Mach headers: architecture, file type, commands and flags

The Mach header tells you what kind of image you are looking at and how much structural metadata follows it.

For a 64-bit Mach-O, the header is mach_header_64. Conceptually:

struct mach_header_64 {
    uint32_t magic;
    cpu_type_t cputype;
    cpu_subtype_t cpusubtype;
    uint32_t filetype;
    uint32_t ncmds;
    uint32_t sizeofcmds;
    uint32_t flags;
    uint32_t reserved;
};

CPU type is not a marketing label

cputype and cpusubtype are loader-facing architecture identifiers. A universal container can hold multiple Mach-O slices, each with its own header and CPU identity.

File type changes how the image is interpreted

Common values include executable images, dynamic libraries, bundles, object files, and dynamic linkers. Two files can contain similar sections yet have very different loader semantics because the file type differs.

ncmds and sizeofcmds are boundary information

ncmds is the number of load-command records after the header. sizeofcmds is the total byte size occupied by that command region.

A parser should validate both. Walking ncmds without checking command sizes and the enclosing command region is how malformed inputs turn into parser bugs.

Flags are accumulated statements

Header flags describe link and loader properties. Treat them as a bitset. Never assume a single flag explains the whole image.

The reliable analysis pattern is:

raw value → individual bits → documented semantics → evidence elsewhere in the image