Mach-O

Mach-O
Name	Mach-O
Developer	Apple Inc., NeXT
Introduced	1995
Type	Executable file format
Operating system	macOS, iOS, iPadOS, watchOS, tvOS, NeXTSTEP

Mach-O Mach-O is a binary executable and object file format used primarily on Apple platforms. It defines how Apple Inc. and NeXT operating systems load, link, and execute code for platforms such as macOS, iOS, iPadOS, watchOS, and tvOS. Implementations interact with kernel components like the XNU kernel, userland tools from Darwin, and development ecosystems including Xcode, Clang, and LLVM.

Overview

Mach-O originated from designs by Mach and the NeXTSTEP project led by Steve Jobs after he left Apple Inc. in the 1980s. It replaced formats such as a.out in many Unix-like systems and was adopted into Darwin when Apple acquired NeXT. The format integrates with system services like the dyld runtime, the Bootstrap protocol, and features used by Grand Central Dispatch and Objective-C runtime on Apple platforms.

File format and structure

A Mach-O file begins with a header followed by load commands, segments, sections, and tables. The header contains CPU information for architectures such as x86-64, ARM64, and legacy PowerPC which influenced choices during transitions like the Apple silicon migration. Fat or universal binaries bundle multiple architecture-specific Mach-O slices in a single file, a technique used during transitions between PowerPC, Intel, and ARM CPU families. Mach-O supports object modules, executable files, dynamic libraries, and kernel extensions used in macOS development.

Load commands and headers

Load commands in Mach-O tell the loader how to map segments, resolve symbols, and set runtime parameters. Important load commands include those specifying entry points, segment mappings, and dynamic linking information used by dyld. Headers encode flags for CPU types such as x86_64 and instruction set attributes recognized by compilers like GCC and Clang. Load commands interoperate with build systems like Xcodebuild, CMake, and Make and influence code signing mechanisms tied to Apple Developer provisioning profiles and Code Signing policies.

Segments, sections, and symbol table

Segments in Mach-O (e.g., __TEXT, __DATA) contain sections used by linkers and debuggers such as lldb. Sections store code, read-only data, and relocations; the symbol table and dynamic symbol tables provide names resolved at link time or runtime by dyld. Debugging and analysis tools like DTrace, Instruments, and AddressSanitizer examine section contents; linkers such as ld64 and GNU ld manage symbol mangling conventions also used by languages and runtimes like Objective-C and Swift.

Dynamic linking and shared libraries

Mach-O supports dynamic libraries (.dylib), dynamically linked shared libraries (.so equivalents), and frameworks used by Cocoa and Cocoa Touch. The dynamic loader dyld resolves dependencies, applies rebasing and binding, and supports lazy and immediate symbol resolution strategies used by system frameworks like Foundation, UIKit, and CoreFoundation. Runtime interposition and symbols are relevant to technologies such as dyld_shared_cache, rpath, and @rpath linking, which are manipulated by build tools and package managers like Homebrew and MacPorts.

Tools and utilities

Developers and analysts use tools to inspect and manipulate Mach-O files: otool for disassembly and load commands, nm for symbol tables, strip to remove symbols, and install_name_tool to change dynamic library references. Binary analysis and reverse engineering communities employ utilities like Hopper Disassembler, IDA Pro, and Ghidra alongside debuggers such as LLDB and GDB (limited on Apple platforms). Build environments integrate Mach-O handling through Xcode, GNU Make, CMake, and language-specific toolchains like Swift Package Manager and Carthage.

History and platform usage

Mach-O emerged from Mach and NeXTSTEP innovations and became central when Apple Inc. transitioned macOS from classic and Mac OS X origins to modern Darwin releases. Over time Mach-O adapted to support PowerPC to Intel (Rosetta) transitions and later the Intel to Apple silicon migration, with tooling updates across Xcode and Clang to handle fat binaries and new ABIs. Its evolution touches communities around open-source, commercial vendors like Apple Inc. and projects including DarwinPorts and Homebrew, and influenced executable formats in other operating systems during the 1990s and 2000s.

Category:Executable file formats