File formats and APIs

Now, it is time to dive deep into various file formats widely used in Apple operating systems to manage executables. Knowing their structure will help in static analysis; it becomes possible to know exactly where to search for particular artifacts of interest. In terms of dynamic analysis, the knowledge about the structure is particularly useful, as this way, we know how to run the sample properly and the order in which the code is going to be executed, so we won't miss an important part of the functionality.

Mach-O

This format is the main executable format on macOS and iOS operating systems. It's pretty much the same as PE on Windows or ELF on Linux-based systems. It is also used to store...