2

I just started with Charlie Miller and Dino Dai Zovi's Mac Hacker's Handbook and was doing the tutorials. This includes getting to know things like 'otool'

otool -f \bin\ls
Fat headers
fat_magic 0xcafebabe
nfat_arch 2
architecture 0
    cputype 16777223
    cpusubtype 3
    capabilities 0x80
    offset 4096
    size 39600
    align 2^12 (4096)
architecture 1
    cputype 7
    cpusubtype 3
    capabilities 0x0
    offset 45056
    size 35632
    align 2^12 (4096)

I tried to find something about that first cputype in /usr/include/mach/machine.h, but found nothing. Clearly I am missing something.

2 Answers 2

6

cputype 16777223 is “x86 64” (64 bit mode); 7 is “i386” (32 bit mode). Incidentally, 16777223 == 0x1000007, so bit 24 means “64 bit”.

Looking in /usr/include/mach/machine.h (pointed out by …/mach-o/fat.h, which seems like a reasonable place to start), we find the following:

⋮
typedef integer_t       cpu_type_t;
⋮
#define CPU_ARCH_ABI64  0x01000000              /* 64 bit ABI */
⋮
#define CPU_TYPE_X86            ((cpu_type_t) 7)
#define CPU_TYPE_I386           CPU_TYPE_X86            /* compatibility */
#define CPU_TYPE_X86_64         (CPU_TYPE_X86 | CPU_ARCH_ABI64)
⋮
#define CPU_TYPE_POWERPC                ((cpu_type_t) 18)
#define CPU_TYPE_POWERPC64              (CPU_TYPE_POWERPC | CPU_ARCH_ABI64)
⋮

Of course, you can also just add the -v option to your otool command to have it show the symbolic values:

% otool -vf /bin/ls
Fat headers
fat_magic FAT_MAGIC
nfat_arch 2
architecture x86_64
    cputype CPU_TYPE_X86_64
    cpusubtype CPU_SUBTYPE_X86_64_ALL
    capabilities CPU_SUBTYPE_LIB64
    offset 4096
    size 39600
    align 2^12 (4096)
architecture i386
    cputype CPU_TYPE_I386
    cpusubtype CPU_SUBTYPE_I386_ALL
    capabilities 0x0
    offset 45056
    size 35632
    align 2^12 (4096)
1
  • Thanks a lot. I completely overlooked the definitons with the hex-values when looking at the file. Thanks again for the hint about the argument :-)
    – er4z0r
    Feb 6, 2011 at 11:39
1

As far as I can figure out, intel FORTRAN-compiled objects use a cputype 16777223 but gcc-compiled objects use a cputype of 7

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .