ZDX ACADEMY

Understanding Apple Mach-O Binary Internals · Orientation and a byte-level toolchain

Language:English

Lab: Build a portable Mach-O header reader

Use only files you own, course fixtures, or binaries you are authorized to inspect.

You do not need macOS to learn the file format.

For this lab, write a small Python program that:

  1. opens a binary file in binary mode;
  2. reads the first 32 bytes;
  3. identifies whether the input is 32-bit Mach-O, 64-bit Mach-O, a byte-swapped Mach-O, or a universal container;
  4. for a 64-bit thin Mach-O, parses:
    • magic
    • cputype
    • cpusubtype
    • filetype
    • ncmds
    • sizeofcmds
    • flags
    • reserved;
  5. prints both hexadecimal and interpreted values.

Use Python's struct.unpack and make the endian format explicit. Do not solve the problem by shelling out to file, otool, or another parser.

Then compare your output with one independent tool if you have one available, such as llvm-readobj, otool -hv, LIEF, or file.

The point of the comparison is not to copy the tool. It is to test your parser against a second implementation.

Deliverable

Save:

Course outline