macosmach-ootool

What do the flags in a mach-o header refer to?


I was trying out this and I noticed the flags portion of the mach-o header and I was wondering what it did. I tried googling it and found lots of references to it but nothing explaining what the flags are.

If I use otool on a basic hello world compiled clang hello.c then run otool it gives me these flags:

$ otool a.out -h
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
 0xfeedfacf 16777223          3  0x80           2    14        664 0x00200085

For Chess.app

Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
 0xfeedfacf 16777223          3  0x80           2    32       4576 0x00210085

What are the flags here? Where do I find out the answer to things like this?


Solution

  • They're defined and documented in Apple's source code in < mach-o/loader.h >

    /* Constants for the flags field of the mach_header */
    #define MH_NOUNDEFS 0x1     /* the object file has no undefined
                           references */
    #define MH_INCRLINK 0x2     /* the object file is the output of an
                           incremental link against a base file
                           and can't be link edited again */
    #define MH_DYLDLINK 0x4     /* the object file is input for the
                           dynamic linker and can't be staticly
                           link edited again */
    #define MH_BINDATLOAD   0x8     /* the object file's undefined
                           references are bound by the dynamic
                           linker when loaded. */
    #define MH_PREBOUND 0x10        /* the file has its dynamic undefined
                           references prebound. */
    #define MH_SPLIT_SEGS   0x20        /* the file has its read-only and
                           read-write segments split */
    #define MH_LAZY_INIT    0x40        /* the shared library init routine is
                           to be run lazily via catching memory
                           faults to its writeable segments
                           (obsolete) */
    #define MH_TWOLEVEL 0x80        /* the image is using two-level name
                           space bindings */
    #define MH_FORCE_FLAT   0x100       /* the executable is forcing all images
                           to use flat name space bindings */
    #define MH_NOMULTIDEFS  0x200       /* this umbrella guarantees no multiple
                           defintions of symbols in its
                           sub-images so the two-level namespace
                           hints can always be used. */
    #define MH_NOFIXPREBINDING 0x400    /* do not have dyld notify the
                           prebinding agent about this
                           executable */
    #define MH_PREBINDABLE  0x800           /* the binary is not prebound but can
                           have its prebinding redone. only used
                                               when MH_PREBOUND is not set. */
    #define MH_ALLMODSBOUND 0x1000      /* indicates that this binary binds to
                                               all two-level namespace modules of
                           its dependent libraries. only used
                           when MH_PREBINDABLE and MH_TWOLEVEL
                           are both set. */ 
    #define MH_SUBSECTIONS_VIA_SYMBOLS 0x2000/* safe to divide up the sections into
                            sub-sections via symbols for dead
                            code stripping */
    #define MH_CANONICAL    0x4000      /* the binary has been canonicalized
                           via the unprebind operation */
    #define MH_WEAK_DEFINES 0x8000      /* the final linked image contains
                           external weak symbols */
    #define MH_BINDS_TO_WEAK 0x10000    /* the final linked image uses
                           weak symbols */
    
    #define MH_ALLOW_STACK_EXECUTION 0x20000/* When this bit is set, all stacks 
                           in the task will be given stack
                           execution privilege.  Only used in
                           MH_EXECUTE filetypes. */
    #define MH_ROOT_SAFE 0x40000           /* When this bit is set, the binary 
                          declares it is safe for use in
                          processes with uid zero */
    
    #define MH_SETUID_SAFE 0x80000         /* When this bit is set, the binary 
                          declares it is safe for use in
                          processes when issetugid() is true */
    
    #define MH_NO_REEXPORTED_DYLIBS 0x100000 /* When this bit is set on a dylib, 
                          the static linker does not need to
                          examine dependent dylibs to see
                          if any are re-exported */
    #define MH_PIE 0x200000         /* When this bit is set, the OS will
                           load the main executable at a
                           random address.  Only used in
                           MH_EXECUTE filetypes. */
    #define MH_DEAD_STRIPPABLE_DYLIB 0x400000 /* Only for use on dylibs.  When
                             linking against a dylib that
                             has this bit set, the static linker
                             will automatically not create a
                             LC_LOAD_DYLIB load command to the
                             dylib if no symbols are being
                             referenced from the dylib. */
    #define MH_HAS_TLV_DESCRIPTORS 0x800000 /* Contains a section of type 
                            S_THREAD_LOCAL_VARIABLES */
    
    #define MH_NO_HEAP_EXECUTION 0x1000000  /* When this bit is set, the OS will
                           run the main executable with
                           a non-executable heap even on
                           platforms (e.g. i386) that don't
                           require it. Only used in MH_EXECUTE
                           filetypes. */
    
    #define MH_APP_EXTENSION_SAFE 0x02000000 /* The code was linked for use in an
                            application extension. */
    
    #define MH_NLIST_OUTOFSYNC_WITH_DYLDINFO 0x04000000
                        /* The external symbols listed in the nlist
                           symbol table do not include all the symbols
                           listed in the dyld info. */
    
    #define MH_SIM_SUPPORT 0x08000000   /* Allow LC_MIN_VERSION_MACOS and
                           LC_BUILD_VERSION load commands with
                           the platforms macOS, iOSMac,
                           iOSSimulator, tvOSSimulator and
                           watchOSSimulator. */