Linux Mach-O Disassembler

Question

Are there any Linux programs that can disassemble an OSX universal x86/x86_64 fat Mach-O binary like objdump? GNU binutils' objdump supports ELF and Windows PE files but not Mach-O.

Nitrobenzene

Are you sure that binutils don't support Mach-O ? Perhaps you need to configure it for that and recompile it (of course your standard distribution's binutils dont support it, because it has no need for that)? – Heedful

I had read somewhere that GNU binutils had not been supporting it. I simply assumed that the mac port was modified to support it. This is not the case as @Brett Hale describes. – Nitrobenzene

Answer 1

AFAIK, the native Darwin binary tools are part of the cctools package. They don't have the same command line syntax or output as the GNU binutils. Later binutils (i.e., 2.22) supports the Mach-O format however. You can get these prebuilt, with the 'g' prefix to the tool names, as mentioned here. Alternatively, you can compile binutils, with something like:

> ./configure --prefix=$CROSSTOOLDIR --target=x86_64-apple-darwin \
--enable-64-bit-bfd --disable-nls --disable-werror

Installation will yield a bin/ directory where the utilities are prefixed with x86_64-apple-darwin. It should handle i386 Mach-O format (and FAT binaries) fine.

Hui

Just to be clear, this is for building binutils specifically for Mac osx? Not for Linux like the original question asked? – Nyctalopia

@JamesMcMahon - It should work on either. --target is the architecture / ABI the tools analyze. --host specifies the platform the tools will run on. Typically --host defaults to the value returned by config.guess. – Hui

Answer 2

With regards to Jeff's response:

bintuils does not include linking support (ld/gld) for mach o not even in the current 2.23 release which is really disappointing but not surprising. That unfortunately is what happens when you make an OS, and reinvent things "that really don't need to be reinvented." Everyone has different priorities. I still haven't heard the end of a.out vs elf from some people.

care to try to run ELF binaries on OSX? https://mcmap.net/q/507425/-possibility-of-loading-executing-elf-files-on-osx

Tomtit

Answer 3

I think you need otool. It is included in mac osx command tools. For example, if you want to disassemble a.out, all you need to do is typing otool -tv a.out in your command line.

Conservancy

Answer 4

You can disassemble Mach-O binaries on Linux with Hopper. Unlike objdump, it has a very nice graphical user interface.

Dumyat

Answer 5

Few famous tools for reverse engineering the Mach-O binaries are otool , strings, nm, otx etc. This definitely works on the MAC OSX, I think it works on the Linux plaform too.

Neelyneeoma

yes... otool is a OSX cmd line tool... There is an alternative tool for Linux platform.. Google and find it ! – Neelyneeoma

Could you please tell the alternative for otool on ubuntu? – Capel