fileXray Example: The Mach-O Filter

fileXray contains over two dozen built-in “filters” that allow you to locate file system objects on an HFS+ volume using a variety of criteria. A filter is a piece of code that gets executed by fileXray for each file system object as fileXray rapidly runs through the entire file system hierarchy of an HFS+ volume. One of these is the Mach-O filter, which lists all Mach-O files on a given volume.

The Mach-O filter differs from most fileXray filters in that it examines file content along with file metadata. After identifying a file as a Mach-O file, the filter further examines it to check if it is a multi-architecture (“fat”) file. If so, the filter calculates the logical size of each architecture-specific thin subfile contained within the fat file. The filter enumerates the following architectures: i386, x86_64, ppc, ppc64, and arm. Any other architecture found in a Mach-O file (say, a NeXT binary—if you have some lying around on the volume) is categorized as “other”. You can optionally specify a list of specific architectures as a filter argument, in which case the filter would only show files containing at least one of the specified architectures.

Using the Mach-O filter, you can answer questions such as the following.

  • Does this HFS+ volume, which is meant for storing media files, contain any Mach-O executables?
  • Are there any ARM executables or libraries on this volume?
  • What is the total logical space being consumed by PowerPC exectuables and libraries on this volume?

The following is an example of using the Mach-O filter.

$ sudo fileXray --filter builtin:macho --volume /Volumes/MacHD
i386    x86_64   ppc      ppc64    arm      other      path      
…
592     504      668      0        584      0          MacHD:/usr/lib/bundle1.o
888     936      972      0        1072     0          MacHD:/usr/lib/crt1.10.5.o
688     816      696      0        880      0          MacHD:/usr/lib/crt1.10.6.o
2112    1840     3480     0        1620     0          MacHD:/usr/lib/crt1.o
...

Comments are closed.


All contents of this site, unless otherwise noted, are ©1994-2014 Amit Singh. All Rights Reserved.