Here is a list of tools commonly used to work with the disassembly of samples:
- IDA: Just like with Windows and Linux, this powerful tool can also be used to analyze Mach-O files.
- Hopper: This product actually started from the Mac platform, so the authors are perfectly familiar with its internals. It features both a disassembler and decompiler and supports both the Objective-C and Swift languages.
- radare2: A strong open-source alternative to the previous tools, this framework allows engineers to disassemble and analyze Mach-O files:
Figure 6: An example of the disassembled Mach-O file for the ARM platform in radare2
In order to load 64-bit ARM Mach-O sample (either as a standalone thin or as part of a fat binary), use -a arm -b 64 arguments.
- RetDec: This cross-platform decompiler supports multiple file formats, including Mach-O, for several architectures.
- Ghidra: A newcomer in the arsenal of reverse-engineers, Ghidra also supports Apple executables.
