topic   Reverse Engineering / Binary Analysis / Apple Platforms
date    2026-03-17
source  Binary Packer project + objdump analysis of Hello World binaries

[context]

While building the Binary Packer I had to understand how executables are structured at the byte level — ELF on Linux, Mach-O on macOS. I compiled a simple Hello World in C and disassembled it on both to see what differs.

[understood]

A Mach-O file is structured like a sandwich: a Header (identity card), Load Commands (the roadmap for dyld), and a Data area (the actual bytes). The magic number tells you everything upfront — 0xFEEDFACE = 32-bit, 0xFEEDFACF = 64-bit, 0xCAFEBABE = fat binary.

ELF and Mach-O solve the same problem differently. ELF uses Program Headers plus Section Headers. Mach-O uses Load Commands that tell dyld exactly how to map each segment.

[diff: before..after]

before  I thought macOS just "ran" binaries like Linux does, same idea.
after   The loader (dyld vs ld-linux.so) and the format are deeply
        different. LC_MAIN and LC_LOAD_DYLIB are richer and more explicit
        than ELF's e_entry + PT_INTERP. Code signing is baked in
        (LC_CODE_SIGNATURE).

[proof_of_concept]

                MACH-O (macOS)              ELF (Linux)
magic           0xFEEDFACF (64-bit)         \x7fELF
text segment    LC_SEGMENT_64 __TEXT r-x    PT_LOAD (text)  r-x
data segment    LC_SEGMENT_64 __DATA rw-    PT_LOAD (data)  rw-
entry point     LC_MAIN                     e_entry
dynamic lib     LC_LOAD_DYLIB libSystem     PT_INTERP ld-linux.so
linker          dyld                        ld-linux.so

ARM64 call to printf (Mach-O):
  adrp x0, 0x100000000   ; load string page
  add  x0, x0, #0x48c    ; add offset → "Hello World"
  bl   0x100000480       ; branch to printf stub

[refs]

man dyld / man ld
otool -l <binary>    # dump load commands on macOS
objdump -D <binary>  # full disassembly
readelf -a <binary>  # ELF equivalent
github.com/aidansteele/osx-abi-macho-file-format-reference

topic   Topic (Reverse Engineering, Web, Crypto, Mindset...)
date    YYYY-MM-DD
source  Where did you encounter this?

[context]

Where were you, what were you doing when this clicked?

[understood]

Explain the concept in your own words.

[diff: before..after]

before  What did you think or assume before?
after   What do you now understand that you didn't?

[proof_of_concept]

# code snippet, command, payload, diagram or analogy

[refs]

- https://...