MACHO file signature
A Mach-O executable file begins with the bytes CF FA ED FE at the start of the file. The signature is the same whatever the file is named, which is why a renamed or extensionless MACHO file is still recognisable.
Known signatures
| Offset | Hex | ASCII |
|---|---|---|
| 0 | CF FA ED FE64-bit, little-endian; the common form on modern Macs. | |
| 0 | CE FA ED FE32-bit, little-endian. | |
| 0 | CA FE BA BEUniversal (fat) binary holding several architectures. Same bytes as a Java class; the following word disambiguates. |
MIME type: application/x-mach-binary
How to check a file's signature
Without installing anything: drop the file on our detector. It reads the bytes in your browser and shows the hex dump alongside the verdict; nothing is uploaded.
macOS and Linux (Terminal):
xxd -l 32 file
file fileWindows (PowerShell):
Format-Hex -Path file -Count 32If the bytes do not match
A file named macho whose first bytes are something else is not a MACHO file. The common explanations are a wrong or deliberately misleading extension, a download that saved an HTML error page instead of the file, or a container such as ZIP wrapping the real content. The detector reports what the bytes say; the MACHO guide explains what a genuine file should contain.