Mach-O Build Information

At the end of 2020, Apple released the first ARM64 based computers (i.e., MacBook, iMac, etc.). Up to that point, ARM64 chips were only used in iOS, iPadOS, watchOS, & tvOS devices. This change could cause some confusion when simply looking at the raw binary. For instance, simply running the file command against an executable compiled for iOS & macOS, they will both look identical:

% file bof.macOS bof.iOS 
bof.macOS: Mach-O 64-bit executable arm64
bof.iOS:   Mach-O 64-bit executable arm64

In this example, I obviously identified which platform each executable was compiled for to differentiate between the two files and for display purposes. If we received the binary without this differentiator, how could we determine which platform the binary is compiled for?

Fortunately, this information is kept in the load command called LC_BUILD_VERSION. We can query the LC_BUILD_VERSION command and the platform sub-command:

% otool -l bof.macOS | grep -A 7 LC_BUILD_VERSION | grep platform
 platform 1

% otool -l bof.iOS | grep -A 7 LC_BUILD_VERSION | grep platform
 platform 2

From the loader.h file, these platforms are defined:

#define PLATFORM_MACOS   1
#define PLATFORM_IOS     2
#define PLATFORM_TVOS    3
#define PLATFORM_WATCHOS 4