Mach-O Inspector

What it's for

Look inside a Mac or iOS program or library (a Mach-O file): which processors it’s built for, the oldest system it runs on, the libraries it loads, the entitlements it asks for (camera, sandbox, debugging…) and who signed it, as lipo, otool -L and codesign -d would show, without the command line.

For example, when you want to know whether an app runs natively on Apple silicon, who really signed a download, or whether a build you’re about to ship still allows debugging.

How to use it

Choose or drop a program (inside an app, in Contents › MacOS), a .dylib or plug-in, or a zipped app (.zip of a .app, or an .ipa). For a zipped app, its Info.plist gives the name, bundle ID and version, and the program it names is read.

Architectures lists each slice of a universal file; Details for picks the slice described below it (arm64 at first). The list above the details points out what matters: unsigned or ad hoc code, apps without the hardened runtime, entitlements that allow debugging or loosen the runtime’s protections, encrypted App Store code, and Mac programs with no arm64 slice. The signature’s certificates are listed from the signer to Apple’s root, and the page checks that the signer’s key signed the code directory.

Example

In the file dialog, press ⇧⌘G, type /bin/ls and choose it. On macOS 27 the message says ls: program for x86_64, arm64e and arm64 (subtype 12), signed. The details show the identifier com.apple.ls, a signature by macOS Software Signing, three linked libraries starting with /usr/lib/libutil.dylib, and a note that it’s a platform binary, part of Apple’s system software.

Good to know

The signature check covers the code directory, not each page of code, so it doesn’t prove the code hasn’t changed since signing, and it can’t tell whether a certificate has been revoked or whether the app is notarised: use codesign --verify and spctl --assess for that. The designated requirement isn’t decoded. A ZIP over 4 GB can’t be read, and a large app takes a moment as the whole ZIP is opened in memory.