Mach-O Executable
| Format | Mach-O Executable |
|---|---|
| Short name | Mach-O |
| Category | execution |
| Platforms | macOS, iOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Native executable, library, and object format for iOS and macOS. App binaries can be analysed for hardcoded strings, URLs, API endpoints, encryption keys, and embedded credentials. Entitlements (XML embedded via LC_CODE_SIGNATURE) define app sandbox capabilities and permissions — relevant for identifying over-privileged apps or jailbreak bypass attempts. Code signatures link the binary to a developer identity and detect tampering. Fat/Universal Binaries contain multiple architecture slices (e.g. arm64 + x86_64) in a single file, preceded by a fat_header with magic 0xCAFEBABE — the same magic as Java class files, so the following bytes (architecture count vs. class file version) must be checked to tell them apart.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | CF FA ED FE | .... | Mach-O 64-bit little-endian (arm64, x86_64) — most common on modern devices |
| offset 0 (0x0) | CE FA ED FE | .... | Mach-O 32-bit little-endian |
| offset 0 (0x0) | CA FE BA BE | .... | Fat/Universal Binary — contains multiple architecture slices (same magic as Java class files) |
| offset 0 (0x0) | FE ED FA CF | .... | Mach-O 64-bit big-endian |
| offset 0 (0x0) | FE ED FA CE | .... | Mach-O 32-bit big-endian |
Known extensions
.dylib, .o
References
- Apple mach-o/loader.h (XNU source — header and load command definitions) https://github.com/apple-oss-distributions/xnu/blob/main/EXTERNAL_HEADERS/mach-o/loader.h
- Apple developer docs — Mach-O format reference (archived) https://developer.apple.com/library/archive/documentation/Performance/Conceptual/CodeFootprint/Articles/MachOOverview.html
- Mach-O ABI reference (GitHub mirror) https://github.com/aidansteele/osx-abi-macho-file-format-reference
- Mach-O format overview (Wikipedia) https://en.wikipedia.org/wiki/Mach-O
- So Macho — a look at Apple executable files (Hexiosec, Scott Lester, 2020) https://hexiosec.com/blog/macho-files/
Cite this entry
Crush Format Reference, “Mach-O Executable”. https://kalink0.github.io/crush-forensics/formats/mach-o/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction