Glossary
Mach-O
Apple's executable file format. Holds load commands, segments, the code signature, and the dyld handoff metadata. Every binary on macOS, iOS, watchOS, tvOS is Mach-O.
Mach-O is the executable format used by every Apple operating system: macOS, iOS, watchOS, tvOS, visionOS. Replaces ELF (Linux/BSD) and PE (Windows) in the Apple world. Inherited from NeXTSTEP, which inherited it from Mach.
A Mach-O file has:
- A header identifying CPU type, file type (executable, dylib, bundle), and a count of load commands.
- A series of load commands describing how to map the binary into memory:
LC_SEGMENT_64— a region (__TEXT,__DATA, etc.) with offset, size, permissions.LC_LOAD_DYLIB— depend on this dylib.LC_MAIN— entry point.LC_CODE_SIGNATURE— pointer to the embedded signature blob.LC_DYLD_CHAINED_FIXUPS— modern relocation/rebase information.
- The segment data — the actual code and initial data.
- A trailing code signature if signed.
apple-oss-distributions/xnubsd/kern/mach_loader.cThe Mach-O loader — parses load commands, builds the VM map, hands off to dyld.View on GitHub(line —) apple-oss-distributions/dylddyld/main.cppdyld — every Mach-O on macOS enters userspace through here.View on GitHub(line —)
The kernel's Mach-O loader handles the initial mapping; everything else (resolving symbols, loading dylibs, running initializers) is dyld's job.
Inspect a Mach-O with otool -h (header), otool -l (load commands), nm (symbols), dyld_info (modern Apple replacement for several of these).
See also: dyld, code signing, and the fork/exec article.