home | help 
SCANMACHO(1)		   Documentation for pax-utils		    SCANMACHO(1)

NAME
     scanmacho - user-space utility to scan Mach-O files

SYNOPSIS
     scanmacho [options] Mach-Os or directories

DESCRIPTION
     scanmacho	is  a user-space utility to quickly scan given Mach-Os, directo-
     ries, or common system paths for different information.  This  may  include
     Mach-O types, their install_names, etc...

     Because  Mach-O files can be "fat", it is possible for a single file to re-
     turn multiple lines. Each line represents a single architecture,  contained
     in the fat (universal) file. While there are no real restrictions, in prac-
     tice, the entries can be distinguished by their arch type, e.g. ppc, ppc64,
     i386, x86_64, arm, ...

OPTIONS
     -A, --archives
	 Scan archives (.a files)

     -a, --all
	 Print all useful/simple info

     -B, --nobanner
	 Don't display the header

     -b, --bind
	 Print flags from mach_header

     -D, --endian
	 Print Mach-O endianness

     -E, --etype filetype
	 Print	only  Mach-O files matching specified etype (like MH_EXECUTABLE,
	 MH_DYLIB, etc...)

     -F, --format FORMAT
	 Use specified format for output; see the FORMAT section for more infor-
	 mation.

     -f, --from FILE
	 Read input stream from specified filename

     -g, --gmatch
	 Use strncmp to match libraries (use with -N).	Or  regexp  with  symbol
	 matching

     -h, --help
	 Show condensed usage and exit

     -i, --interp
	 Print the interpreter information (LC_LOAD_DYLINKER)

     -M, --bits BITS
	 Print only Mach-O files matching specified numeric bits (like 32/64)

     -m, --mount
	 Don't recursively cross mount points

     -N, --lib INSTALLNAME
	 Find Mach-Os that need the specified INSTALL_NAME

     -n, --needed
	 Print libraries the Mach-O is linked against (LC_LOAD_DYLIB).

     -O, --perms PERMS
	 Print only Mach-O files with matching specified octal bits (like 755).

     -o, --file FILE
	 Write output stream to specified filename.

     -p, --path
	 Scan all directories in PATH environment.

     -q, --quiet
	 Only output 'bad' things.

     -R, --recursive
	 Scan directories recursively

     -r, --rpath
	 Print RPATH encoded in the Mach-O (LC_RPATH)

     -S, --soname
	 Print the Mach-O's shared library name (install_name).

     -V, --version
	 Print version and exit

     -v, --verbose
	 Be verbose (can be used more than once)

     -y, --symlink
	 Don't scan symlinks

     -Z, --size SIZE
	 Print Mach-O file size

FORMAT
     The  format  string  is  much  like a printf string in that it is a literal
     string with flags requesting different information. For example, you  could
     use a format string and expect the following results.

	   # scanmacho -BF "file %f needs %n; funky time" /bin/bash
	   file bash needs /usr/lib/libncurses.5.4.dylib,/usr/lib/libSystem.B.dylib; funky time

     Note that when you use a format string, generally information related flags
     should  be  omitted.  In  other  words,  you do not want to try and request
     NEEDED output (-n) and try to specify a format output at the same	time  as
     these  operations are mutually exclusive. Each information related flag has
     an equivalent conversion specifier, so use those instead. You can of course
     continue to use non-information related flags (such as --verbose).

     There are three characters that introduce conversion specifiers.

     * % - replace with info
     *	 # - silent boolean match
     *	 + - verbose match

     And there are a number of conversion specifiers. We try  to  match  up  the
     specifier with corresponding option.

     * a - arch type
     *	 b - mach_header flags
     *	 D - endian
     *	 F - long filename
     *	 f - short filename
     *	 i - dyld
     *	 M - CPU_TYPE class
     *	 N - specified needed
     *	 n - needed libraries
     *	 p - filename (minus search)
     *	 o - mh_type
     *	 O - perms
     *	 r - rpaths
     *	 S - install_name

MACH-O FILETYPES
     You  can  narrow your search by specifying the Mach-O object file type. The
     commandline option takes the symbolic type name.  Multiple  values  can  be
     passed comma separated. Example -E MH_EXECUTE,MH_DYLIB

     Here is the normal list available for your pleasure.

     * MH_OBJECT - intermediate object file (.o)
     *	 MH_EXECUTE - standard executable program
     *	 MH_BUNDLE - dlopen plugin (.bundle)
     *	 MH_DYLIB - dynamic shared library (.dylib)
     *	 MH_PRELOAD - executable not loaded by Mac OS X kernel (ROM)
     *	 MH_CORE - program crash core file
     *	 MH_DYLINKER - dynamic linker shared library (dyld)
     *	 MH_DYLIB_STUB - shared library stub for static only, no sections
     *	 MH_DSYM - debug symbols file (in .dSYM dir)

MACH-O BITS
     You  can  also narrow your search by specifying the Mach-O bitsize. Specify
     the numeric value.

     * 32 - 32bit mach_header
     *	 64 - 64bit mach_header_64

HOMEPAGE
     https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities

REPORTING BUGS
     Please include as much information as possible (using any available  debug-
     ging options) and send bug reports to the maintainers (see the AUTHORS sec-
     tion). Please use the Gentoo bugzilla at https://bugs.gentoo.org/ if possi-
     ble.

SEE ALSO
     chpax(1), dumpelf(1), paxctl(1), pspax(1), readelf(1), scanelf(1), elf(5)

AUTHORS
     Ned Ludd <solar@gentoo.org>
	 Maintainer

     Mike Frysinger <vapier@gentoo.org>
	 Maintainer

     Fabian Groffen <grobian@gentoo.org>
	 Mach-O Maintainer

NOTES
      1. https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities

      2. https://bugs.gentoo.org/

pax-utils git			   08/27/2026			    SCANMACHO(1)
home | help