ocaml-mach-o#

Mach-O (macOS / iOS) binary reader in pure OCaml.

Installation#

Install with opam:

$ opam install mach-o

If opam cannot find the package, it may not yet be released in the public opam-repository. Add the overlay repository, then install it:

$ opam repo add samoht https://tangled.org/gazagnaire.org/opam-overlay.git
$ opam update
$ opam install mach-o

Overview#

ocaml-mach-o reads Mach-O images -- the executable format used by macOS and iOS. The on-disk structures (the Mach header, LC_SEGMENT_64 segments and their sections, and the LC_SYMTAB symbol table) are described with the wire combinator library and decoded through bytesrw, so a binary's sections and symbols can be inspected without shelling out to nm, size or otool.

It reads 64-bit thin images and fat (universal) binaries, selecting the 64-bit slice for the host architecture (arm64 first, then x86-64).

Mach-O symbol records carry an address but no size, so this library exposes the raw symbols and sections and leaves size attribution -- the distance from each symbol to the next within its section -- to the caller.

Reading#

Mach_o.of_string parses an image and exposes its architecture, sections and defined symbols. Malformed input is rejected with a message rather than an exception:

# Mach_o.of_string "this is plainly not a Mach-O binary at all"
- : (Mach_o.t, string) result =
Error "Mach-O: not a 64-bit Mach-O (magic 0x73696874)"

On a real binary, Mach_o.sections and Mach_o.symbols return the section layout and the defined symbols, each tagged with the 1-based section ordinal that Mach_o.section_by_index resolves.

Status#

The Mach header, 64-bit segments and sections, and the symbol and string tables are parsed and bounds-checked against the input. Fat binaries are resolved to a single 64-bit slice. Undefined, absolute and debugging (stab) symbols are dropped. The format is read, not written.

Licence#

ISC. See LICENSE.md.