# XMachOViewer: a Mach-O viewer for Windows, Linux and macOS

> XMachOViewer is a MIT licensed C++ application that opens a Mach-O file and shows its headers, load commands, sections, symbol table and linked libraries, disassembles it for x86 and ARM, PowerPC and m68k, and answers the questions people actually ask about an unfamiliar binary, such as whether it is packed, which hashes it has and whether it contains cryptographic signatures.

**horsicq/XMachOViewer** —  XMachOViewer is a Mach-O viewer for Windows, Linux and MacOS

- Repository: https://github.com/horsicq/XMachOViewer
- Website: http://ntinfo.biz
- Stars: 970 · Forks: 73
- Language: C++
- License: MIT
- Published: 2026-10-20 · Updated: 2026-10-20 · Language: en
- Canonical page: https://hysenlabs.com/projects/horsicq-xmachoviewer

## A format viewer that runs on the machine you are at

XMachOViewer is a Mach-O viewer for Windows, Linux and macOS, which is the entire premise and the reason the tool exists. Mach-O is the executable format used by macOS, and the tools that understand it are usually macOS tools. That is a slow way to answer a simple question when you are on a Windows box or a Linux CI runner, and XMachOViewer is a C++ application that removes the constraint. The feature list is a list of questions rather than a list of widgets, which tells you how it is meant to be used. It has a Header Viewer giving a detailed view of the Mach-O headers and load commands, a Section Viewer for inspecting and analysing the sections inside the file, a Symbol Table Viewer for the symbols, a Dynamic Library Viewer for the libraries the binary links against, a String Viewer for the readable strings, a Hex Viewer for the raw bytes, and File Format Detection that automatically identifies the format and type of the file. The project is MIT licensed, the site is ntinfo.biz, and the repository is tagged for Hacktoberfest, which is a clue about how contributions have arrived.

## The structural viewers: headers, sections, symbols, libraries

Most of the feature list is about the structure of the file rather than its code, and these are the views that answer the question you actually have when a binary turns up unexpectedly. The Header Viewer gives a detailed view of the Mach-O headers and the load commands, which is where the file tells you what it wants the loader to do, and the Section Viewer lets you inspect and analyse the different sections inside the file. The Symbol Table Viewer displays and analyses the symbol table, so you can see what a binary claims to export and import, and the Dynamic Library Viewer lists the dynamic libraries linked to the Mach-O file, which is how you find out that an application depends on a framework you do not have. The String Viewer shows all the readable strings within the file, which is often the fastest route to a URL, a file path or a version string, and the Hex Viewer is there for when the other views are not enough. File Format Detection sits above all of it, automatically detecting the file format and type, so you can tell whether the file you opened is what you thought it was.

## Disassembly for four architectures in one window

The Disassembly Viewer shows disassembled code for multiple architectures including x86 and x86-64, ARM, PowerPC and m68k, and the breadth is the point. A Mach-O file can be a modern arm64 binary from a current Mac, an x86-64 build, a PowerPC build from the last era of Apple workstations, or a 68k binary from the original Macintosh, and a viewer that only handles the first two leaves you stuck on the rest. The architecture support is also the practical reason to run the tool on a machine that is not a Mac, since the older targets are exactly the ones you would not have a current development environment for. The name demangling feature belongs with the disassembly view, because a mangled symbol name is unreadable until it is converted back to its original form, and the tool does that conversion for you, which is what makes the symbol table view useful rather than a wall of names.

## The questions people ask about an unfamiliar binary

Four features in the list answer the questions that come up when you are handed a binary you did not build. The Entropy Viewer analyses entropy to detect packed or encrypted sections, and it is the fastest way to notice that a section is compressed or obfuscated without reading any code. The Heuristic Scan automatically detects various characteristics and anomalies in the file, which is the automated version of the same suspicion, scanning for structural oddities across the file. The Hash Viewer computes and displays various hashes of the file content, MD5, SHA1 and SHA256, so you can compare a file you have against a reference without a command line. And Crypto Search looks for common cryptographic signatures, which is how you find out that a binary contains an embedded key or a constant that looks like one, something that is useful precisely because it is a pattern search rather than a semantic analysis. Between them, these four turn the viewer from a curiosity into something you can use for triage.

## Building it, and how the dependencies are arranged

Building is documented in the repository rather than in the readme, in a BUILD.md file under the doc directory, and the project is built with CMake, with a CMakeLists.txt at the root. The tree shows a dep directory for the third party code and a .gitmodules file, so the dependencies are pulled in as submodules rather than vendored by hand, which is the arrangement that lets a binary analysis tool keep its libraries current without a large merge. The source is in src, resources in res, a build directory, and a release_version.txt file that holds the version. The user interface is a translation project in its own right, with a translations directory in the repository and a badge pointing at the XTranslation project, where the readme asks for help. For a tool built by one developer with an audience spread across languages, routing the localisation through a separate translation platform rather than through pull requests is the workable arrangement, and it is why the readme's only contribution instruction is about translation.

## Where the project stands, and the naming of its releases

The release history needs reading carefully, because the tags are not conventional version numbers. The releases page lists Beta from 2025-04-20, 0.04 from 2022-08-06 and 0.03 from 2022-01-28, and the readme links a latest SemVer badge to the same page. So the last numbered release is 0.04, there is a Beta tag after it, and the last push was on 2026-10-19, which means the code is being worked on well after the last version anybody can install from a tag. For a tool whose value is its file format coverage, that gap matters less than it would for a library, because the parsing code changes when the format or the toolchain does. The documentation set is small and practical, a BUILD.md, a RUN.md with instructions for the xmachoviewer command, a changelog.txt and a set of screenshots in the doc directory, and the readme credits PELock Software Protection and Reverse Engineering. The download itself comes from the releases page, so the practical advice for a new user is to take the newest build there and read the changelog to see what changed since the numbered release.

## Conclusion

XMachOViewer is worth installing if you handle macOS binaries on a Windows or Linux workstation, because the same viewer runs everywhere and the alternative is usually a Mac or a command line toolchain you do not have. It is the wrong choice if you need to patch or sign binaries, since it is a viewer rather than an editor, and note that the newest numbered release is from 2022 even though the code is still being changed. Before you rely on it, read the changelog file for what changed after the last tag, and check the disassembly view against a binary you already understand.

## FAQ

### What is XMachOViewer?

It is a Mach-O viewer for Windows, Linux and macOS, written in C++ and MIT licensed. It shows the headers and load commands, sections, symbol table and linked libraries, the strings and raw hex, and it computes hashes, analyses entropy and searches for cryptographic signatures.

### Which architectures can XMachOViewer disassemble?

The Disassembly Viewer handles x86 and x86-64, ARM, PowerPC and m68k, which covers current Apple silicon binaries, older Intel builds, PowerPC era software and original Macintosh binaries in the same tool.

### How do I check whether a Mach-O file is packed or encrypted?

Use the Entropy Viewer, which analyses entropy to detect packed or encrypted sections, and the Heuristic Scan, which automatically detects characteristics and anomalies across the file. The Crypto Search feature then looks for common cryptographic signatures inside the binary.

### How do I build XMachOViewer?

The build instructions are in the BUILD.md document in the doc directory of the repository. The project is built with CMake, with a CMakeLists.txt at the root and its third party dependencies held in the dep directory and pulled in as submodules.

### Where do I download XMachOViewer and how do I run it?

Downloads are on the project's releases page, and the usage instructions for the xmachoviewer command are in the RUN.md document in the doc directory. The changelog is kept in changelog.txt in the repository root.

## Sources

- [horsicq/XMachOViewer on GitHub](https://github.com/horsicq/XMachOViewer)
- [License: MIT](https://github.com/horsicq/XMachOViewer/blob/master/LICENSE)
- [Project website](http://ntinfo.biz)
- [README](https://github.com/horsicq/XMachOViewer/blob/master/README.md)
- [Releases](https://github.com/horsicq/XMachOViewer/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/horsicq-xmachoviewer