1SCANMACHO(1) Documentation for pax-utils SCANMACHO(1)
2
6 scanmacho - user-space utility to scan Mach-O files
7
9 scanmacho [options] Mach-Os or directories
10
12 scanmacho is a user-space utility to quickly scan given Mach-Os,
13 directories, or common system paths for different information. This may
14 include Mach-O types, their install_names, etc...
15 Because Mach-O files can be "fat", it is possible for a single file to
17 return multiple lines. Each line represents a single architecture,
18 contained in the fat (universal) file. While there are no real
19 restrictions, in practice, the entries can be distinguished by their
20 arch type, e.g. ppc, ppc64, i386, x86_64, arm, ...
21
23 -A, --archives
24 Scan archives (.a files)
25 -a, --all
27 Print all useful/simple info
28 -B, --nobanner
30 Don't display the header
31 -b, --bind
33 Print flags from mach_header
34 -D, --endian
36 Print Mach-O endianness
37 -E, --etype filetype
39 Print only Mach-O files matching specified etype (like
40 MH_EXECUTABLE, MH_DYLIB, etc...)
41 -F, --format FORMAT
43 Use specified format for output; see the FORMAT section for more
44 information.
45 -f, --from FILE
47 Read input stream from specified filename
48 -g, --gmatch
50 Use strncmp to match libraries (use with -N). Or regexp with symbol
51 matching
52 -h, --help
54 Show condensed usage and exit
55 -i, --interp
57 Print the interpreter information (LC_LOAD_DYLINKER)
58 -M, --bits BITS
60 Print only Mach-O files matching specified numeric bits (like
61 32/64)
62 -m, --mount
64 Don't recursively cross mount points
65 -N, --lib INSTALLNAME
67 Find Mach-Os that need the specified INSTALL_NAME
68 -n, --needed
70 Print libraries the Mach-O is linked against (LC_LOAD_DYLIB).
71 -O, --perms PERMS
73 Print only Mach-O files with matching specified octal bits (like
74 755).
75 -o, --file FILE
77 Write output stream to specified filename.
78 -p, --path
80 Scan all directories in PATH environment.
81 -q, --quiet
83 Only output 'bad' things.
84 -R, --recursive
86 Scan directories recursively
87 -r, --rpath
89 Print RPATH encoded in the Mach-O (LC_RPATH)
90 -S, --soname
92 Print the Mach-O's shared library name (install_name).
93 -V, --version
95 Print version and exit
96 -v, --verbose
98 Be verbose (can be used more than once)
99 -y, --symlink
101 Don't scan symlinks
102 -Z, --size SIZE
104 Print Mach-O file size
105
107 The format string is much like a printf string in that it is a literal
108 string with flags requesting different information. For example, you
109 could use a format string and expect the following results.
110 # scanmacho -BF "file %f needs %n; funky time" /bin/bash
112 file bash needs /usr/lib/libncurses.5.4.dylib,/usr/lib/libSystem.B.dylib; funky time
113 Note that when you use a format string, generally information related
116 flags should be omitted. In other words, you do not want to try and
117 request NEEDED output (-n) and try to specify a format output at the
118 same time as these operations are mutually exclusive. Each information
119 related flag has an equivalent conversion specifier, so use those
120 instead. You can of course continue to use non-information related
121 flags (such as --verbose).
122 There are three characters that introduce conversion specifiers.
124 • % - replace with info
126 • # - silent boolean match
127 • + - verbose match
128 And there are a number of conversion specifiers. We try to match up the
130 specifier with corresponding option.
131 • a - arch type
133 • b - mach_header flags
135 • D - endian
136 • F - long filename
137 • f - short filename
138 • i - dyld
139 • M - CPU_TYPE class
140 • N - specified needed
141 • n - needed libraries
142 • p - filename (minus search)
143 • o - mh_type
144 • O - perms
145 • r - rpaths
146 • S - install_name
147
150 You can narrow your search by specifying the Mach-O object file type.
151 The commandline option takes the symbolic type name. Multiple values
152 can be passed comma separated. Example -E MH_EXECUTE,MH_DYLIB
153 Here is the normal list available for your pleasure.
155 • MH_OBJECT - intermediate object file (.o)
157 • MH_EXECUTE - standard executable program
158 • MH_BUNDLE - dlopen plugin (.bundle)
159 • MH_DYLIB - dynamic shared library (.dylib)
160 • MH_PRELOAD - executable not loaded by Mac OS X kernel (ROM)
161 • MH_CORE - program crash core file
162 • MH_DYLINKER - dynamic linker shared library (dyld)
163 • MH_DYLIB_STUB - shared library stub for static only, no sections
164 • MH_DSYM - debug symbols file (in .dSYM dir)
165
168 You can also narrow your search by specifying the Mach-O bitsize.
169 Specify the numeric value.
170 • 32 - 32bit mach_header
172 • 64 - 64bit mach_header_64
173
176 https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities
177
179 Please include as much information as possible (using any available
180 debugging options) and send bug reports to the maintainers (see the
181 AUTHORS section). Please use the Gentoo bugzilla at
182 https://bugs.gentoo.org/ if possible.
183
185 chpax(1), dumpelf(1), paxctl(1), pspax(1), readelf(1), scanelf(1),
186 elf(5)
187
189 Ned Ludd <solar@gentoo.org>
190 Maintainer
191 Mike Frysinger <vapier@gentoo.org>
193 Maintainer
194 Fabian Groffen <grobian@gentoo.org>
196 Mach-O Maintainer
197
199 1. https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities
200 2. https://bugs.gentoo.org/
202pax-utils 1.3.1 04/18/2021 SCANMACHO(1)