Binary analysis · Intermediate

Understanding Apple Mach-O Binary Internals

A practical, technically rigorous course on Apple Mach-O internals. Students learn the actual file structures and loader concepts, use real analysis tools, write small parsers, inspect code-signing metadata, and finish with a capstone analysis artifact.

All learning material free$4.99 verified credentialVersion 1

The credential is optional. You do not need to pay to access the course material.

MODULE 1

Orientation and a byte-level toolchain

Set up a portable workflow and learn to verify claims directly against bytes and structures.

What a binary format actually promiseslesson · 35 min Lab: Build a portable Mach-O header readerlab · 60 min

MODULE 2

The Mach-O container

Magic values, endianness, 32/64-bit headers, CPU types and file types.

Mach headers: architecture, file type, commands and flagslesson · 45 min

MODULE 3

Load commands are the map

Understand LC_* commands and how they describe what the loader and linker need.

Load commands are the maplesson · 55 min

MODULE 4

Segments, sections and virtual memory

Connect on-disk layout to mapped memory and permissions.

Segments, sections, file offsets and virtual memorylesson · 60 min

MODULE 5

Symbols, relocations and dynamic linking

Follow names and references through symbol tables, dyld metadata and imports.

Symbols, string tables and dynamic linkinglesson · 65 min Modern dyld metadata: exports and chained fixupslesson · 55 min

MODULE 6

Universal binaries and architecture slices

Inspect FAT containers and reason about multiple architecture payloads.

Universal binaries: one container, multiple Mach-O imageslesson · 40 min Lab: Parse a universal Mach-O wrapperlab · 75 min

MODULE 7

Code signatures, entitlements and trust metadata

Understand what is signed, where metadata lives, and what verification does and does not prove.

Code signatures and entitlements without mythologylesson · 70 min Lab: Map the embedded code-signature structurelab · 90 min

MODULE 8

Objective-C and Swift runtime metadata

Recognize runtime structures that expose classes, selectors, protocols and language metadata.

Objective-C and Swift runtime metadatalesson · 60 min

MODULE 9

Reconstructing behavior from an unfamiliar binary

Combine headers, mappings, symbols, strings and disassembly into a coherent execution model.

A repeatable workflow for unfamiliar Mach-O fileslesson · 65 min

MODULE 10

Capstone and verified credential

Produce a reproducible analysis report and complete the final assessment.

Capstone: produce a defensible Mach-O analysiscapstone · 120 min Final assessmentexam · 45 min