SCANMACHO(1)

📦
version 1.3.11 · 13 versions
, in arch rolling

💅 SCANMACHO(1) — the manual page, but make it cute

okay so first things first bestie, this is part of the pax-utils docs, and the command is literally called scanmacho ✨

🌸 NAME 🌸

scanmacho — a user-space utility that scans Mach-O files 🍓

🎀 SYNOPSIS 🎀

scanmacho [options] Mach-Os or directories

💖 DESCRIPTION 💖

scanmacho is a user-space utility that will quickly scan whatever Mach-Os you hand it — or directories, or the common system paths — and pull out different kinds of info. We're talking Mach-O types, their install_names, all that good stuff. literally so handy 🫶

And here's the thing, because Mach-O files can be "fat" 🍔, a single file can totally return multiple lines. Each line = one single architecture contained inside that fat (universal) file. There aren't any real restrictions on this, but in practice you can tell the entries apart by their arch type, like ppc, ppc64, i386, x86_64, arm, ... iykyk 👑

✨ OPTIONS ✨

  • -A, --archives — scan archives (.a files) 📦
  • -a, --all — print all the useful/simple info, the whole vibe check
  • -B, --nobanner — don't display the header, we're skipping the intro
  • -b, --bind — print the flags from mach_header
  • -D, --endian — print the Mach-O endianness
  • -E, --etype filetype — only print Mach-O files that match the etype you specified (like MH_EXECUTABLE, MH_DYLIB, etc...)
  • -F, --format FORMAT — use your specified format for output; peep the FORMAT section below for the deets 👀
  • -f, --from FILE — read the input stream from the filename you specified
  • -g, --gmatch — use strncmp to match libraries (use with -N). Or regexp with symbol matching
  • -h, --help — show condensed usage and dip
  • -i, --interp — print the interpreter information (LC_LOAD_DYLINKER)
  • -M, --bits BITS — only print Mach-O files matching the numeric bits you gave (like 32/64)
  • -m, --mount — don't recursively cross mount points, we stay in our lane
  • -N, --lib INSTALLNAME — find the Mach-Os that need the INSTALL_NAME you specified
  • -n, --needed — print the libraries the Mach-O is linked against (LC_LOAD_DYLIB). bestie reveal 💅
  • -O, --perms PERMS — only print Mach-O files with matching specified octal bits (like 755)
  • -o, --file FILE — write the output stream to the filename you specified
  • -p, --path — scan all the directories in the PATH environment
  • -q, --quiet — only output the 'bad' things. no fluff, only drama 💀
  • -R, --recursive — scan directories recursively, go deep
  • -r, --rpath — print the RPATH encoded in the Mach-O (LC_RPATH)
  • -S, --soname — print the Mach-O's shared library name (install_name)
  • -V, --version — print version and exit
  • -v, --verbose — be verbose (you can use this more than once, stack it up 🔥)
  • -y, --symlink — don't scan symlinks
  • -Z, --size SIZE — print Mach-O file size

🌈 FORMAT 🌈

So the format string is basically a printf string — a literal string, but with flags in it requesting different pieces of info. Like, you could use a format string and expect the following results:

# scanmacho -BF "file %f needs %n; funky time" /bin/bash
file bash needs /usr/lib/libncurses.5.4.dylib,/usr/lib/libSystem.B.dylib; funky time
ok important note bestie 🙈 — when you use a format string, you should generally omit the information-related flags. Like, you do NOT want to try requesting NEEDED output (-n) AND specify a format output at the same time, because those operations are mutually exclusive. Each information-related flag has an equivalent conversion specifier, so just use those instead, periodt. You can of course keep using the non-information-related flags (like --verbose), those are chill. ✨

There are three characters that introduce conversion specifiers:

  • % — replace with info
  • # — silent boolean match
  • + — verbose match

And there's a whole bunch of conversion specifiers. We try to match up each specifier with its corresponding option:

  • a — arch type
  • b — mach_header flags
  • D — endian
  • F — long filename
  • f — short filename
  • i — dyld
  • M — CPU_TYPE class
  • N — specified needed
  • n — needed libraries
  • p — filename (minus search)
  • o — mh_type
  • O — perms
  • r — rpaths
  • S — install_name

🦋 MACH-O FILETYPES 🦋

You can narrow your search by specifying the Mach-O object file type. The commandline option takes the symbolic type name. Multiple values can be passed comma separated. Example -E MH_EXECUTE,MH_DYLIB

Here's the normal list, available for your pleasure 👑

  • MH_OBJECT — intermediate object file (.o)
  • MH_EXECUTE — standard executable program
  • MH_BUNDLE — dlopen plugin (.bundle)
  • MH_DYLIB — dynamic shared library (.dylib)
  • MH_PRELOAD — executable not loaded by Mac OS X kernel (ROM)
  • MH_CORE — program crash core file
  • MH_DYLINKER — dynamic linker shared library (dyld)
  • MH_DYLIB_STUB — shared library stub for static only, no sections
  • MH_DSYM — debug symbols file (in .dSYM dir)

🧚 MACH-O BITS 🧚

You can also narrow your search by specifying the Mach-O bitsize. Just specify the numeric value.

  • 32 — 32bit mach_header
  • 64 — 64bit mach_header_64

⭐ HOMEPAGE ⭐

https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities

💜 REPORTING BUGS 💜

Please include as much information as possible (using any available debugging options) and send bug reports to the maintainers (see the AUTHORS section). Please use the Gentoo bugzilla at https://bugs.gentoo.org/ if possible. fr fr they want the details 🫶

🌸 SEE ALSO 🌸

chpax(1), dumpelf(1), paxctl(1), pspax(1), readelf(1), scanelf(1), elf(5)

👑 AUTHORS 👑

  • Ned Ludd <solar@gentoo.org> — Maintainer
  • Mike Frysinger <vapier@gentoo.org> — Maintainer
  • Fabian Groffen <grobian@gentoo.org> — Mach-O Maintainer

🎀 NOTES 🎀

  1. https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities
  2. https://bugs.gentoo.org/

and that's the whole page bestie, no cap 💅 ok bye ily, this was pax-utils version 1.3.11, dated 08/02/2026 — slay 🌈✨🦋

📦 where this page comes from