macho

debug.macho reads 64-bit Mach-O headers and LC_SEGMENT_64 section metadata on any host platform. Both little-endian and big-endian files are supported.

import debug.macho
import os

data := os.read_bytes('app')!
f := macho.new_file(data)!
println(f.header.cpu_type)
for s in f.sections {
    println(s.name)
}

new_file returns an error if the header, load command area, command count, command sizes, or section tables are truncated or inconsistent. It reads section names and segment names from each section header and preserves section order. Numeric fields use host byte order; header.magic is always magic_64. Unknown load commands are skipped after their size and alignment are checked.

This is a metadata reader, not a complete executable validator. Section contents, symbols, relocations, and the contents of other load commands are not decoded or validated. Fat/universal binaries and 32-bit Mach-O files are not supported, even though their magic constants are available for identification.

See Apple's Mach-O definitions for the header layout.

fn new_file(data []u8) !File

new_file parses a 64-bit Mach-O file in either byte order from data. Invalid or truncated load commands return an error. Section contents are not decoded or validated. Fat binaries and 32-bit Mach-O files are not supported.

struct File {
pub:
	header   Header
	sections []Section
}

File contains the header and section metadata of a 64-bit Mach-O file.

struct Header {
pub:
	magic       u32
	cpu_type    i32
	cpu_subtype i32
	file_type   u32
	num_cmds    u32
	size_cmds   u32
	flags       u32
}

Header contains the fields of a 64-bit Mach-O header, in host byte order.

struct Section {
pub:
	name    string
	segname string
	addr    u64
	size    u64
	offset  u32
}

Section describes a section from an LC_SEGMENT_64 command.