Lab: Build a portable Mach-O header reader
Use only files you own, course fixtures, or binaries you are authorized to inspect.
You do not need macOS to learn the file format.
For this lab, write a small Python program that:
- opens a binary file in binary mode;
- reads the first 32 bytes;
- identifies whether the input is 32-bit Mach-O, 64-bit Mach-O, a byte-swapped Mach-O, or a universal container;
- for a 64-bit thin Mach-O, parses:
magiccputypecpusubtypefiletypencmdssizeofcmdsflagsreserved;
- prints both hexadecimal and interpreted values.
Use Python's struct.unpack and make the endian format explicit. Do not solve the problem by shelling out to file, otool, or another parser.
Then compare your output with one independent tool if you have one available, such as llvm-readobj, otool -hv, LIEF, or file.
The point of the comparison is not to copy the tool. It is to test your parser against a second implementation.
Deliverable
Save:
- your parser source;
- the SHA-256 of the sample you tested;
- your parsed header;
- the independent tool output;
- a short note explaining any difference.