GView Specific Plugin: Mach-O

The Mach-O plugin parses Mach-O and Mach-O Fat binaries (macOS/iOS), including Go binaries, with section/segment/symbol extraction and code signature validation.

References

• LLVM / Mach-O format: MachODump, BinaryFormat/MachO.h, MachO namespace, SymbolTable.cpp

• Apple Security / codesign: Security, codesign.c, codedirectory.h

• cctools / otool: ofile_print.c

• dyld: ImageLoaderMachO, dyld, MachOLoaded

• XNU headers: mach-o/nlist.h, mach-o/stab.h

• Third-party: macholib, go-macho (blacktop), LIEF MachO, zsign, osx-abi-macho-file-format-reference

• Articles: Code Signing (newosxbook), Mach-O (redmaple), iOS code signature

• Validation: validate_macho_sig.py