machofile

machofile is a module to parse Mach-O binary files, with a focus on malware analysis and reverse engineering.

Inspired by Ero Carrera's pefile, this module aims to provide similar capabilities but for Mach-O binaries instead. Reference material and documentation used to gain the file format knowledge, the basic structures and constant are taken from the resources listed below.

machofile is self-contained. The module has no dependencies; it is endianness independent; and it works on macOS, Windows, and Linux.

While there are other Mach-o parsing modules out there, the motivations behind developing this one are:

first and foremost, for me this was a great way to deep dive and learn more about the Mach-O format and structures
to provide a simple way to parse Mach-O files for analysis
to not depend on external modules (e.g. lief, macholib, macho, etc.), since everything is directly extracted from the file and is all in pure python.

Let me know if you try it or find bugs but also... be gentle ;) code will be optimized and more features will be added.

Current Features:

Parse Mach-O Header
Parse Load Commands
Parse File Segments
Parse Dylib Commands
Parse Dylib List
Extract imported function
Extract Exported Symbols
Hashes: dylib hash, import hash, export hash, entitlement hash, symhash
Segment entropy calculation
Extract Entry point
Extract UUID
Extract Version Information
Parse basic Code Signature information
Support for FAT (Universal) Binaries
Dump individual Mach-O slices from FAT (Universal) Binaries
JSON output support (both human-readable and raw formats)

Note: as of now, this has initially been tested against x86, x86_64, arm64, and arm64e Mach-O samples.

Next features to be implemented (in random order):

Embedded strings
File Attributes

% machofile -a -f b4f68a58658ceceb368520dafc35b270272ac27b8890d5b3ff0b968170471e2b [General File Info] Filename: b4f68a58658ceceb368520dafc35b270272ac27b8890d5b3ff0b968170471e2b Filesize: 54240 MD5: 20ffe440e4f557b9e03855b5da2b3c9c SHA1: 1bf61ecad8568a774f9fba726a254a9603d09f33 SHA256: b4f68a58658ceceb368520dafc35b270272ac27b8890d5b3ff0b968170471e2b [Mach-O Header] magic: MH_MAGIC (32-bit), 0xFEEDFACE cputype: Intel i386 cpusubtype: X86_ALL filetype: EXECUTE ncmds: 13 sizeofcmds: 1180 flags: NOUNDEFS, DYLDLINK, TWOLEVEL [Load Cmd table] {'cmd': 'LC_SEGMENT', 'cmdsize': 56} {'cmd': 'LC_SEGMENT', 'cmdsize': 192} {'cmd': 'LC_SEGMENT', 'cmdsize': 328} {'cmd': 'LC_SEGMENT', 'cmdsize': 192} {'cmd': 'LC_SEGMENT', 'cmdsize': 56} {'cmd': 'LC_SYMTAB', 'cmdsize': 24} {'cmd': 'LC_DYSYMTAB', 'cmdsize': 80} {'cmd': 'LC_LOAD_DYLINKER', 'cmdsize': 28} {'cmd': 'LC_UUID', 'cmdsize': 24} {'cmd': 'LC_UNIXTHREAD', 'cmdsize': 80} {'cmd': 'LC_LOAD_DYLIB', 'cmdsize': 52} {'cmd': 'LC_LOAD_DYLIB', 'cmdsize': 52} {'cmd': 'LC_CODE_SIGNATURE', 'cmdsize': 16} [Load Commands] LC_CODE_SIGNATURE LC_DYSYMTAB LC_LOAD_DYLIB LC_LOAD_DYLINKER LC_SEGMENT LC_SYMTAB LC_UNIXTHREAD LC_UUID [File Segments] SEGNAME VADDR VSIZE OFFSET SIZE MAX_VM_PROTECTION INITIAL_VM_PROTECTION NSECTS FLAGS ENTROPY ------------------------------------------------------------------------------------------------------------ __PAGEZERO 0 4096 0 0 0 0 0 0 0.0 __TEXT 4096 28672 0 28672 7 5 2 0 5.080680410706916 __DATA 32768 4096 28672 4096 7 3 4 0 0.1261649636134924 __IMPORT 36864 4096 32768 4096 7 7 2 0 0.21493796627555234 __LINKEDIT 40960 20480 36864 17376 7 1 0 0 6.637864516225949 [Dylib Commands] DYLIB_NAME_OFFSET DYLIB_TIMESTAMP DYLIB_CURRENT_VERSION DYLIB_COMPAT_VERSION DYLIB_NAME ---------------------------------------------------------------------------------------------------------- 24 2 65536 65536 b'/usr/lib/libgcc_s.1.dylib' 24 2 7274759 65536 b'/usr/lib/libSystem.B.dylib' [Dylib Names] b'/usr/lib/libgcc_s.1.dylib' b'/usr/lib/libSystem.B.dylib' [UUID] d691c242-da49-1081-50d5-4f8991924b06 [Entry Point] type: LC_UNIXTHREAD entry_address: 9200 thread_data_size: 72 [Version Information] No version information found [Code Signature] signed: True signing_status: Apple signed certificates_info: count: 3 certificates: index: 0 size: 4815 subject: Contains: Developer ID Certification Authority issuer: Unable to parse is_apple_cert: True type: Developer ID Certification Authority index: 1 size: 1215 subject: Contains: Apple Root CA issuer: Unable to parse is_apple_cert: True type: Apple Root CA index: 2 size: 1385 subject: Contains: Developer ID Application: issuer: Unable to parse is_apple_cert: False type: Developer ID Application Certificate entitlements_info: count: 0 entitlements: code_directory: version: 131328 flags: 0 hash_offset: 144 identifier_offset:48 special_slots: 3 signing_flags: None code_slots: 11 hash_size: 44640 hash_type: 335609868 hash_algorithm: Unknown (335609868) identifier: onmac.unspecified.installer [Imported Libraries] /usr/lib/libgcc_s.1.dylib /usr/lib/libSystem.B.dylib [Imported Functions] (Sources: CF=chained_fixups, BO=bind, WB=weak_bind, LB=lazy_bind, ST=symtab) /usr/lib/libSystem.B.dylib: __NSGetExecutablePath [ST] ___stderrp [ST] _dlerror [ST] _dlopen [ST] _dlsym [ST] _exit [ST] _fclose [ST] _fopen [ST] _fprintf [ST] _fputs$UNIX2003 [ST] _free [ST] _fwrite$UNIX2003 [ST] _getenv [ST] _getpid [ST] _getpwnam [ST] _lstat [ST] _mbstowcs [ST] _memcpy [ST] _memset [ST] _setenv$UNIX2003 [ST] _setlocale [ST] _snprintf [ST] _stat [ST] _strchr [ST] _strdup [ST] _strlen [ST] _unsetenv$UNIX2003 [ST] [Exported Symbols] <unknown>: _NXArgc _NXArgv ___progname _environ _main start [Similarity Hashes] dylib_hash: 0556bed5dc31bddaee73f3234b3c577b export_hash: 824e359e3d0ad7283d0982bd5da2e8fd import_hash: 0bae89995ad3900987c49c0bea1d17fe symhash: 15e6c1aeba01be1404901f7152213779

machofile

Most Popular

Usage and examples

Module version

Command Line version

Dumping Slices from Universal (FAT) Binaries

JSON Output

Human-Readable JSON (Default)

Raw JSON Output

JSON Output Options

Sponsored by

Credits

Reference/Documentation links: