What problem does it solve? Analyzing macOS and iOS binaries requires understanding the Mach-O format, whose load commands combine the roles of section tables, import tables, entry points, and code signatures. This Skill provides a structured workflow for parsing Mach-O files with otool, llvm-objdump, jtool2, and manual byte-level inspection, so you can map segments, trace dylib dependencies, and verify code signatures without guessing at offsets. ## Core Features & Use Cases - Header and Load Command Parsing: Decode mach_header fields, walk LC_* commands by cmdsize, and validate ncmds against sizeofcmds to detect forged headers. - Segment, Entry, and dyld Analysis: Map __TEXT/__DATA/__LINKEDIT segments, compute entry VA from LC_MAIN, and decode rebase/bind/export tables including the export trie. - Dependency and Signature Inspection: List LC_LOAD_DYLIB entries to detect injected dylib persistence, and check codesign status for adhoc versus Apple-signed binaries. - Use Case: Given a suspicious macOS dylib, run otool -L to compare its load commands against the signed dependency list, extract the export trie with llvm-objdump, and confirm whether an unexpected LC_LOAD_DYLIB entry indicates malicious persistence. ## Quick Start Analyze the attached Mach-O binary by parsing its mach_header, load commands, segments, dylib dependencies, and code signature, then report the entry point and any anomalies.
