MachO file

Mach-O is short for Mach Object file format, which is the MAC and iOS executable file format, It is similar to PE(Executable) format on Windows and ELF (Executable and Linking Format) format on Linux. Mach-O is a file format for executables, object code, and dynamic libraries.

Common mach-O files:

  • Object file.o
  • Library files :.a,.dylib, Framework
  • Executable file
  • Dyld: dynamic linker
  • Dsym: symbol file

View instruction: View the file type through the $file file path

// use find to find a file of type $find / -name"*.dylib"
/usr/local/lib/libLeeHook.dylib
$ file /usr/local/lib/libLeeHook.dylib 
/usr/local/lib/libLeeHook.dylib: Mach-O 64-bit dynamically linked shared library arm64
Copy the code

Common binaries for common app release versions come in two types, depending on the supported system version

  • For iOS11: arm64 + arm_v7
  • IOS11 and later: arm64

Manually set the common binary file type

Lipo command

Universal binary 

// There are currently three common binaries containing $file /Users/testDemo
/Users/testDemo: Mach-O universal binary with 3 architectures: [arm_v7:Mach-O executable arm_v7] [arm_v7s:Mach-O executable arm_v7s] [arm64:Mach-O 64-bit executable arm64] //lipo -info Displays the file type /Users $lipo-info /Users/testDemo
Architectures in the fat file: $ file /Users/testDemo are: armv7 armv7s arm64 //lipo XXX -thin < type > -output < file name > /Users $lipotestDemo -thin armv7 -output testDemo_armv7 // Check again /Users $lipo-info /Users/testDemo_armv7 
Architectures in the fat file: /Users/testDemo is armv7
Copy the code

Otool command

In addition to using MachOView to view MachO internal information, you can also use the otool command;

$ otool -f testDemo Fat headers fat_magic 0xcafebabe nfat_arch 3 architecture 0 cputype 12 cpusubtype 9 capabilities 0x0 offset 16384 size 75744 align 2^14 (16384) architecture 1 cputype 12 cpusubtype 11 capabilities 0x0 offset 98304 size 75744 align 2^14 (16384) architecture 2 ... . .Copy the code

MachO file structure

Header data structure

LoadCommands data structure

Headers and LoadCommands are tied together

Data

Store data: code, string constants, classes, methods, etc.

conclusion