X86 Disassembly/macOS

Mach-O format overview macOS (Previously OS X) uses the Mach-O file format to encode executables, object files, and shared libraries (.dylib files). Here, we will be looking at the 64-bit version of the Mach-O format. The majority of data in Mach-O files are 'segments' and 'sections', where Segments are containers for Sections, and store information about each Section. The Sections themselves are containers for data. Mach-O files have five primary structures: +StructureDescriptionHeaderContains information about the purpose, and size of the file's structuresLoad CommandsDeclaration of all Segments and SectionsDataThe actual contents of the file (e.g. Data section, Text section).Symbol tableSays where each symbol is located in the fileString tableContains the name of each symbol Note that when each Structure is gone over, they are all an unbroken sequence of bytes, and there is no empty space between them. Header Information The header is the very first thing in the file, and it has 8 unsigned 32-bit integers: +NamePurposeEndiannessTypical ValueMagic NumberThe File's magic numberBig-Endian0xFEEDFACF for 64-bit architectureCPU TypeThe Intended CPU type for the executableLittle-Endian0x01000007 for x86_64CPU subtypeThe specific kind of CPU usedLittle-Endian0x00000003 for all x64 CPUsFile typeThe purpose of the fileLittle-Endian0x00000001 for object file, 0x00000002 for executableNumber of Load CommandsThe quantity of Load commands (does not include section headers)Little-EndianVariableSize of Load CommandsThe number of bytes occupied by the Load CommandsLittle-EndianVariableFlagsExtra file informationLittle-Endian0x00000000ReservedNo practical useLittle-Endian0x00000000