0x00000009 || Optimized for ARM-V7 or newer.
|-
| 0x0000000A || Optimized for ARM-V7F (Cortex A9) or newer.
|-
| 0x0000000B || Optimized for ARM-V7S (Swift) or newer.
|-
| 0x0000000C || Optimized for ARM-V7K (Kirkwood40) or newer.
|-
| 0x0000000D || Optimized for ARM-V8 or newer.
|-
| 0x0000000E || Optimized for ARM-V6M or newer.
|-
| 0x0000000F || Optimized for ARM-V7M or newer.
|-
| 0x00000010 || Optimized for ARM-V7EM or newer.
|-
|}

If the CPU type is x86 then the subtypes are as follows:<ref name="machine.h" />

{|class="wikitable"
|+ CPU subtype x86
|-
! Value !! CPU version
|-
| 0x00000003 || All x86 processors.
|-
| 0x00000004 || Optimized for 486 or newer.
|-
| 0x00000084 || Optimized for 486SX or newer.
|-
| 0x00000056 || Optimized for Pentium M5 or newer.
|-
| 0x00000067 || Optimized for Celeron or newer.
|-
| 0x00000077 || Optimized for Celeron Mobile.
|-
| 0x00000008 || Optimized for Pentium 3 or newer.
|-
| 0x00000018 || Optimized for Pentium 3-M or newer.
|-
| 0x00000028 || Optimized for Pentium 3-XEON or newer.
|-
| 0x0000000A || Optimized for Pentium-4 or newer.
|-
| 0x0000000B || Optimized for Itanium or newer.
|-
| 0x0000001B || Optimized for Itanium-2 or newer.
|-
| 0x0000000C || Optimized for XEON or newer.
|-
| 0x0000001C || Optimized for XEON-MP or newer.
|}

After the subtype value is the file type value.

{|class="wikitable"
|+ File type
|-
! Value !! Description
|-
|  0x00000001 || Relocatable object file.
|-
|  0x00000002 || Demand paged executable file.
|-
|  0x00000003 || Fixed VM shared library file.
|-
|  0x00000004 || Core file.
|-
|  0x00000005 || Preloaded executable file.
|-
|  0x00000006 || Dynamically bound shared library file.
|-
|  0x00000007 || Dynamic link editor.
|-
|  0x00000008 || Dynamically bound bundle file.
|-
|  0x00000009 || Shared library stub for static linking only, no section contents.
|-
|  0x0000000A || Companion file with only debug sections.
|-
|  0x0000000B || x86_64 kexts.
|-
|  0x0000000C || a file composed of other Mach-Os to be run in the same userspace sharing a single linkedit.
|}

After the file type value is the number of load commands and the total number of bytes the load commands are after the Mach-O header, then a 32-bit flag with the following possible settings.

{|class="wikitable"
|+ Flag Settings
|-
! Flag in [[Arithmetic_shift | left shift ]] !! Flag in Binary !! Description
|-
| 1<<0 || 0000_0000_0000_0000_0000_0000_0000_0001 || The object file has no undefined references.
|-
| 1<<1 || 0000_0000_0000_0000_0000_0000_0000_0010 || The object file is the output of an incremental link against a base file and can't be link edited again.
|-
| 1<<2 || 0000_0000_0000_0000_0000_0000_0000_0100 || The object file is input for the dynamic linker and can't be statically link edited again.
|-
| 1<<3 || 0000_0000_0000_0000_0000_0000_0000_1000 || The object file's undefined references are bound by the dynamic linker when loaded.
|-
| 1<<4 || 0000_0000_0000_0000_0000_0000_0001_0000 || The file has its dynamic undefined references prebound.
|-
| 1<<5 || 0000_0000_0000_0000_0000_0000_0010_0000 || The file has its read-only and read-write segments split.
|-
| 1<<6 || 0000_0000_0000_0000_0000_0000_0100_0000 || The shared library init routine is to be run lazily via catching memory faults to its writeable segments (obsolete).
|-
| 1<<7 || 0000_0000_0000_0000_0000_0000_1000_0000 || The image is using two-level name space bindings.
|-
| 1<<8 || 0000_0000_0000_0000_0000_0001_0000_0000 || The executable is forcing all images to use flat name space bindings.
|-
| 1<<9 || 0000_0000_0000_0000_0000_0010_0000_0000 || This umbrella guarantees no multiple definitions of symbols in its sub-images so the two-level namespace hints can always be used.
|-
| 1<<10 || 0000_0000_0000_0000_0000_0100_0000_0000 || Do not have dyld notify the prebinding agent about this executable.
|-
| 1<<11 || 0000_0000_0000_0000_0000_1000_0000_0000 || The binary is not prebound but can have its prebinding redone. only used when MH_PREBOUND is not set.
|-
| 1<<12 || 0000_0000_0000_0000_0001_0000_0000_0000 || Indicates that this binary binds to all two-level namespace modules of its dependent libraries.
|-
| 1<<13 || 0000_0000_0000_0000_0010_0000_0000_0000 || Safe to divide up the sections into sub-sections via symbols for dead code stripping.
|-
| 1<<14 || 0000_0000_0000_0000_0100_0000_0000_0000 || The binary has been canonicalized via the un-prebind operation.
|-
| 1<<15 || 0000_0000_0000_0000_1000_0000_0000_0000 || The final linked image contains external weak symbols.
|-
| 1<<16 || 0000_0000_0000_0001_0000_0000_0000_0000 || The final linked image uses weak symbols.
|-
| 1<<17 || 0000_0000_0000_0010_0000_0000_0000_0000 || When this bit is set, all stacks in the task will be given stack execution privilege.
|-
| 1<<18 || 0000_0000_0000_0100_0000_0000_0000_0000 || When this bit is set, the binary declares it is safe for use in processes with uid zero.
|-
| 1<<19 || 0000_0000_0000_1000_0000_0000_0000_0000 || When this bit is set, the binary declares it is safe for use in processes when UGID is true.
|-
| 1<<20 || 0000_0000_0001_0000_0000_0000_0000_0000 || When this bit is set on a dylib, the static linker does not need to examine dependent dylibs to see if any are re-exported.
|-
| 1<<21 || 0000_0000_0010_0000_0000_0000_0000_0000 || When this bit is set, the OS will load the main executable at a random address.
|-
| 1<<22 || 0000_0000_0100_0000_0000_0000_0000_0000 || Only for use on dylibs. When linking against a dylib that has this bit set, the static linker will automatically not create a load command to the dylib if no symbols are being referenced from the dylib.
|-
| 1<<23 || 0000_0000_1000_0000_0000_0000_0000_0000 || Contains a section of type S_THREAD_LOCAL_VARIABLES.
|-
| 1<<24 || 0000_0001_0000_0000_0000_0000_0000_0000 || When this bit is set, the OS will run the main executable with a non-executable heap even on platforms (e.g. i386) that don't require it.
|-
| 1<<25 || 0000_0010_0000_0000_0000_0000_0000_0000 || The code was linked for use in an application.
|-
| 1<<26 || 0000_0100_0000_0000_0000_0000_0000_0000 || The external symbols listed in the nlist symbol table do not include all the symbols listed in the dyld info.
|-
| 1<<27 || 0000_1000_0000_0000_0000_0000_0000_0000 || Allow LC_MIN_VERSION_MACOS and LC_BUILD_VERSION load commands with the platforms macOS, macCatalyst, iOSSimulator, tvOSSimulator and watchOSSimulator.
|-
| 1<<31 || 1000_0000_0000_0000_0000_0000_0000_0000 || Only for use on dylibs. When this bit is set, the dylib is part of the dyld shared cache, rather than loose in the filesystem.
|-
| ---- || 0xxx_0000_0000_0000_0000_0000_0000_0000|| The digits marked with "x" have no use, and are reserved for future use.
|}

Multiple binary digits can be set to one in the flags to identify any information or settings that apply to the binary.

Now the load commands are read as we have reached the end of the Mach-O header.