Mach-o file format

Mach-o (Mach object) file format

This format is very rare in Chinese, and the most detailed is Apple's official documentation, this article does not repeat the contents of the Mach-o file format, only the experience when using IDA reverse iOS application.

Mach-o Detailed documentation Reference: https://developer.apple.com/library/mac/documentation/DeveloperTools/Conceptual/MachORuntime/index.html

The 1,mach-o format can contain executable code for multiple target platforms, such as executable code that contains both arm64 and ARM7.

When you build an iOS application with a multi-target platform, drag it into Ida, as shown in:

Ida recognizes the code for both architectures.

Let Ida load the code for the ARM7 platform first

Place the mouse over the red circle. You can see the magic number of the Mach-o file in the hex window on the right. Show magic number at file offset 4000 in the lower-left corner of the position

Then open the Segment window to view the layout of the file mapped to memory

　

From the IDA Segment window, you can see clearly how the various sections of each executable file are loaded. The executable file is mapped from a file offset of 4000 to memory (starting at 0).

Mach-o file format