A repeatable workflow for unfamiliar Mach-O files

When you receive an unfamiliar Mach-O file, resist the urge to start by scrolling through disassembly.

Use a layered workflow.

1. Establish identity

Record the file hash, container type, architecture slice, Mach-O width, file type, and basic build/platform metadata.

2. Map the image

List segments, sections, permissions, file ranges, and preferred virtual ranges. Mark non-file-backed regions.

3. Inventory dependencies and linking metadata

Identify dylibs, imports, exported names, symbol information, and dynamic-link metadata.

4. Inspect trust metadata

Record code-signature presence, signing identity information available to your tools, entitlements, and whether verification succeeds under the environment you are using.

5. Inspect language/runtime metadata

Determine whether Objective-C, Swift, C++, or other recognizable runtime conventions provide useful structural clues.

6. Build hypotheses

Only now start forming hypotheses about behavior. Write them as hypotheses and attach evidence.

7. Test hypotheses

Use cross-references, control flow, strings, data references, debugger traces in an authorized environment, or small parser scripts to test the model.

8. Produce a reproducible report

Someone else should be able to repeat your observations from the sample hash, commands, scripts, and offsets/addresses you recorded.

That final requirement is what turns “I looked at a binary” into technical work another person can trust.