# machofile
machofile is a module to parse Mach-O binary files, with a focus on malware analysis and reverse engineering.
Inspired by Ero Carrera's pefile, this module aims to provide a similar capability but for Mach-O binaries instead.
Reference material and documentation used to gain the file format knowledge, the basic structures and constant are taken from the resources listed below.
machofile is self-contained. The module has no dependencies; it is endianness independent; and it works on macOS, Windows, and Linux.
While there are other mach-o parsing modules out there, the motivations behind developing this one are:
- first and foremost, for me this was a great way to deep dive and learn more about the Mach-O format and structures
- to provide a simple way to parse Mach-O files for analysis
- to not depend on external modules (e.g. lief, macholib, macho, etc.), since everything is directly extracted from the file and is all in pure python.
This is still officially out of beta (2025.07.30), but still please let me know if you try or find bugs but also... be gentle ;) code will be optimized and more features will be added.
**Current Features:**
- Parse Mach-O Header
- Parse Load Commands
- Parse File Segments
- Parse Dylib Commands
- Parse Dylib List
- Extract imported function
- Extract Exported Symbols
- Hashes: dylib hash, import hash, export hash, symhash
- Segment entropy calculation
- Extract Entry point
- Extract UUID
- Extract Version Information
- Parse basic Code Signature information
- Support for FAT (Universal) Binaries
- JSON output support (both human-readable and raw formats)
_Note: as of now, this has initially been tested against x86, x86_64, arm64, and arm64e Mach-O samples._
**Next features to be implemented (in random order):**
- Embedded strings
- File Attributes
- flag for suspicious libraries
- Packer detection
- ...
## Credits
Those are the people that I would like to thank for being the inspiration that led me to write this module:
- Ero Carrera ([@erocarrera](https://twitter.com/erocarrera)) for writing and maintaining the [pefile](https://github.com/erocarrera/pefile/tree/master) module
- Patrick Wardle ([@patrickwardle](https://twitter.com/patrickwardle)) for the great work in sharing his macOS malware analysis and research, and brigning to life [OBTS](https://objectivebythesea.org/) :)
- Greg Lesnewich ([@greglesnewich](https://twitter.com/greglesnewich)) for his work on [macho-similarity](https://github.com/g-les/macho_similarity)
## Usage and example
You can either use it from command line or import it as a module in your python code, and call each function individually to parse only the structures you are interested in.
### Module version
It expects to be supplied with either a file path or a data buffer to parse.
```python
import machofile
macho = machofile.UniversalMachO(file_path='/path/to/machobinary')
macho.parse()
```
If the data buffer is already available, it can be supplied directly with:
```python
import machofile
with open(file_path, 'rb') as f:
data = f.read()
macho = machofile.UniversalMachO(data=data)
macho.parse()
```
For detailed usage of the API, check the dedicated [API documentation page](API_documentation_machofile.md).
### Command Line version
You can use `machofile.py` also directly as a CLI tool. All CLI features are available from the same file you import as a module.
```
% python3 machofile.py -h
usage: machofile.py [-h] -f FILE [-j] [--raw] [-a] [-d] [-e] [-ep] [-g]
[-hdr] [-i] [-l] [-seg] [-sig] [-sim] [-u] [-v] [--arch ARCH]
Parse Mach-O file structures.
options:
-h, --help show this help message and exit
required arguments:
-f, --file FILE Path to the file to be parsed
output format options:
-j, --json Output data in JSON format
--raw Output raw values in JSON format (use with -j/--json)
data extraction options:
-a, --all Print all info about the file
-d, --dylib Print Dylib Command Table and Dylib list
-e, --exports Print exported symbols
-ep, --entry-point Print entry point information
-g, --general_info Print general info about the file
-hdr, --header Print Mach-O header info
-i, --imports Print imported symbols
-l, --load_cmd_t Print Load Command Table and Command list
-seg, --segments Print File Segments info
-sig, --signature Print code signature and entitlements information
-sim, --similarity Print similarity hashes
-u, --uuid Print UUID
-v, --version Print version information
filter options:
--arch ARCH Show info for specific architecture only (for Universal binaries)
```
Example output:
```
% python3 machofile.py -a -f b4f68a58658ceceb368520dafc35b270272ac27b8890d5b3ff0b968170471e2b
[General File Info]
Filename: b4f68a58658ceceb368520dafc35b270272ac27b8890d5b3ff0b968170471e2b
Filesize: 54240
MD5: 20ffe440e4f557b9e03855b5da2b3c9c
SHA1: 1bf61ecad8568a774f9fba726a254a9603d09f33
SHA256: b4f68a58658ceceb368520dafc35b270272ac27b8890d5b3ff0b968170471e2b
[Mach-O Header]
magic: MH_MAGIC (32-bit), 0xFEEDFACE
cputype: Intel i386
cpusubtype: X86_ALL
filetype: EXECUTE
ncmds: 13
sizeofcmds: 1180
flags: NOUNDEFS, DYLDLINK, TWOLEVEL
[Load Cmd table]
{'cmd': 'LC_SEGMENT', 'cmdsize': 56}
{'cmd': 'LC_SEGMENT', 'cmdsize': 192}
{'cmd': 'LC_SEGMENT', 'cmdsize': 328}
{'cmd': 'LC_SEGMENT', 'cmdsize': 192}
{'cmd': 'LC_SEGMENT', 'cmdsize': 56}
{'cmd': 'LC_SYMTAB', 'cmdsize': 24}
{'cmd': 'LC_DYSYMTAB', 'cmdsize': 80}
{'cmd': 'LC_LOAD_DYLINKER', 'cmdsize': 28}
{'cmd': 'LC_UUID', 'cmdsize': 24}
{'cmd': 'LC_UNIXTHREAD', 'cmdsize': 80}
{'cmd': 'LC_LOAD_DYLIB', 'cmdsize': 52}
{'cmd': 'LC_LOAD_DYLIB', 'cmdsize': 52}
{'cmd': 'LC_CODE_SIGNATURE', 'cmdsize': 16}
[Load Commands]
LC_CODE_SIGNATURE
LC_DYSYMTAB
LC_LOAD_DYLIB
LC_LOAD_DYLINKER
LC_SEGMENT
LC_SYMTAB
LC_UNIXTHREAD
LC_UUID
[File Segments]
SEGNAME VADDR VSIZE OFFSET SIZE MAX_VM_PROTECTION INITIAL_VM_PROTECTION NSECTS FLAGS ENTROPY
------------------------------------------------------------------------------------------------------------
__PAGEZERO 0 4096 0 0 0 0 0 0 0.0
__TEXT 4096 28672 0 28672 7 5 2 0 5.080680410706916
__DATA 32768 4096 28672 4096 7 3 4 0 0.1261649636134924
__IMPORT 36864 4096 32768 4096 7 7 2 0 0.21493796627555234
__LINKEDIT 40960 20480 36864 17376 7 1 0 0 6.637864516225949
[Dylib Commands]
DYLIB_NAME_OFFSET DYLIB_TIMESTAMP DYLIB_CURRENT_VERSION DYLIB_COMPAT_VERSION DYLIB_NAME
----------------------------------------------------------------------------------------------------------
24 2 65536 65536 b'/usr/lib/libgcc_s.1.dylib'
24 2 7274759 65536 b'/usr/lib/libSystem.B.dylib'
[Dylib Names]
b'/usr/lib/libgcc_s.1.dylib'
b'/usr/lib/libSystem.B.dylib'
[UUID]
d691c242-da49-1081-50d5-4f8991924b06
[Entry Point]
type: LC_UNIXTHREAD
entry_address:9200
thread_data_size:72
[Version Information]
No version information found
[Code Signature]
signed: True
signing_status:Apple signed
certificates_info:
count: 3
certificates:
index: 0
size: 4815
subject: Contains: Developer ID Certification Authority
issuer: Unable to parse
is_apple_cert:True
type: Developer ID Certification Authority
index: 1
size: 1215
subject: Contains: Apple Root CA
issuer: Unable to parse
is_apple_cert:True
type: Apple Root CA
index: 2
size: 1385
subject: Contains: Developer ID Application:
issuer: Unable to parse
is_apple_cert:False
type: Developer ID Application Certificate
entitlements_info:
count: 0
entitlements:
code_directory:
version: 131328
flags: 0
hash_offset: 144
identifier_offset:48
special_slots:3
signing_flags:
None
code_slots: 11
hash_size: 44640
hash_type: 335609868
hash_algorithm:Unknown (335609868)
identifier: onmac.unspecified.installer
[Imported Functions]
/usr/lib/libSystem.B.dylib:
__NSGetExecutablePath
___stderrp
_dlerror
_dlopen
_dlsym
_exit
_fclose
_fopen
_fprintf
_fputs$UNIX2003
_free
_fwrite$UNIX2003
_getenv
_getpid
_getpwnam
_lstat
_mbstowcs
_memcpy
_memset
_setenv$UNIX2003
_setlocale
_snprintf
_stat
_strchr
_strdup
_strlen
_unsetenv$UNIX2003
[Exported Symbols]
<unknown>:
_NXArgc
_NXArgv
___progname
_environ
_main
start
[Similarity Hashes]
dylib_hash: 0556bed5dc31bddaee73f3234b3c577b
import_hash: 0bae89995ad3900987c49c0bea1d17fe
export_hash: 824e359e3d0ad7283d0982bd5da2e8fd
symhash: 15e6c1aeba01be1404901f7152213779
```
### JSON Output
machofile supports JSON output for programmatic consumption of the parsed data. The JSON output comes in two formats:
#### Human-Readable JSON (Default)
The default JSON output provides human-readable values with proper formatting applied:
```bash
% python3 machofile.py -j -hdr -f dec750b9d596b14aeab1ed6f6d6d370022443ceceb127e7d2468b903c2d9477a
{
"header": {
"x86_64": {
"magic": "MH_MAGIC_64 (64-bit), 0xFEEDFACF",
"cputype": "x86_64",
"cpusubtype": "x86_ALL",
"filetype": "EXECUTE",
"ncmds": 41,
"sizeofcmds": 5024,
"flags": "NOUNDEFS, DYLDLINK, TWOLEVEL, BINDS_TO_WEAK, PIE"
},
"arm64": {
"magic": "MH_MAGIC_64 (64-bit), 0xFEEDFACF",
"cputype": "ARM 64-bit",
"cpusubtype": "ARM_ALL",
"filetype": "EXECUTE",
"ncmds": 41,
"sizeofcmds": 5104,
"flags": "NOUNDEFS, DYLDLINK, TWOLEVEL, BINDS_TO_WEAK, PIE"
}
},
"architectures": [
"x86_64",
"arm64"
]
}
```
#### Raw JSON Output
For applications that need to process raw numeric values, use the `--raw` flag:
```bash
% python3 machofile.py -j --raw -hdr -f dec750b9d596b14aeab1ed6f6d6d370022443ceceb127e7d2468b903c2d9477a
{
"header": {
"x86_64": {
"magic": 4277009103,
"cputype": 16777223,
"cpusubtype": 3,
"filetype": 2,
"ncmds": 41,
"sizeofcmds": 5024,
"flags": 2162821
},
"arm64": {
"magic": 4277009103,
"cputype": 16777228,
"cpusubtype": 0,
"filetype": 2,
"ncmds": 41,
"sizeofcmds": 5104,
"flags": 2162821
}
},
"architectures": [
"x86_64",
"arm64"
]
}
```
#### JSON Output Options
- `-j, --json`: Output data in JSON format (human-readable by default)
- `--raw`: Output raw numeric values instead of formatted strings (must be used with `-j`)
JSON output supports all the same analysis options as the standard output (`-a`, `-hd`, `-l`, `-sg`, etc.) and works with both single-architecture and Universal (FAT) binaries.
## Reference/Documentation links:
- https://opensource.apple.com/source/xnu/xnu-2050.18.24/EXTERNAL_HEADERS/mach-o/loader.h
- https://github.com/apple-oss-distributions/lldb/blob/10de1840defe0dff10b42b9c56971dbc17c1f18c/llvm/include/llvm/Support/MachO.h
- https://github.com/apple-oss-distributions/dyld/tree/main
- https://iphonedev.wiki/Mach-O_File_Format
- https://lowlevelbits.org/parsing-mach-o-files/
- https://github.com/aidansteele/osx-abi-macho-file-format-reference
- https://lief-project.github.io/doc/latest/tutorials/11_macho_modification.html
- https://github.com/VirusTotal/yara/blob/master/libyara/include/yara/macho.h
- https://github.com/corkami/pics/blob/master/binary/README.md
- https://github.com/qyang-nj/llios/tree/main
- https://github.com/threatstream/symhash
Raw data
{
"_id": null,
"home_page": null,
"name": "machofile",
"maintainer": null,
"docs_url": null,
"requires_python": ">=3.7",
"maintainer_email": "Pasquale Stirparo <pstirparo@threatresearch.ch>",
"keywords": "mach-o, macho, universal-binary, binary-parser, macos, ios, reverse-engineering, malware-analysis, security, python",
"author": null,
"author_email": "Pasquale Stirparo <pstirparo@threatresearch.ch>",
"download_url": "https://files.pythonhosted.org/packages/f9/2d/f9aaf1a3f326fdda61140da7af869d1cf581953b24d4d2d7b50e04db6eb7/machofile-2025.7.31.tar.gz",
"platform": null,
"description": "# machofile\nmachofile is a module to parse Mach-O binary files, with a focus on malware analysis and reverse engineering.\n\nInspired by Ero Carrera's pefile, this module aims to provide a similar capability but for Mach-O binaries instead. \nReference material and documentation used to gain the file format knowledge, the basic structures and constant are taken from the resources listed below.\n\nmachofile is self-contained. The module has no dependencies; it is endianness independent; and it works on macOS, Windows, and Linux.\n\nWhile there are other mach-o parsing modules out there, the motivations behind developing this one are:\n- first and foremost, for me this was a great way to deep dive and learn more about the Mach-O format and structures\n- to provide a simple way to parse Mach-O files for analysis\n- to not depend on external modules (e.g. lief, macholib, macho, etc.), since everything is directly extracted from the file and is all in pure python.\n\nThis is still officially out of beta (2025.07.30), but still please let me know if you try or find bugs but also... be gentle ;) code will be optimized and more features will be added.\n\n**Current Features:**\n- Parse Mach-O Header\n- Parse Load Commands\n- Parse File Segments\n- Parse Dylib Commands\n- Parse Dylib List\n- Extract imported function\n- Extract Exported Symbols\n- Hashes: dylib hash, import hash, export hash, symhash\n- Segment entropy calculation\n- Extract Entry point\n- Extract UUID\n- Extract Version Information\n- Parse basic Code Signature information\n- Support for FAT (Universal) Binaries\n- JSON output support (both human-readable and raw formats)\n\n\n_Note: as of now, this has initially been tested against x86, x86_64, arm64, and arm64e Mach-O samples._\n\n**Next features to be implemented (in random order):**\n- Embedded strings\n- File Attributes\n- flag for suspicious libraries\n- Packer detection\n- ...\n\n## Credits\nThose are the people that I would like to thank for being the inspiration that led me to write this module:\n- Ero Carrera ([@erocarrera](https://twitter.com/erocarrera)) for writing and maintaining the [pefile](https://github.com/erocarrera/pefile/tree/master) module\n- Patrick Wardle ([@patrickwardle](https://twitter.com/patrickwardle)) for the great work in sharing his macOS malware analysis and research, and brigning to life [OBTS](https://objectivebythesea.org/) :)\n- Greg Lesnewich ([@greglesnewich](https://twitter.com/greglesnewich)) for his work on [macho-similarity](https://github.com/g-les/macho_similarity)\n\n## Usage and example\nYou can either use it from command line or import it as a module in your python code, and call each function individually to parse only the structures you are interested in.\n\n### Module version\nIt expects to be supplied with either a file path or a data buffer to parse.\n\n```python\nimport machofile\nmacho = machofile.UniversalMachO(file_path='/path/to/machobinary')\nmacho.parse()\n```\n\nIf the data buffer is already available, it can be supplied directly with:\n\n```python\nimport machofile\nwith open(file_path, 'rb') as f:\n data = f.read()\nmacho = machofile.UniversalMachO(data=data)\nmacho.parse()\n```\n\nFor detailed usage of the API, check the dedicated [API documentation page](API_documentation_machofile.md).\n\n### Command Line version\nYou can use `machofile.py` also directly as a CLI tool. All CLI features are available from the same file you import as a module.\n\n```\n% python3 machofile.py -h\nusage: machofile.py [-h] -f FILE [-j] [--raw] [-a] [-d] [-e] [-ep] [-g] \n [-hdr] [-i] [-l] [-seg] [-sig] [-sim] [-u] [-v] [--arch ARCH]\n\nParse Mach-O file structures.\n\noptions:\n -h, --help show this help message and exit\n\nrequired arguments:\n -f, --file FILE Path to the file to be parsed\n\noutput format options:\n -j, --json Output data in JSON format\n --raw Output raw values in JSON format (use with -j/--json)\n\ndata extraction options:\n -a, --all Print all info about the file\n -d, --dylib Print Dylib Command Table and Dylib list\n -e, --exports Print exported symbols\n -ep, --entry-point Print entry point information\n -g, --general_info Print general info about the file\n -hdr, --header Print Mach-O header info\n -i, --imports Print imported symbols\n -l, --load_cmd_t Print Load Command Table and Command list\n -seg, --segments Print File Segments info\n -sig, --signature Print code signature and entitlements information\n -sim, --similarity Print similarity hashes\n -u, --uuid Print UUID\n -v, --version Print version information\n\nfilter options:\n --arch ARCH Show info for specific architecture only (for Universal binaries)\n```\n\nExample output:\n```\n% python3 machofile.py -a -f b4f68a58658ceceb368520dafc35b270272ac27b8890d5b3ff0b968170471e2b\n\n[General File Info]\n Filename: b4f68a58658ceceb368520dafc35b270272ac27b8890d5b3ff0b968170471e2b\n Filesize: 54240\n MD5: 20ffe440e4f557b9e03855b5da2b3c9c\n SHA1: 1bf61ecad8568a774f9fba726a254a9603d09f33\n SHA256: b4f68a58658ceceb368520dafc35b270272ac27b8890d5b3ff0b968170471e2b\n\n[Mach-O Header]\n magic: MH_MAGIC (32-bit), 0xFEEDFACE\n cputype: Intel i386\n cpusubtype: X86_ALL\n filetype: EXECUTE\n ncmds: 13\n sizeofcmds: 1180\n flags: NOUNDEFS, DYLDLINK, TWOLEVEL\n\n[Load Cmd table]\n {'cmd': 'LC_SEGMENT', 'cmdsize': 56}\n {'cmd': 'LC_SEGMENT', 'cmdsize': 192}\n {'cmd': 'LC_SEGMENT', 'cmdsize': 328}\n {'cmd': 'LC_SEGMENT', 'cmdsize': 192}\n {'cmd': 'LC_SEGMENT', 'cmdsize': 56}\n {'cmd': 'LC_SYMTAB', 'cmdsize': 24}\n {'cmd': 'LC_DYSYMTAB', 'cmdsize': 80}\n {'cmd': 'LC_LOAD_DYLINKER', 'cmdsize': 28}\n {'cmd': 'LC_UUID', 'cmdsize': 24}\n {'cmd': 'LC_UNIXTHREAD', 'cmdsize': 80}\n {'cmd': 'LC_LOAD_DYLIB', 'cmdsize': 52}\n {'cmd': 'LC_LOAD_DYLIB', 'cmdsize': 52}\n {'cmd': 'LC_CODE_SIGNATURE', 'cmdsize': 16}\n\n[Load Commands]\n LC_CODE_SIGNATURE\n LC_DYSYMTAB\n LC_LOAD_DYLIB\n LC_LOAD_DYLINKER\n LC_SEGMENT\n LC_SYMTAB\n LC_UNIXTHREAD\n LC_UUID\n\n[File Segments]\n SEGNAME VADDR VSIZE OFFSET SIZE MAX_VM_PROTECTION INITIAL_VM_PROTECTION NSECTS FLAGS ENTROPY \n ------------------------------------------------------------------------------------------------------------\n __PAGEZERO 0 4096 0 0 0 0 0 0 0.0 \n __TEXT 4096 28672 0 28672 7 5 2 0 5.080680410706916 \n __DATA 32768 4096 28672 4096 7 3 4 0 0.1261649636134924 \n __IMPORT 36864 4096 32768 4096 7 7 2 0 0.21493796627555234\n __LINKEDIT 40960 20480 36864 17376 7 1 0 0 6.637864516225949 \n\n[Dylib Commands]\n DYLIB_NAME_OFFSET DYLIB_TIMESTAMP DYLIB_CURRENT_VERSION DYLIB_COMPAT_VERSION DYLIB_NAME \n ----------------------------------------------------------------------------------------------------------\n 24 2 65536 65536 b'/usr/lib/libgcc_s.1.dylib' \n 24 2 7274759 65536 b'/usr/lib/libSystem.B.dylib'\n\n[Dylib Names]\n b'/usr/lib/libgcc_s.1.dylib'\n b'/usr/lib/libSystem.B.dylib'\n\n[UUID]\n d691c242-da49-1081-50d5-4f8991924b06\n\n[Entry Point]\n type: LC_UNIXTHREAD\n entry_address:9200\n thread_data_size:72\n\n[Version Information]\n No version information found\n\n[Code Signature]\n signed: True\n signing_status:Apple signed\n certificates_info:\n count: 3\n certificates:\n index: 0\n size: 4815\n subject: Contains: Developer ID Certification Authority\n issuer: Unable to parse\n is_apple_cert:True\n type: Developer ID Certification Authority\n\n index: 1\n size: 1215\n subject: Contains: Apple Root CA\n issuer: Unable to parse\n is_apple_cert:True\n type: Apple Root CA\n\n index: 2\n size: 1385\n subject: Contains: Developer ID Application:\n issuer: Unable to parse\n is_apple_cert:False\n type: Developer ID Application Certificate\n entitlements_info:\n count: 0\n entitlements:\n code_directory:\n version: 131328\n flags: 0\n hash_offset: 144\n identifier_offset:48\n special_slots:3\n signing_flags:\n None\n code_slots: 11\n hash_size: 44640\n hash_type: 335609868\n hash_algorithm:Unknown (335609868)\n identifier: onmac.unspecified.installer\n\n[Imported Functions]\n /usr/lib/libSystem.B.dylib:\n __NSGetExecutablePath\n ___stderrp\n _dlerror\n _dlopen\n _dlsym\n _exit\n _fclose\n _fopen\n _fprintf\n _fputs$UNIX2003\n _free\n _fwrite$UNIX2003\n _getenv\n _getpid\n _getpwnam\n _lstat\n _mbstowcs\n _memcpy\n _memset\n _setenv$UNIX2003\n _setlocale\n _snprintf\n _stat\n _strchr\n _strdup\n _strlen\n _unsetenv$UNIX2003\n\n[Exported Symbols]\n <unknown>:\n _NXArgc\n _NXArgv\n ___progname\n _environ\n _main\n start\n\n[Similarity Hashes]\n dylib_hash: 0556bed5dc31bddaee73f3234b3c577b\n import_hash: 0bae89995ad3900987c49c0bea1d17fe\n export_hash: 824e359e3d0ad7283d0982bd5da2e8fd\n symhash: 15e6c1aeba01be1404901f7152213779\n```\n\n### JSON Output\nmachofile supports JSON output for programmatic consumption of the parsed data. The JSON output comes in two formats:\n\n#### Human-Readable JSON (Default)\nThe default JSON output provides human-readable values with proper formatting applied:\n\n```bash\n% python3 machofile.py -j -hdr -f dec750b9d596b14aeab1ed6f6d6d370022443ceceb127e7d2468b903c2d9477a \n{\n \"header\": {\n \"x86_64\": {\n \"magic\": \"MH_MAGIC_64 (64-bit), 0xFEEDFACF\",\n \"cputype\": \"x86_64\",\n \"cpusubtype\": \"x86_ALL\",\n \"filetype\": \"EXECUTE\",\n \"ncmds\": 41,\n \"sizeofcmds\": 5024,\n \"flags\": \"NOUNDEFS, DYLDLINK, TWOLEVEL, BINDS_TO_WEAK, PIE\"\n },\n \"arm64\": {\n \"magic\": \"MH_MAGIC_64 (64-bit), 0xFEEDFACF\",\n \"cputype\": \"ARM 64-bit\",\n \"cpusubtype\": \"ARM_ALL\",\n \"filetype\": \"EXECUTE\",\n \"ncmds\": 41,\n \"sizeofcmds\": 5104,\n \"flags\": \"NOUNDEFS, DYLDLINK, TWOLEVEL, BINDS_TO_WEAK, PIE\"\n }\n },\n \"architectures\": [\n \"x86_64\",\n \"arm64\"\n ]\n}\n```\n\n#### Raw JSON Output\nFor applications that need to process raw numeric values, use the `--raw` flag:\n\n```bash\n% python3 machofile.py -j --raw -hdr -f dec750b9d596b14aeab1ed6f6d6d370022443ceceb127e7d2468b903c2d9477a\n{\n \"header\": {\n \"x86_64\": {\n \"magic\": 4277009103,\n \"cputype\": 16777223,\n \"cpusubtype\": 3,\n \"filetype\": 2,\n \"ncmds\": 41,\n \"sizeofcmds\": 5024,\n \"flags\": 2162821\n },\n \"arm64\": {\n \"magic\": 4277009103,\n \"cputype\": 16777228,\n \"cpusubtype\": 0,\n \"filetype\": 2,\n \"ncmds\": 41,\n \"sizeofcmds\": 5104,\n \"flags\": 2162821\n }\n },\n \"architectures\": [\n \"x86_64\",\n \"arm64\"\n ]\n}\n```\n\n#### JSON Output Options\n- `-j, --json`: Output data in JSON format (human-readable by default)\n- `--raw`: Output raw numeric values instead of formatted strings (must be used with `-j`)\n\nJSON output supports all the same analysis options as the standard output (`-a`, `-hd`, `-l`, `-sg`, etc.) and works with both single-architecture and Universal (FAT) binaries.\n\n## Reference/Documentation links:\n- https://opensource.apple.com/source/xnu/xnu-2050.18.24/EXTERNAL_HEADERS/mach-o/loader.h\n- https://github.com/apple-oss-distributions/lldb/blob/10de1840defe0dff10b42b9c56971dbc17c1f18c/llvm/include/llvm/Support/MachO.h\n- https://github.com/apple-oss-distributions/dyld/tree/main\n- https://iphonedev.wiki/Mach-O_File_Format\n- https://lowlevelbits.org/parsing-mach-o-files/\n- https://github.com/aidansteele/osx-abi-macho-file-format-reference\n- https://lief-project.github.io/doc/latest/tutorials/11_macho_modification.html\n- https://github.com/VirusTotal/yara/blob/master/libyara/include/yara/macho.h\n- https://github.com/corkami/pics/blob/master/binary/README.md\n- https://github.com/qyang-nj/llios/tree/main\n- https://github.com/threatstream/symhash\n",
"bugtrack_url": null,
"license": null,
"summary": "A Python module to parse Mach-O binary files",
"version": "2025.7.31",
"project_urls": {
"Bug Tracker": "https://github.com/pasquales/machofile/issues",
"Documentation": "https://github.com/pasquales/machofile/blob/main/API_documentation_machofile.md",
"Homepage": "https://github.com/pasquales/machofile",
"Repository": "https://github.com/pasquales/machofile"
},
"split_keywords": [
"mach-o",
" macho",
" universal-binary",
" binary-parser",
" macos",
" ios",
" reverse-engineering",
" malware-analysis",
" security",
" python"
],
"urls": [
{
"comment_text": null,
"digests": {
"blake2b_256": "6b4c391e07ca1eb65273c8e2f2d511b0d7f2168eecf64b2f9223a4fe5169b533",
"md5": "5b161367690be3294467bc661698f2bb",
"sha256": "c111a22af3561b1d26af76772b368611cbad632586235b3b41acc90f0aa8c6bc"
},
"downloads": -1,
"filename": "machofile-2025.7.31-py3-none-any.whl",
"has_sig": false,
"md5_digest": "5b161367690be3294467bc661698f2bb",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": ">=3.7",
"size": 47203,
"upload_time": "2025-07-31T08:34:27",
"upload_time_iso_8601": "2025-07-31T08:34:27.195932Z",
"url": "https://files.pythonhosted.org/packages/6b/4c/391e07ca1eb65273c8e2f2d511b0d7f2168eecf64b2f9223a4fe5169b533/machofile-2025.7.31-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": null,
"digests": {
"blake2b_256": "f92df9aaf1a3f326fdda61140da7af869d1cf581953b24d4d2d7b50e04db6eb7",
"md5": "0735f01debde5dd2cd7669c94b0b9471",
"sha256": "b448b43e7507de404c74c055d87a93c160d6425c7b053d929787a00ad90d0a5e"
},
"downloads": -1,
"filename": "machofile-2025.7.31.tar.gz",
"has_sig": false,
"md5_digest": "0735f01debde5dd2cd7669c94b0b9471",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=3.7",
"size": 40190,
"upload_time": "2025-07-31T08:34:28",
"upload_time_iso_8601": "2025-07-31T08:34:28.726236Z",
"url": "https://files.pythonhosted.org/packages/f9/2d/f9aaf1a3f326fdda61140da7af869d1cf581953b24d4d2d7b50e04db6eb7/machofile-2025.7.31.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2025-07-31 08:34:28",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "pasquales",
"github_project": "machofile",
"github_not_found": true,
"lcname": "machofile"
}
JSON
