Odd cputype in /bin/ls binary
I just started with Charlie Miller and Dino Dai Zovi's Mac Hacker's Handbook and was doing the tutorials. This includes getting to know things like 'otool'
otool -f \bin\ls
Fat headers
fat_magic 0xcafebabe
nfat_arch 2
architecture 0
cputype 16777223
cpusubtype 3
capabilities 0x80
offset 4096
size 39600
align 2^12 (4096)
architecture 1
cputype 7
cpusubtype 3
capabilities 0x0
offset 45056
size 35632
align 2^12 (4096)
I tried to find something about that first cputype
in /usr/include/mach/machine.h, but found nothing. Clearly I am missing something.
cputype
16777223 is “x86 64” (64 bit mode); 7 is “i386” (32 bit mode). Incidentally, 16777223 == 0x1000007, so bit 24 means “64 bit”.
Looking in /usr/include/mach/machine.h
(pointed out by …/mach-o/fat.h
, which seems like a reasonable place to start), we find the following:
⋮
typedef integer_t cpu_type_t;
⋮
#define CPU_ARCH_ABI64 0x01000000 /* 64 bit ABI */
⋮
#define CPU_TYPE_X86 ((cpu_type_t) 7)
#define CPU_TYPE_I386 CPU_TYPE_X86 /* compatibility */
#define CPU_TYPE_X86_64 (CPU_TYPE_X86 | CPU_ARCH_ABI64)
⋮
#define CPU_TYPE_POWERPC ((cpu_type_t) 18)
#define CPU_TYPE_POWERPC64 (CPU_TYPE_POWERPC | CPU_ARCH_ABI64)
⋮
Of course, you can also just add the -v
option to your otool
command to have it show the symbolic values:
% otool -vf /bin/ls
Fat headers
fat_magic FAT_MAGIC
nfat_arch 2
architecture x86_64
cputype CPU_TYPE_X86_64
cpusubtype CPU_SUBTYPE_X86_64_ALL
capabilities CPU_SUBTYPE_LIB64
offset 4096
size 39600
align 2^12 (4096)
architecture i386
cputype CPU_TYPE_I386
cpusubtype CPU_SUBTYPE_I386_ALL
capabilities 0x0
offset 45056
size 35632
align 2^12 (4096)
As far as I can figure out, intel FORTRAN-compiled objects use a cputype 16777223 but gcc-compiled objects use a cputype of 7