Mach-O File Format

Mach-O is the executable format of macOS, iOS, watchOS, tvOS and visionOS: executables, dylibs, frameworks, bundles, kernel extensions, the kernel itself, and object files. This page describes the headers and load commands with their offsets, how chained fixups and code signatures are stored, and annotates every byte of a real arm64 executable.

All formats
Layout
Annotated sample
Universal binaries
Header
Load commands
Segments and sections
Symbols
Chained fixups
Code signature
Tools

Layout

File

mach_header_64

Load commands (LC_SEGMENT_64 + section_64, LC_MAIN, LC_LOAD_DYLIB...)

__TEXT segment data (starts at offset 0: includes the headers)

__DATA_CONST, __DATA

__LINKEDIT (fixups, exports, symbols, strings)

Code signature (end of __LINKEDIT)

Memory (sample)

__PAGEZERO ---0 – 4 GiB, no access: catches NULL and truncated pointers

__TEXT r-xheaders, code, stubs, constants

__DATA_CONST rw- → r--GOT, read-only after fixups

__DATA rw-writable data (absent in the sample)

__LINKEDIT r--raw data used by dyld and the kernel

Everything is described by load commands: there is no section header table and no program header table. Segments are mapped page by page (16 KiB on arm64), ASLR slides the whole image.

Annotated sample (33360 bytes, arm64)

A real executable built by clang -arch arm64 -Os from int main(void) { puts("Hello, Mach-O!"); return 0; }, linked against libSystem and ad-hoc signed. Every byte is described; zero padding is folded.

Segment	vmaddr	vmsize	fileoff	filesize	initprot
__PAGEZERO	0x0	0x100000000	0x0	0x0	---
__TEXT	0x100000000	0x4000	0x0	0x4000	r-x
__DATA_CONST	0x100004000	0x4000	0x4000	0x4000	rw-
__LINKEDIT	0x100008000	0x4000	0x8000	0x250	r--

0x0mach_header_64magic, cputype, ncmds32 B

0x20Load commands17 commands, segments and their sections1.0 KiB

0x438Paddingroom for more load commands40 B

0x460__TEXT sections__text, __stubs, __cstring, __unwind_info14.9 KiB

0x4000__DATA_CONST__got16.0 KiB

0x8000__LINKEDITfixups, exports, symbols, strings256 B

0x8100Code signatureSuperBlob, CodeDirectory, page hashes336 B

00000000cffaedfe0c0000010000000002000000................

0000001011000000180400008500200000000000.......... .....

0000002019000000480000005f5f504147455a45....H...__PAGEZE

00000030524f0000000000000000000000000000RO..............

0000004000000000010000000000000000000000................

0000005000000000000000000000000000000000................

0000006000000000000000001900000088010000................

000000705f5f5445585400000000000000000000__TEXT..........

0000008000000000010000000040000000000000.........@......

0000009000000000000000000040000000000000.........@......

000000a005000000050000000400000000000000................

000000b05f5f7465787400000000000000000000__text..........

000000c05f5f5445585400000000000000000000__TEXT..........

000000d060040000010000002000000000000000`....... .......

000000e060040000020000000000000000000000`...............

000000f000040080000000000000000000000000................

000001005f5f7374756273000000000000000000__stubs.........

000001105f5f5445585400000000000000000000__TEXT..........

0000012080040000010000000c00000000000000................

0000013080040000020000000000000000000000................

0000014008040080000000000c00000000000000................

000001505f5f63737472696e6700000000000000__cstring.......

000001605f5f5445585400000000000000000000__TEXT..........

000001708c040000010000000f00000000000000................

000001808c040000000000000000000000000000................

0000019002000000000000000000000000000000................

000001a05f5f756e77696e645f696e666f000000__unwind_info...

000001b05f5f5445585400000000000000000000__TEXT..........

000001c09c040000010000005800000000000000........X.......

000001d09c040000020000000000000000000000................

000001e000000000000000000000000000000000................

000001f019000000980000005f5f444154415f43........__DATA_C

000002004f4e5354000000000040000001000000ONST.....@......

0000021000400000000000000040000000000000.@.......@......

0000022000400000000000000300000003000000.@..............

0000023001000000100000005f5f676f74000000........__got...

0000024000000000000000005f5f444154415f43........__DATA_C

000002504f4e5354000000000040000001000000ONST.....@......

0000026008000000000000000040000003000000.........@......

0000027000000000000000000600000001000000................

0000028000000000000000001900000048000000............H...

000002905f5f4c494e4b45444954000000000000__LINKEDIT......

000002a000800000010000000040000000000000.........@......

000002b000800000000000005002000000000000........P.......

000002c001000000010000000000000000000000................

000002d0340000801000000000800000600000004...........`...

000002e0330000801000000060800000300000003.......`...0...

000002f002000000180000009880000003000000................

00000300d0800000280000000b00000050000000....(.......P...

0000031000000000000000000000000002000000................

0000032002000000010000000000000000000000................

0000033000000000000000000000000000000000................

00000340c8800000020000000000000000000000................

0000035000000000000000000e00000020000000............ ...

000003600c0000002f7573722f6c69622f64796c..../usr/lib/dyl

0000037064000000000000001b00000018000000d...............

00000380b2e757fca87032899510ad46484c798d..W..p2....FHLy.

000003902a000000100000000000000000000000*...............

000003a028000080180000006004000000000000(.......`.......

000003b000000000000000000c00000038000000............8...

000003c0180000000200000000004c0500000100..........L.....

000003d02f7573722f6c69622f6c696253797374/usr/lib/libSyst

000003e0656d2e422e64796c6962000000000000em.B.dylib......

000003f026000000100000009080000008000000&...............

0000040029000000100000009880000000000000)...............

000004101d000000100000000081000050010000............P...

0000042032000000180000000100000000000e002...............

0000043000051a00000000000000000000000000................

00000440… 0x20 zero bytes …

00000460fd7bbfa9fd0300910000009000301291.{...........0..

000004700400009400008052fd7bc1a8c0035fd6.......R.{...._.

0000048030000090100240f900021fd648656c6c0.....@.....Hell

000004906f2c204d6163682d4f21000001000000o, Mach-O!......

000004a01c000000000000001c00000000000000................

000004b01c000000020000006004000040000000........`...@...

000004c040000000810400000000000040000000@...........@...

000004d000000000000000000000000003000000................

000004e00c000100100001000000000000000004................

000004f000000000000000000000000000000000................

00000500… 0x3b00 zero bytes …

0000400000000000000000800000000000000000................

00004010… 0x3ff0 zero bytes …

0000800000000000200000005000000054000000.... ...P...T...

0000801001000000010000000000000000000000................

0000802004000000000000000000000018000000................

0000803000000000000000001800000000400600.............@..

0000804000400000000000000000000001000000.@..............

0000805001020000005f70757473000000000000....._puts......

0000806000015f001200000000020000000300e0.._.............

00008070080000025f6d685f657865637574655f...._mh_execute_

0000808068656164657200096d61696e000d0000header..main....

00008090e008000000000000020000000f011000................

000080a00000000001000000160000000f010000................

000080b060040000010000001c00000001000001`...............

000080c000000000000000000200000002000000................

000080d020005f5f6d685f657865637574655f68 .__mh_execute_h

000080e06561646572005f6d61696e005f707574eader._main._put

000080f073000000000000000000000000000000s...............

00008100fade0cc00000013c0000000300000000.......<........

0000811000000024000000020000012800010000...$.......(....

0000812000000134fade0c020000010400020400...4............

0000813000000002000000a40000005800000002...........X....

0000814000000003000081002002000e00000000........ .......

0000815000000000000000000000000000000000................

0000816000000000000000000000000000000000................

0000817000004000000000000000000168656c6c..@.........hell

000081806f2d61726d363400987920904eab650eo-arm64..y .N.e.

0000819075788c054aa0b0524e6a80bfc71aa32dux..J..RNj.....-

000081a0f8d237a61743f9860000000000000000..7..C..........

000081b000000000000000000000000000000000................

000081c00000000000000000f8be42393d9a93c3..........B9=...

000081d0918811685da155a4260d467123095684...h].U.&.Fq#.V.

000081e010a0494da4d0bcb41e3cfc661d24698c..IM.....<.f.$i.

000081f0a0cf3ab977bfd120b518e20f23488ddb..:.w.. ....#H..

0000820057eaabdaf790395b0126b7f76edb5e99W.....9[.&..n.^.

00008210dc0a654b9d549829398a5f12e16d94eb..eK.T.)9._..m..

00008220534d61a2ce1e3f41fade0c010000000cSMa...?A........

0000823000000000fade0b01000000082ca7ad7f............,...

00008240acb2586fc6e966c004d7d1d16b024f58..Xo..f.....k.OX

Hover a byte or a field to see what it is. Click to pin it.

mach_header_64 0x0

magicMH_MAGIC_64
cputypeCPU_TYPE_ARM64
cpusubtypeCPU_SUBTYPE_ARM64_ALL
filetypeMH_EXECUTE
ncmds0x11
sizeofcmds0x418
flagsMH_NOUNDEFS | MH_DYL…
reserved0

Load command 0: LC_SEGMENT_64 __PAGEZERO 0x20

cmdLC_SEGMENT_64
cmdsize0x48
segname"__PAGEZERO"
vmaddr0
vmsize0x100000000
fileoff0
filesize0
maxprot---
initprot---
nsects0
flags0

Load command 1: LC_SEGMENT_64 __TEXT 0x68

cmdLC_SEGMENT_64
cmdsize0x188
segname"__TEXT"
vmaddr0x100000000
vmsize0x4000
fileoff0
filesize0x4000
maxprotr-x
initprotr-x
nsects4
flags0

Load command 1: LC_SEGMENT_64 __TEXT / section_64 __text 0xb0

sectname"__text"
segname"__TEXT"
addr0x100000460
size0x20
offset0x460
align2^2
reloff0
nreloc0
flagsS_REGULAR | S_ATTR_P…
reserved10
reserved20
reserved30

Load command 1: LC_SEGMENT_64 __TEXT / section_64 __stubs 0x100

sectname"__stubs"
segname"__TEXT"
addr0x100000480
size0xc
offset0x480
align2^2
reloff0
nreloc0
flagsS_SYMBOL_STUBS | S_A…
reserved10
reserved20xc
reserved30

Load command 1: LC_SEGMENT_64 __TEXT / section_64 __cstring 0x150

sectname"__cstring"
segname"__TEXT"
addr0x10000048c
size0xf
offset0x48c
align2^0
reloff0
nreloc0
flagsS_CSTRING_LITERALS
reserved10
reserved20
reserved30

Load command 1: LC_SEGMENT_64 __TEXT / section_64 __unwind_info 0x1a0

sectname"__unwind_info"
segname"__TEXT"
addr0x10000049c
size0x58
offset0x49c
align2^2
reloff0
nreloc0
flagsS_REGULAR
reserved10
reserved20
reserved30

Load command 2: LC_SEGMENT_64 __DATA_CONST 0x1f0

cmdLC_SEGMENT_64
cmdsize0x98
segname"__DATA_CONST"
vmaddr0x100004000
vmsize0x4000
fileoff0x4000
filesize0x4000
maxprotrw-
initprotrw-
nsects1
flagsSG_READ_ONLY

Load command 2: LC_SEGMENT_64 __DATA_CONST / section_64 __got 0x238

sectname"__got"
segname"__DATA_CONST"
addr0x100004000
size8
offset0x4000
align2^3
reloff0
nreloc0
flagsS_NON_LAZY_SYMBOL_PO…
reserved11
reserved20
reserved30

Load command 3: LC_SEGMENT_64 __LINKEDIT 0x288

cmdLC_SEGMENT_64
cmdsize0x48
segname"__LINKEDIT"
vmaddr0x100008000
vmsize0x4000
fileoff0x8000
filesize0x250
maxprotr--
initprotr--
nsects0
flags0

Load command 4: LC_DYLD_CHAINED_FIXUPS 0x2d0

cmdLC_DYLD_CHAINED_FIXUPS
cmdsize0x10
dataoff0x8000
datasize0x60

Load command 5: LC_DYLD_EXPORTS_TRIE 0x2e0

cmdLC_DYLD_EXPORTS_TRIE
cmdsize0x10
dataoff0x8060
datasize0x30

Load command 6: LC_SYMTAB 0x2f0

cmdLC_SYMTAB
cmdsize0x18
symoff0x8098
nsyms3
stroff0x80d0
strsize0x28

Load command 7: LC_DYSYMTAB 0x308

cmdLC_DYSYMTAB
cmdsize0x50
ilocalsym0
nlocalsym0
iextdefsym0
nextdefsym2
iundefsym2
nundefsym1
tocoff0
ntoc0
modtaboff0
nmodtab0
extrefsymoff0
nextrefsyms0
indirectsymoff0x80c8
nindirectsyms2
extreloff0
nextrel0
locreloff0
nlocrel0

Load command 8: LC_LOAD_DYLINKER 0x358

cmdLC_LOAD_DYLINKER
cmdsize0x20
name0xc
path"/usr/lib/dyld"

Load command 9: LC_UUID 0x378

cmdLC_UUID
cmdsize0x18
uuidB2E757FCA87032899510…

Load command 10: LC_SOURCE_VERSION 0x390

cmdLC_SOURCE_VERSION
cmdsize0x10
version0

Load command 11: LC_MAIN 0x3a0

cmdLC_MAIN
cmdsize0x18
entryoff0x460
stacksize0

Load command 12: LC_LOAD_DYLIB 0x3b8

cmdLC_LOAD_DYLIB
cmdsize0x38
dylib.name0x18
dylib.timestamp2
dylib.current_version1356.0.0
dylib.compatibility_version1.0.0
path"/usr/lib/libSystem.…

Load command 13: LC_FUNCTION_STARTS 0x3f0

cmdLC_FUNCTION_STARTS
cmdsize0x10
dataoff0x8090
datasize8

Load command 14: LC_DATA_IN_CODE 0x400

cmdLC_DATA_IN_CODE
cmdsize0x10
dataoff0x8098
datasize0

Load command 15: LC_CODE_SIGNATURE 0x410

cmdLC_CODE_SIGNATURE
cmdsize0x10
dataoff0x8100
datasize0x150

Load command 16: LC_BUILD_VERSION 0x420

cmdLC_BUILD_VERSION
cmdsize0x18
platformPLATFORM_MACOS
minos14.0.0
sdk26.5.0
ntools0

Padding 0x438

paddingzeros

__TEXT,__text 0x460

stpstp x29, x30, [sp, #…
movmov x29, sp
adrpadrp x0, 0x100000000
addadd x0, x0, #0x48c
blbl 0x100000480
movmov w0, #0x0
ldpldp x29, x30, [sp], …
retret

__TEXT,__stubs 0x480

adrpadrp x16, 0x100004000
ldrldr x16, [x16]
brbr x16

__TEXT,__cstring 0x48c

string"Hello, Mach-O!"

Padding 0x49b

paddingzeros

__TEXT,__unwind_info 0x49c

__unwind_info

Padding 0x4f4

paddingzeros

__DATA_CONST,__got 0x4000

slot 0bind ordinal 0, next 0

Padding 0x4008

paddingzeros

Chained fixups: header 0x8000

fixups_version0
starts_offset0x20
imports_offset0x50
symbols_offset0x54
imports_count1
imports_format1
symbols_format0

Padding 0x801c

paddingzeros

Chained fixups: starts_in_image 0x8020

seg_count4
seg_info_offset[0]0 (__PAGEZERO)
seg_info_offset[1]0 (__TEXT)
seg_info_offset[2]24 (__DATA_CONST)
seg_info_offset[3]0 (__LINKEDIT)

Padding 0x8034

paddingzeros

Chained fixups: starts_in_segment __DATA_CONST 0x8038

size0x18
page_size0x4000
pointer_formatDYLD_CHAINED_PTR_64_…
segment_offset0x4000
max_valid_pointer0
page_count1
page_start[0]0x0

Chained fixups: imports 0x8050

import 0lib 1, weak 0, name …

Padding 0x8054

paddingzeros

Chained fixups: symbols 0x8055

name"_puts"

Padding 0x805b

paddingzeros

Exports trie 0x8060

trie

Function starts 0x8090

ULEB128 deltas

Symbol 0 __mh_execute_header 0x8098

n_strx2 → "__mh_execute_he…
n_typeN_SECT | N_EXT
n_sect1
n_desc0x10
n_value0x100000000

Symbol 1 _main 0x80a8

n_strx22 → "_main"
n_typeN_SECT | N_EXT
n_sect1
n_desc0
n_value0x100000460

Symbol 2 _puts 0x80b8

n_strx28 → "_puts"
n_typeN_UNDF | N_EXT
n_sect0
n_desclibrary ordinal 1
n_value0

Indirect symbol table 0x80c8

entry 02
entry 12

String table 0x80d0

strings[0]" "

Padding 0x80d1

paddingzeros

String table 0x80d2

name"__mh_execute_header"
name"_main"
name"_puts"

Padding 0x80f2

paddingzeros

Code signature: CS_SuperBlob 0x8100

magic0xfade0cc0
length0x13c
count0x3

Code signature: CS_BlobIndex 0 0x810c

typeCSSLOT_CODEDIRECTORY
offset0x24

Code signature: CS_BlobIndex 1 0x8114

typeCSSLOT_REQUIREMENTS
offset0x128

Code signature: CS_BlobIndex 2 0x811c

typeCSSLOT_SIGNATURESLOT
offset0x134

Code signature: CS_CodeDirectory 0x8124

magicCSMAGIC_CODEDIRECTORY
length0x104
version0x20400
flagsCS_ADHOC
hashOffset0xa4
identOffset0x58
nSpecialSlots2
nCodeSlots3
codeLimit0x8100
hashSize0x20
hashTypeSHA-256
platform0
pageSize0xe
spare20
scatterOffset0
teamOffset0
spare30
codeLimit640
execSegBase0
execSegLimit0x4000
execSegFlags1
identifier"hello-arm64"

Code signature: special slots 0x8188

slot -2987920904eab650e…
slot -10000000000000000…

Code signature: page hashes 0x81c8

page 0f8be42393d9a93c3…
page 11e3cfc661d24698c…
page 20126b7f76edb5e99…

Code signature: blob 0xfade0c01 0x8228

blob

Code signature: blob 0xfade0b01 0x8234

blob

Padding 0x823c

padding20 bytes

Universal (fat) binaries

A universal file starts with a fat_header and an array of fat_arch; each entry points to a complete thin Mach-O (x86_64, arm64, arm64e...). The kernel and dyld pick the best slice.

fat_header 8 (0x8) bytes

Field	Offset	Size	Type	Meaning
`magic`	0x00	4	uint32_t	`FAT_MAGIC` `0xcafebabe` or `FAT_MAGIC_64` `0xcafebabf`.
`nfat_arch`	0x04	4	uint32_t	Number of architectures that follow.

All the fat structures are big endian. 0xcafebabe is also the magic of Java class files: tools tell them apart with nfat_arch, which is small for Mach-O.

fat_arch / fat_arch_64 20 (0x14) bytes / 32 (0x20) bytes

Field	Off. fat_arch	Off. fat_arch_64	Size fat_arch	Size fat_arch_64	Type	Meaning
`cputype`	0x00	0x00	4	4	cpu_type_t	CPU type of this slice.
`cpusubtype`	0x04	0x04	4	4	cpu_subtype_t	CPU subtype.
`offset`	0x08	0x08	4	8	uint32_t / uint64_t	File offset of the thin Mach-O.
`size`	0x0c	0x10	4	8	uint32_t / uint64_t	Size of the slice.
`align`	0x10	0x18	4	4	uint32_t	Alignment as a power of 2 (14 = 16 KiB).
`reserved`	—	0x1c	—	4	uint32_t	Reserved.

Magic numbers

Name	Value	Meaning
MH_MAGIC	0xfeedface	32-bit, native byte order.
MH_CIGAM	0xcefaedfe	32-bit, swapped.
MH_MAGIC_64	0xfeedfacf	64-bit, native byte order. Read as bytes `cf fa ed fe` in little-endian files.
MH_CIGAM_64	0xcffaedfe	64-bit, swapped.
FAT_MAGIC	0xcafebabe	Universal binary, 32-bit offsets.
FAT_CIGAM	0xbebafeca	Universal, as read on a little-endian machine.
FAT_MAGIC_64	0xcafebabf	Universal binary, 64-bit offsets.

Header

mach_header / mach_header_64 28 (0x1c) bytes / 32 (0x20) bytes

Field	Off. 32	Off. 64	Size 32	Size 64	Type	Meaning
`magic`	0x00	0x00	4	4	uint32_t	`MH_MAGIC` `0xfeedface` (32-bit) or `MH_MAGIC_64` `0xfeedfacf` (64-bit), in the file's byte order.
`cputype`	0x04	0x04	4	4	cpu_type_t	CPU type: `CPU_TYPE_ARM64`, `CPU_TYPE_X86_64`...
`cpusubtype`	0x08	0x08	4	4	cpu_subtype_t	CPU subtype; the top byte holds capability bits such as `CPU_SUBTYPE_PTRAUTH_ABI`.
`filetype`	0x0c	0x0c	4	4	uint32_t	File type: `MH_EXECUTE`, `MH_DYLIB`, `MH_BUNDLE`, `MH_OBJECT`...
`ncmds`	0x10	0x10	4	4	uint32_t	Number of load commands.
`sizeofcmds`	0x14	0x14	4	4	uint32_t	Total size of the load commands, which follow the header.
`flags`	0x18	0x18	4	4	uint32_t	Flags (`MH_PIE`, `MH_DYLDLINK`, `MH_TWOLEVEL`...).
`reserved`	—	0x1c	—	4	uint32_t	Reserved (64-bit only), 0.

cputype

Name	Value	Meaning
CPU_ARCH_ABI64	0x1000000	Flag: 64-bit ABI.
CPU_ARCH_ABI64_32	0x2000000	Flag: 64-bit hardware with 32-bit pointers (arm64_32, watchOS).
CPU_TYPE_X86	7	i386.
CPU_TYPE_X86_64	0x1000007	x86-64.
CPU_TYPE_ARM	0xc	32-bit ARM.
CPU_TYPE_ARM64	0x100000c	arm64.
CPU_TYPE_ARM64_32	0x200000c	arm64_32.
CPU_TYPE_POWERPC	0x12	PowerPC.
CPU_TYPE_POWERPC64	0x1000012	PowerPC 64-bit.

cpusubtype

Name	Value	Meaning
CPU_SUBTYPE_X86_64_ALL	3	Any x86-64.
CPU_SUBTYPE_X86_64_H	8	x86-64h (Haswell and later).
CPU_SUBTYPE_ARM64_ALL	0	Any arm64.
CPU_SUBTYPE_ARM64_V8	1	ARMv8.
CPU_SUBTYPE_ARM64E	2	arm64e: pointer authentication (system binaries).
CPU_SUBTYPE_PTRAUTH_ABI	0x80000000	Flag on arm64e: versioned pointer authentication ABI.
CPU_SUBTYPE_LIB64	0x80000000	Flag: 64-bit library (old meaning of the same bit).

filetype

Name	Value	Meaning
MH_OBJECT	1	Relocatable object file (`.o`).
MH_EXECUTE	2	Executable.
MH_FVMLIB	3	Fixed VM shared library (obsolete).
MH_CORE	4	Core dump.
MH_PRELOAD	5	Preloaded executable (firmware).
MH_DYLIB	6	Dynamic library (`.dylib`, framework binary).
MH_DYLINKER	7	The dynamic linker (`/usr/lib/dyld`).
MH_BUNDLE	8	Plug-in loaded with `dlopen` (`.bundle`).
MH_DYLIB_STUB	9	Stub library (symbols only).
MH_DSYM	0xa	Companion debug file (`.dSYM`).
MH_KEXT_BUNDLE	0xb	Kernel extension.
MH_FILESET	0xc	Set of Mach-O files (kernel collections).

flags

Name	Value	Meaning
MH_NOUNDEFS	1	No undefined references.
MH_INCRLINK	2	Incremental link output.
MH_DYLDLINK	4	Input to dyld; cannot be statically linked again.
MH_BINDATLOAD	8	Bind undefined references at load.
MH_PREBOUND	0x10	Prebound (obsolete).
MH_TWOLEVEL	0x80	Two-level namespace: each import names its library.
MH_WEAK_DEFINES	0x8000	Contains weak definitions.
MH_BINDS_TO_WEAK	0x10000	Uses weak symbols.
MH_ALLOW_STACK_EXECUTION	0x20000	Executable stack.
MH_PIE	0x200000	Position independent: load at a random address (ASLR).
MH_HAS_TLV_DESCRIPTORS	0x800000	Has thread-local variables.
MH_NO_HEAP_EXECUTION	0x1000000	Non-executable heap.
MH_APP_EXTENSION_SAFE	0x2000000	Safe for app extensions.
MH_SIM_SUPPORT	0x8000000	Built for the simulator.
MH_DYLIB_IN_CACHE	0x80000000	Part of the dyld shared cache.

Load commands

ncmds commands follow the header, sizeofcmds bytes in total. All start with cmd and cmdsize; the next command is at cmd + cmdsize.

load_command 8 (0x8) bytes

Field	Offset	Size	Type	Meaning
`cmd`	0x00	4	uint32_t	Command type (`LC_*`). Bit `LC_REQ_DYLD` (0x80000000) means dyld must understand it to load the file.
`cmdsize`	0x04	4	uint32_t	Size of the command including its trailing data (strings, sections), multiple of 8 in 64-bit files.

Command	Value	Structure	Meaning
LC_REQ_DYLD	0x80000000	—	Flag bit: dyld must understand the command or refuse to load the file.
LC_SEGMENT	0x1	segment_command	32-bit segment.
LC_SYMTAB	0x2	symtab_command	Symbol table and string table.
LC_UNIXTHREAD	0x5	thread_command	Initial thread state (entry point of static executables and dyld).
LC_DYSYMTAB	0xb	dysymtab_command	Symbol table groups and indirect symbols.
LC_LOAD_DYLIB	0xc	dylib_command	Library to load.
LC_ID_DYLIB	0xd	dylib_command	Install name of this library.
LC_LOAD_DYLINKER	0xe	dylinker_command	Path of the dynamic linker.
LC_ID_DYLINKER	0xf	dylinker_command	Name of this dynamic linker.
LC_LOAD_WEAK_DYLIB	0x80000018	dylib_command	Library that may be missing.
LC_SEGMENT_64	0x19	segment_command_64	64-bit segment.
LC_UUID	0x1b	uuid_command	Build UUID.
LC_RPATH	0x8000001c	rpath_command	Run-path search directory for `@rpath`.
LC_CODE_SIGNATURE	0x1d	linkedit_data_command	Code signature.
LC_REEXPORT_DYLIB	0x8000001f	dylib_command	Library whose symbols are re-exported.
LC_ENCRYPTION_INFO_64	0x2c	encryption_info_command_64	Encrypted range (App Store FairPlay); `cryptid` != 0 when encrypted.
LC_DYLD_INFO_ONLY	0x80000022	dyld_info_command	Compressed rebase/bind opcodes (before chained fixups).
LC_FUNCTION_STARTS	0x26	linkedit_data_command	ULEB128 deltas of function start addresses.
LC_MAIN	0x80000028	entry_point_command	Entry point (offset of main).
LC_DATA_IN_CODE	0x29	linkedit_data_command	Data ranges inside code (jump tables).
LC_SOURCE_VERSION	0x2a	source_version_command	Source version.
LC_LINKER_OPTION	0x2d	linker_option_command	Linker options in object files (auto-linking).
LC_BUILD_VERSION	0x32	build_version_command	Platform, minimum OS and SDK versions.
LC_DYLD_EXPORTS_TRIE	0x80000033	linkedit_data_command	Exported symbols as a trie.
LC_DYLD_CHAINED_FIXUPS	0x80000034	linkedit_data_command	Rebases and binds as chains of pointers.
LC_FILESET_ENTRY	0x80000035	fileset_entry_command	Mach-O embedded in an MH_FILESET.

segment_command / segment_command_64 56 (0x38) bytes / 72 (0x48) bytes

Field	Off. 32	Off. 64	Size 32	Size 64	Type	Meaning
`cmd`	0x00	0x00	4	4	uint32_t	`LC_SEGMENT` (0x1) / `LC_SEGMENT_64` (0x19).
`cmdsize`	0x04	0x04	4	4	uint32_t	`sizeof(segment_command_64) + nsects * sizeof(section_64)`.
`segname`	0x08	0x08	16	16	char[16]	Segment name: `__TEXT`, `__DATA`...
`vmaddr`	0x18	0x18	4	8	ADDR	Virtual address (before ASLR slide).
`vmsize`	0x1c	0x20	4	8	ADDR	Size in memory; the excess over filesize is zero-filled.
`fileoff`	0x20	0x28	4	8	ADDR	File offset of the content.
`filesize`	0x24	0x30	4	8	ADDR	Bytes mapped from the file.
`maxprot`	0x28	0x38	4	4	vm_prot_t	Maximum protection (`VM_PROT_READ` 1, `WRITE` 2, `EXECUTE` 4).
`initprot`	0x2c	0x3c	4	4	vm_prot_t	Initial protection.
`nsects`	0x30	0x40	4	4	uint32_t	Number of `section_64` structures that follow this command.
`flags`	0x34	0x44	4	4	uint32_t	Flags: `SG_READ_ONLY` (0x10) for `__DATA_CONST`, made read-only after fixups.

maxprot / initprot

Name	Value	Meaning
VM_PROT_NONE	0	No access.
VM_PROT_READ	1	Read.
VM_PROT_WRITE	2	Write.
VM_PROT_EXECUTE	4	Execute.

Segment flags

Name	Value	Meaning
SG_HIGHVM	1	Content is at the high end of the VM space.
SG_NORELOC	4	Nothing in the segment needs relocation.
SG_PROTECTED_VERSION_1	8	Encrypted segment (old FairPlay).
SG_READ_ONLY	0x10	Made read-only by dyld after fixups (`__DATA_CONST`).

entry_point_command 24 (0x18) bytes

Field	Offset	Size	Type	Meaning
`cmd`	0x00	4	uint32_t	`LC_MAIN` (0x80000028).
`cmdsize`	0x04	4	uint32_t	24.
`entryoff`	0x08	8	uint64_t	Offset of `main()` from the start of `__TEXT`, which is also its file offset since __TEXT starts at offset 0. dyld calls it after initializing the process.
`stacksize`	0x10	8	uint64_t	Initial stack size if not 0.

Replaced LC_UNIXTHREAD (a full register state with the entry address in pc/rip) in 10.8. Static executables, dyld itself and the kernel still use LC_UNIXTHREAD.

dylib_command 24 (0x18) bytes

Field	Offset	Size	Type	Meaning
`cmd`	0x00	4	uint32_t	`LC_LOAD_DYLIB`, `LC_ID_DYLIB`, `LC_LOAD_WEAK_DYLIB`, `LC_REEXPORT_DYLIB`...
`cmdsize`	0x04	4	uint32_t	Includes the path string, padded to 8 bytes.
`dylib.name`	0x08	4	lc_str	Offset of the path from the start of the command (24): `/usr/lib/libSystem.B.dylib`, `@rpath/Foo.framework/Foo`.
`dylib.timestamp`	0x0c	4	uint32_t	Build timestamp (usually 2).
`dylib.current_version`	0x10	4	uint32_t	Version as `xxxx.yy.zz` (16.8.8 bits).
`dylib.compatibility_version`	0x14	4	uint32_t	Minimum compatible version.

Libraries are referred to by ordinal: the first LC_LOAD_DYLIB is ordinal 1, as used by imports in the chained fixups and in n_desc of undefined symbols (two-level namespace).

dylinker_command 12 (0xc) bytes

Field	Offset	Size	Type	Meaning
`cmd`	0x00	4	uint32_t	`LC_LOAD_DYLINKER` (0xe).
`cmdsize`	0x04	4	uint32_t	Includes the path string.
`name`	0x08	4	lc_str	Offset of the path, normally `/usr/lib/dyld`.

linkedit_data_command 16 (0x10) bytes

Field	Offset	Size	Type	Meaning
`cmd`	0x00	4	uint32_t	`LC_DYLD_CHAINED_FIXUPS`, `LC_DYLD_EXPORTS_TRIE`, `LC_CODE_SIGNATURE`, `LC_FUNCTION_STARTS`, `LC_DATA_IN_CODE`...
`cmdsize`	0x04	4	uint32_t	16.
`dataoff`	0x08	4	uint32_t	File offset of the data in `__LINKEDIT`.
`datasize`	0x0c	4	uint32_t	Size of the data.

symtab_command 24 (0x18) bytes

Field	Offset	Size	Type	Meaning
`cmd`	0x00	4	uint32_t	`LC_SYMTAB` (0x2).
`cmdsize`	0x04	4	uint32_t	24.
`symoff`	0x08	4	uint32_t	File offset of the `nlist_64` array.
`nsyms`	0x0c	4	uint32_t	Number of symbols.
`stroff`	0x10	4	uint32_t	File offset of the string table.
`strsize`	0x14	4	uint32_t	Size of the string table.

dysymtab_command 80 (0x50) bytes

Field	Offset	Size	Type	Meaning
`cmd`	0x00	4	uint32_t	`LC_DYSYMTAB` (0xb).
`cmdsize`	0x04	4	uint32_t	80.
`ilocalsym`	0x08	4	uint32_t	Index of the first local symbol.
`nlocalsym`	0x0c	4	uint32_t	Number of local symbols.
`iextdefsym`	0x10	4	uint32_t	Index of the first exported (defined external) symbol.
`nextdefsym`	0x14	4	uint32_t	Number of exported symbols.
`iundefsym`	0x18	4	uint32_t	Index of the first undefined (imported) symbol.
`nundefsym`	0x1c	4	uint32_t	Number of undefined symbols.
`tocoff`	0x20	4	uint32_t	Table of contents (legacy), 0.
`ntoc`	0x24	4	uint32_t
`modtaboff`	0x28	4	uint32_t	Module table (legacy), 0.
`nmodtab`	0x2c	4	uint32_t
`extrefsymoff`	0x30	4	uint32_t	External reference table (legacy), 0.
`nextrefsyms`	0x34	4	uint32_t
`indirectsymoff`	0x38	4	uint32_t	File offset of the indirect symbol table: one `uint32_t` symbol index per stub and pointer slot.
`nindirectsyms`	0x3c	4	uint32_t	Number of indirect symbol entries.
`extreloff`	0x40	4	uint32_t	External relocations (legacy dyld info), 0 with chained fixups.
`nextrel`	0x44	4	uint32_t
`locreloff`	0x48	4	uint32_t	Local relocations, 0 with chained fixups.
`nlocrel`	0x4c	4	uint32_t

The symbol table is sorted in three groups (local, exported, undefined); this command gives the boundaries.

uuid_command 24 (0x18) bytes

Field	Offset	Size	Type	Meaning
`cmd`	0x00	4	uint32_t	`LC_UUID` (0x1b).
`cmdsize`	0x04	4	uint32_t	24.
`uuid`	0x08	16	uint8_t[16]	Unique build ID; matches the dSYM and crash reports.

build_version_command 24 (0x18) bytes

Field	Offset	Size	Type	Meaning
`cmd`	0x00	4	uint32_t	`LC_BUILD_VERSION` (0x32).
`cmdsize`	0x04	4	uint32_t	`24 + ntools * 8`.
`platform`	0x08	4	uint32_t	Platform (`PLATFORM_MACOS`, `PLATFORM_IOS`...).
`minos`	0x0c	4	uint32_t	Minimum OS version, `xxxx.yy.zz` nibbles (0x000e0000 = 14.0).
`sdk`	0x10	4	uint32_t	SDK version, same encoding.
`ntools`	0x14	4	uint32_t	Number of `build_tool_version` entries that follow.

build_tool_version 8 (0x8) bytes

Field	Offset	Size	Type	Meaning
`tool`	0x00	4	uint32_t	`TOOL_CLANG` 1, `TOOL_SWIFT` 2, `TOOL_LD` 3, `TOOL_LLD` 4.
`version`	0x04	4	uint32_t	Tool version.

Name	Value	Meaning
TOOL_CLANG	1	clang
TOOL_SWIFT	2	swiftc
TOOL_LD	3	ld
TOOL_LLD	4	lld

Platforms

Name	Value	Meaning
PLATFORM_MACOS	1	macOS
PLATFORM_IOS	2	iOS
PLATFORM_TVOS	3	tvOS
PLATFORM_WATCHOS	4	watchOS
PLATFORM_BRIDGEOS	5	bridgeOS
PLATFORM_MACCATALYST	6	Mac Catalyst
PLATFORM_IOSSIMULATOR	7	iOS simulator
PLATFORM_TVOSSIMULATOR	8	tvOS simulator
PLATFORM_WATCHOSSIMULATOR	9	watchOS simulator
PLATFORM_DRIVERKIT	0xa	DriverKit
PLATFORM_VISIONOS	0xb	visionOS
PLATFORM_VISIONOSSIMULATOR	0xc	visionOS simulator

source_version_command 16 (0x10) bytes

Field	Offset	Size	Type	Meaning
`cmd`	0x00	4	uint32_t	`LC_SOURCE_VERSION` (0x2a).
`cmdsize`	0x04	4	uint32_t	16.
`version`	0x08	8	uint64_t	A.B.C.D.E packed as 24.10.10.10.10 bits.

Segments and sections

section / section_64 68 (0x44) bytes / 80 (0x50) bytes

Field	Off. 32	Off. 64	Size 32	Size 64	Type	Meaning
`sectname`	0x00	0x00	16	16	char[16]	Section name (`__text`, `__cstring`...).
`segname`	0x10	0x10	16	16	char[16]	Segment it belongs to.
`addr`	0x20	0x20	4	8	ADDR	Virtual address.
`size`	0x24	0x28	4	8	ADDR	Size in bytes.
`offset`	0x28	0x30	4	4	uint32_t	File offset (0 for zerofill sections).
`align`	0x2c	0x34	4	4	uint32_t	Alignment as a power of 2.
`reloff`	0x30	0x38	4	4	uint32_t	File offset of the relocation entries (object files).
`nreloc`	0x34	0x3c	4	4	uint32_t	Number of relocation entries (object files).
`flags`	0x38	0x40	4	4	uint32_t	Type (low 8 bits, `S_`) and attributes (high 24 bits, `S_ATTR_`).
`reserved1`	0x3c	0x44	4	4	uint32_t	For symbol pointer and stub sections: index into the indirect symbol table.
`reserved2`	0x40	0x48	4	4	uint32_t	For `S_SYMBOL_STUBS`: size of one stub (12 on arm64).
`reserved3`	—	0x4c	—	4	uint32_t	Reserved (64-bit only).

Segment	Section	Content
__PAGEZERO	—	No file content, no access. 4 GiB on 64-bit executables.
__TEXT	__text	Code.
__TEXT	__stubs, __auth_stubs	12-byte stubs that load an address from the GOT and branch to it (`adrp; ldr; br`).
__TEXT	__cstring, __const	String literals, read-only data.
__TEXT	__objc_methname, __objc_classname, __objc_methtype	Objective-C names.
__TEXT	__swift5_*	Swift metadata (types, protocols, reflection).
__TEXT	__unwind_info, __eh_frame	Compact unwind tables, DWARF CFI.
__DATA_CONST	__got, __auth_got	Pointers to imported symbols, filled by dyld (non-lazy).
__DATA_CONST	__const, __mod_init_func, __objc_classlist	Pointers that need fixups but never change afterwards.
__DATA	__data, __bss, __common	Writable data, zero-fill.
__DATA	__la_symbol_ptr	Lazy pointers (older binaries without chained fixups).
__DATA	__objc_data, __objc_selrefs, __thread_vars	Objective-C runtime data, TLV descriptors.
__LINKEDIT	—	No sections: the data of LC_SYMTAB, LC_DYSYMTAB, chained fixups, exports trie, function starts and code signature.

Section types (flags & 0xff)

Name	Value	Meaning
S_REGULAR	0	Regular section.
S_ZEROFILL	1	Zero-filled on demand, no file content (`__bss`, `__common`).
S_CSTRING_LITERALS	2	C strings, may be merged (`__cstring`).
S_4BYTE_LITERALS	3	4-byte literals.
S_8BYTE_LITERALS	4	8-byte literals.
S_LITERAL_POINTERS	5	Pointers to literals (`__objc_selrefs`).
S_NON_LAZY_SYMBOL_POINTERS	6	Pointers filled at load time (`__got`).
S_LAZY_SYMBOL_POINTERS	7	Pointers bound on first call (`__la_symbol_ptr`).
S_SYMBOL_STUBS	8	Stubs that jump through a pointer (`__stubs`).
S_MOD_INIT_FUNC_POINTERS	9	Constructor pointers (`__mod_init_func`).
S_MOD_TERM_FUNC_POINTERS	0xa	Destructor pointers.
S_COALESCED	0xb	Weak definitions coalesced by the linker.
S_THREAD_LOCAL_REGULAR	0x11	TLV initial values (`__thread_data`).
S_THREAD_LOCAL_ZEROFILL	0x12	TLV zero-fill (`__thread_bss`).
S_THREAD_LOCAL_VARIABLES	0x13	TLV descriptors (`__thread_vars`).
S_INIT_FUNC_OFFSETS	0x16	32-bit offsets of constructors (`__init_offsets`).

Section attributes (flags & 0xffffff00)

Name	Value	Meaning
S_ATTR_PURE_INSTRUCTIONS	0x80000000	Only instructions.
S_ATTR_NO_TOC	0x40000000	Coalesced symbols not in the table of contents.
S_ATTR_STRIP_STATIC_SYMS	0x20000000	Static symbols may be stripped.
S_ATTR_NO_DEAD_STRIP	0x10000000	Never dead-stripped.
S_ATTR_LIVE_SUPPORT	0x8000000	Kept if referenced items are kept.
S_ATTR_DEBUG	0x2000000	Debug information (`__DWARF`).
S_ATTR_SOME_INSTRUCTIONS	0x400	Contains some instructions.
S_ATTR_EXT_RELOC	0x200	Has external relocations.
S_ATTR_LOC_RELOC	0x100	Has local relocations.

Symbols

nlist / nlist_64 12 (0xc) bytes / 16 (0x10) bytes

Field	Off. 32	Off. 64	Size 32	Size 64	Type	Meaning
`n_strx`	0x00	0x00	4	4	uint32_t	Offset of the name in the string table.
`n_type`	0x04	0x04	1	1	uint8_t	Type bits: `N_STAB` 0xe0 (debug), `N_PEXT` 0x10, `N_TYPE` 0x0e, `N_EXT` 0x01.
`n_sect`	0x05	0x05	1	1	uint8_t	Section number (1-based, across all segments) or `NO_SECT` (0).
`n_desc`	0x06	0x06	2	2	int16_t / uint16_t	For undefined symbols: library ordinal in the high byte (`GET_LIBRARY_ORDINAL`); flags such as `N_WEAK_REF`, `N_WEAK_DEF`.
`n_value`	0x08	0x08	4	8	ADDR	Address of the symbol (0 if undefined).

n_type

Name	Value	Meaning
N_STAB	0xe0	Mask: debugging symbol (stab) if any bit is set.
N_PEXT	0x10	Private external (was exported, made hidden).
N_TYPE	0xe	Mask for the type:
N_UNDF	0	undefined, `n_sect == NO_SECT`.
N_ABS	2	absolute.
N_INDR	0xa	indirect (alias).
N_PBUD	0xc	prebound undefined.
N_SECT	0xe	defined in section `n_sect`.
N_EXT	1	External (global) symbol.

Chained fixups

Since macOS 12 / iOS 15, rebases and binds are no longer opcodes in LC_DYLD_INFO: every pointer that needs a fixup is stored in place, already encoded with the information dyld needs and the distance to the next fixup in the same page. LC_DYLD_CHAINED_FIXUPS only gives where each chain starts and the list of imports. dyld walks the chains and replaces each slot with the final pointer.

dyld_chained_fixups_header 28 (0x1c) bytes

Field	Offset	Size	Type	Meaning
`fixups_version`	0x00	4	uint32_t	0.
`starts_offset`	0x04	4	uint32_t	Offset of `dyld_chained_starts_in_image`, from the start of this header.
`imports_offset`	0x08	4	uint32_t	Offset of the imports table.
`symbols_offset`	0x0c	4	uint32_t	Offset of the imported symbol names.
`imports_count`	0x10	4	uint32_t	Number of imports.
`imports_format`	0x14	4	uint32_t	`DYLD_CHAINED_IMPORT` 1, `_ADDEND` 2, `_ADDEND64` 3.
`symbols_format`	0x18	4	uint32_t	0 = plain strings, 1 = zlib-compressed.

dyld_chained_starts_in_segment 24 (0x18) bytes

Field	Offset	Size	Type	Meaning
`size`	0x00	4	uint32_t	Size of this structure.
`page_size`	0x04	2	uint16_t	0x1000 or 0x4000.
`pointer_format`	0x06	2	uint16_t	`DYLD_CHAINED_PTR_*`: how to decode each 64-bit slot.
`segment_offset`	0x08	8	uint64_t	Offset of the segment from the start of the image (vmaddr - __TEXT vmaddr).
`max_valid_pointer`	0x10	4	uint32_t	For 32-bit formats.
`page_count`	0x14	2	uint16_t	Number of pages in the segment.
`page_start`	0x16	2	uint16_t[1]	Per page: offset of the first fixup, or `DYLD_CHAINED_PTR_START_NONE` (0xffff).

dyld_chained_starts_in_image before it is uint32_t seg_count followed by one uint32_t seg_info_offset per segment (0 when the segment has no fixups).

Name	Value	Meaning
DYLD_CHAINED_IMPORT	1	imports_format: 32-bit `dyld_chained_import`.
DYLD_CHAINED_IMPORT_ADDEND	2	imports_format: import with a 32-bit addend.
DYLD_CHAINED_IMPORT_ADDEND64	3	imports_format: import with a 64-bit addend.
DYLD_CHAINED_PTR_START_NONE	0xffff	page_start value of a page without fixups.

Pointer formats

Name	Value	Meaning
DYLD_CHAINED_PTR_ARM64E	1	arm64e: authenticated pointers, stride 8, targets are vmaddrs.
DYLD_CHAINED_PTR_64	2	64-bit, targets are vmaddrs.
DYLD_CHAINED_PTR_32	3	32-bit.
DYLD_CHAINED_PTR_64_OFFSET	6	64-bit, targets are offsets from the image start (arm64 and x86-64 apps).
DYLD_CHAINED_PTR_ARM64E_KERNEL	7	arm64e kernel, stride 4.
DYLD_CHAINED_PTR_ARM64E_USERLAND	9	arm64e user space, targets are offsets.
DYLD_CHAINED_PTR_ARM64E_USERLAND24	0xc	Same with 24-bit bind ordinals.

DYLD_CHAINED_PTR_64 / 64_OFFSET slots

dyld_chained_ptr_64_bind

63bind=11

62–51next12

50–32reserved19

31–24addend8

23–0ordinal24

dyld_chained_ptr_64_rebase

63bind=01

62–51next12

50–44reserved7

43–36high88

35–0target36

dyld_chained_import (imports_format 1)

31–9name_offset23

8weak_import1

7–0lib_ordinal8

next counts 4-byte strides to the next fixup in the page (0 = end of chain). A bind's ordinal indexes the imports table; an import's lib_ordinal is the LC_LOAD_DYLIB number (0 = self, -1 = main executable, -2 = flat lookup, -3 = weak). In the sample, the single __got slot is a bind to import 0, _puts from library 1 (libSystem).

Code signature

LC_CODE_SIGNATURE points to a CS_SuperBlob at the end of __LINKEDIT. On Apple silicon every executable page must be signed, so the linker adds an ad-hoc signature by default. A developer or App Store signature adds requirements, entitlements and a CMS blob with the certificate chain.

CS_SuperBlob 12 (0xc) bytes

Field	Offset	Size	Type	Meaning
`magic`	0x00	4	uint32_t	`CSMAGIC_EMBEDDED_SIGNATURE` 0xfade0cc0.
`length`	0x04	4	uint32_t	Total length of the signature.
`count`	0x08	4	uint32_t	Number of `CS_BlobIndex` entries that follow.

Code signature structures are big endian.

CS_BlobIndex 8 (0x8) bytes

Field	Offset	Size	Type	Meaning
`type`	0x00	4	uint32_t	Slot: `CSSLOT_CODEDIRECTORY` 0, `CSSLOT_REQUIREMENTS` 2, `CSSLOT_ENTITLEMENTS` 5, `CSSLOT_SIGNATURESLOT` 0x10000 (CMS)...
`offset`	0x04	4	uint32_t	Offset of the blob from the start of the SuperBlob.

CS_CodeDirectory 112 (0x70) bytes

Field	Offset	Size	Type	Meaning
`magic`	0x00	4	uint32_t	`CSMAGIC_CODEDIRECTORY` 0xfade0c02.
`length`	0x04	4	uint32_t	Length of this blob.
`version`	0x08	4	uint32_t	Format version: 0x20400 adds the exec segment fields, 0x20500 the hardened runtime version.
`flags`	0x0c	4	uint32_t	`CS_ADHOC` 0x2, `CS_RUNTIME` 0x10000 (hardened runtime), `CS_LINKER_SIGNED` 0x20000...
`hashOffset`	0x10	4	uint32_t	Offset of code slot 0; special slots are stored before it, at negative indexes.
`identOffset`	0x14	4	uint32_t	Offset of the identifier (bundle ID or file name).
`nSpecialSlots`	0x18	4	uint32_t	Number of special slots (hashes of Info.plist, requirements, entitlements...).
`nCodeSlots`	0x1c	4	uint32_t	Number of page hashes.
`codeLimit`	0x20	4	uint32_t	Bytes covered by the page hashes (the file up to the signature).
`hashSize`	0x24	1	uint8_t	32 for SHA-256.
`hashType`	0x25	1	uint8_t	`CS_HASHTYPE_SHA1` 1, `CS_HASHTYPE_SHA256` 2.
`platform`	0x26	1	uint8_t	Non-zero for platform binaries.
`pageSize`	0x27	1	uint8_t	log2 of the page size hashed (12 = 4 KiB).
`spare2`	0x28	4	uint32_t	0.
`scatterOffset`	0x2c	4	uint32_t	v 0x20100.
`teamOffset`	0x30	4	uint32_t	v 0x20200: offset of the Team ID string.
`spare3`	0x34	4	uint32_t	v 0x20300.
`codeLimit64`	0x38	8	uint64_t	v 0x20300: 64-bit code limit.
`execSegBase`	0x40	8	uint64_t	v 0x20400: file offset of the executable segment.
`execSegLimit`	0x48	8	uint64_t	v 0x20400: size of the executable segment.
`execSegFlags`	0x50	8	uint64_t	v 0x20400: `CS_EXECSEG_MAIN_BINARY` 1, `CS_EXECSEG_ALLOW_UNSIGNED` 0x10...
`runtime`	0x58	4	uint32_t	v 0x20500: SDK version the hardened runtime was built against.
`preEncryptOffset`	0x5c	4	uint32_t	v 0x20500: offset of the hashes of the pages before encryption.
`linkageHashType`	0x60	1	uint8_t	v 0x20600: linkage hash fields.
`linkageApplicationType`	0x61	1	uint8_t	v 0x20600.
`linkageApplicationSubType`	0x62	2	uint16_t	v 0x20600.
`linkageOffset`	0x64	4	uint32_t	v 0x20600.
`linkageSize`	0x68	4	uint32_t	v 0x20600.

The cdhash of a binary is the hash of this blob. Every 4 KiB page of the file up to codeLimit has its hash in a code slot, and the kernel checks pages when they are faulted in.

Name	Value	Meaning
CSMAGIC_EMBEDDED_SIGNATURE	0xfade0cc0	SuperBlob holding the whole signature.
CSMAGIC_CODEDIRECTORY	0xfade0c02	CodeDirectory: page hashes, identifier, flags.
CSMAGIC_REQUIREMENTS	0xfade0c01	Internal requirements (designated requirement).
CSMAGIC_EMBEDDED_ENTITLEMENTS	0xfade7171	Entitlements plist.
CSMAGIC_EMBEDDED_DER_ENTITLEMENTS	0xfade7172	Entitlements in DER.
CSMAGIC_BLOBWRAPPER	0xfade0b01	CMS signature (certificate chain). Absent in ad-hoc signatures.
CS_ADHOC	2	CodeDirectory flag: ad-hoc signed, no certificate.
CS_RUNTIME	0x10000	CodeDirectory flag: hardened runtime.
CS_LINKER_SIGNED	0x20000	CodeDirectory flag: ad-hoc signature added by the linker.

Slots and CodeDirectory values

Name	Value	Meaning
CSSLOT_CODEDIRECTORY	0	CodeDirectory.
CSSLOT_INFOSLOT	1	Hash of Info.plist (special slot -1).
CSSLOT_REQUIREMENTS	2	Requirements.
CSSLOT_RESOURCEDIR	3	Hash of _CodeSignature/CodeResources (bundles).
CSSLOT_APPLICATION	4	Application-specific.
CSSLOT_ENTITLEMENTS	5	Entitlements plist.
CSSLOT_DER_ENTITLEMENTS	7	DER entitlements.
CSSLOT_ALTERNATE_CODEDIRECTORIES	0x1000	Additional CodeDirectories (e.g. SHA-1 next to SHA-256).
CSSLOT_SIGNATURESLOT	0x10000	CMS signature.
CS_HASHTYPE_SHA1	1	hashType: SHA-1.
CS_HASHTYPE_SHA256	2	hashType: SHA-256.
CS_EXECSEG_MAIN_BINARY	1	execSegFlags: main executable.
CS_EXECSEG_ALLOW_UNSIGNED	0x10	execSegFlags: may map unsigned pages (debugging, JIT).

Tools

Task	Command
Header	otool -hv a.out
Load commands	otool -lv a.out
Linked libraries	otool -L a.out
Chained fixups, imports, exports	dyld_info -fixups -imports -exports a.out
Symbols	nm -m a.out
Architectures of a universal binary	lipo -info a.out lipo -thin arm64 -output a.arm64 a.out
Platform and versions	vtool -show a.out
Code signature, entitlements	codesign -dvvv --entitlements - a.out
Disassemble	otool -tV a.out llvm-objdump -d a.out

Structures and constants from the macOS SDK headers mach-o/loader.h, fat.h, nlist.h, fixup-chains.h, mach/machine.h and kern/cs_blobs.h, checked by compiling them. Other formats: ELF, PE/COFF.