mach

sleuthit-2.09 一个磁盘的工具集

#------------------------------------------------------------
# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
# Unfortunately the first, cafebabe, is shared with
# Java ByteCode, so they are both handled in the file "cafebabe".
# The "feedface" ones are handled herein.
#------------------------------------------------------------
0	lelong&0xfeffffff	0xfeedface	Mach-O
>0	byte		0xcf		64-bit
>12	lelong		1		object
>12	lelong		2		executable
>12	lelong		3		fixed virtual memory shared library
>12	lelong		4		core
>12	lelong		5		preload executable
>12	lelong		6		dynamically linked shared library
>12	lelong		7		dynamic linker
>12	lelong		8		bundle
>12	lelong		9		dynamically linked shared library stub
>12	lelong		>9
>>12	lelong		x		filetype=%ld
>4	lelong		<0
>>4	lelong		x		architecture=%ld
>4	lelong		1		vax
>4	lelong		2		romp
>4	lelong		3		architecture=3
>4	lelong		4		ns32032
>4	lelong		5		ns32332
>4	lelong		6		m68k
>4	lelong		7		i386
>4	lelong		8		mips
>4	lelong		9		ns32532
>4	lelong		10		architecture=10
>4	lelong		11		hppa
>4	lelong		12		acorn
>4	lelong		13		m88k
>4	lelong		14		sparc
>4	lelong		15		i860-big
>4	lelong		16		i860
>4	lelong		17		rs6000
>4	lelong		18		ppc
>4	lelong		16777234	ppc64
>4	lelong		>16777234
>>4	lelong		x		architecture=%ld
#
0	belong&0xfffffffe	0xfeedface	Mach-O
>3	byte		0xcf		64-bit
>12	belong		1		object
>12	belong		2		executable
>12	belong		3		fixed virtual memory shared library
>12	belong		4		core
>12	belong		5		preload executable
>12	belong		6               dynamically linked shared library
>12	belong		7               dynamic linker
>12	belong		8		bundle
>12	belong		9		dynamically linked shared library stub
>12	belong		>9
>>12	belong		x		filetype=%ld
>4	belong		<0
>>4	belong		x		architecture=%ld
>4	belong		1		vax
>4	belong		2		romp
>4	belong		3		architecture=3
>4	belong		4		ns32032
>4	belong		5		ns32332
>4	belong		6		for m68k architecture
# from NeXTstep 3.0 <mach/machine.h>
# i.e. mc680x0_all, ignore
# >>8	belong		1		(mc68030)
>>8	belong		2		(mc68040)
>>8	belong		3		(mc68030 only)
>4	belong		7		i386
>4	belong		8		mips
>4	belong		9		ns32532
>4	belong		10		architecture=10
>4	belong		11		hppa
>4	belong		12		acorn
>4	belong		13		m88k
>4	belong		14		sparc
>4	belong		15		i860-big
>4	belong		16		i860
>4	belong		17		rs6000
>4	belong		18		ppc
>4	belong		16777234	ppc64
>4	belong		>16777234
>>4	belong		x		architecture=%ld