fileXray contains over two dozen built-in “filters” that allow you to locate file system objects on an HFS+ volume using a variety of criteria. A filter is a piece of code that gets executed by fileXray for each file system object as fileXray rapidly runs through the entire file system hierarchy of an HFS+ volume. One of these is the Mach-O filter, which lists all Mach-O files on a given volume.
The Mach-O filter differs from most fileXray filters in that it examines file content along with file metadata. After identifying a file as a Mach-O file, the filter further examines it to check if it is a multi-architecture (“fat”) file. If so, the filter calculates the logical size of each architecture-specific thin subfile contained within the fat file. The filter enumerates the following architectures:
arm. Any other architecture found in a Mach-O file (say, a NeXT binary—if you have some lying around on the volume) is categorized as “other”. You can optionally specify a list of specific architectures as a filter argument, in which case the filter would only show files containing at least one of the specified architectures.
Using the Mach-O filter, you can answer questions such as the following.
- Does this HFS+ volume, which is meant for storing media files, contain any Mach-O executables?
- Are there any ARM executables or libraries on this volume?
- What is the total logical space being consumed by PowerPC exectuables and libraries on this volume?
The following is an example of using the Mach-O filter.
$ sudo fileXray --filter builtin:macho --volume /Volumes/MacHD i386 x86_64 ppc ppc64 arm other path … 592 504 668 0 584 0 MacHD:/usr/lib/bundle1.o 888 936 972 0 1072 0 MacHD:/usr/lib/crt1.10.5.o 688 816 696 0 880 0 MacHD:/usr/lib/crt1.10.6.o 2112 1840 3480 0 1620 0 MacHD:/usr/lib/crt1.o ...