Mach-O Binary MIME Type

What does application/x-mach-binary mean?

The application/x-mach-binary media type identifies a Mach-O, or Mach object, file. Mach-O is the native binary format used for executable code on Apple platforms. The same container can hold a linked executable, a relocatable object, a dynamic library, a loadable bundle, debug data, a core file, or another loader-defined file type.¹²

Apple's format begins with a header that records the target CPU, file type, number and total size of load commands, and flags. Load commands then describe the segments, linked libraries, entry point, symbols, code signature, and other information needed by tools and the dynamic loader.²

How do you identify a Mach-O file?

Check the first four bytes rather than relying on a filename. Apple's public Mach-O headers define separate magic values for 32-bit and 64-bit files, in native or byte-swapped order:²

The CA FE BA BE value is also used by Java class files. A detector must inspect the following fields and validate the structure instead of treating those four bytes as conclusive. A universal binary wraps multiple Mach-O slices, usually so one file can provide code for more than one processor architecture.⁵

Mach-O files frequently have no extension at all. Command-line tools inside an app bundle are a familiar example. Relocatable objects commonly use .o, dynamic libraries use .dylib, and loadable bundles may use .bundle, but those suffixes describe a role or packaging convention rather than a unique MIME mapping. Poly also recognizes the explicit .mach suffix.

On macOS, inspect an unknown file without launching it:

file --mime-type path/to/file
otool -hv path/to/file
otool -l path/to/file
codesign --verify --verbose path/to/file

otool -h prints the Mach header, while -l prints load commands. LLVM's cross-platform llvm-objdump --macho --private-headers provides similar static inspection.⁶⁷

History and registration status

Mach-O grew out of Carnegie Mellon University's Mach work and was refined for NeXT's operating system. NeXT's own developer documentation says Mach object files replaced the 4.3BSD a.out format by default on NEXTSTEP, credits an evolving Carnegie Mellon design, and describes NeXT's enhancements.⁸ NeXTSTEP 1.0 shipped in 1989, so the format was deployed by then.⁹

The format later became the native executable format for Mac OS X and its descendants. Apple describes Mach-O segments as page-oriented regions containing sections, with compiled code conventionally in __TEXT,__text and writable program data in __DATA.¹

The media-type label did not follow the same formal standards path. IANA's current application registry has no entry for application/x-mach-binary.³ Use it when interoperating with systems that recognize the value, but do not assume every HTTP server, browser, or operating system will assign it. application/octet-stream is a common generic fallback for unrecognized binary data.

What is inside a Mach-O file?

The header's filetype field changes how the rest of the file should be interpreted. Apple's definitions include:²

Changing an extension cannot convert one of these roles into another. The CPU type, platform requirements, load commands, symbol bindings, entry point, and code all have to agree with the intended use.

Mach-O is also not the same as an Apple app. A .app is a directory bundle containing resources, metadata, and one or more executables. Its main executable is normally Mach-O, but the bundle as a whole is not one Mach-O file.

Support in Poly

Poly recognizes .mach filenames and maps them to application/x-mach-binary. It can store, sync, share, version, and download these files. Poly intentionally classifies the type as an unknown binary, so processing stops at ordinary file properties:

• The filename and basic properties are searchable.
• Architectures, segments, load commands, linked libraries, symbols, entitlements, signatures, and embedded strings are not extracted or indexed.
• Poly does not generate a thumbnail or provide a Mach-O viewer or disassembler.
• The Poly agent cannot inspect or explain the binary's contents.

For searchable analysis, export a trusted tool's report as a sibling text file. For example, otool -l or llvm-objdump output can be saved as text and handled separately from the original executable.

Can you convert a Mach-O file?

Mach-O contains compiled program code, so there is no general conversion to PDF, text, an image, PE, or ELF. Choose a narrower operation:

• Use lipo or llvm-lipo to inspect or extract architecture slices from a universal binary.
• Use otool, nm, or llvm-objdump to export headers, symbols, relocations, or disassembly as text.
• Rebuild from source for a different CPU or operating system.
• Preserve a signed original if you need to verify provenance. Editing load commands, removing slices, or otherwise changing bytes can invalidate its code signature.

A disassembly is an analysis of machine instructions, not recovered source code. Names, comments, types, build settings, and higher-level structure may have been removed during compilation or stripping.

Security and compatibility

Treat an unfamiliar Mach-O as executable content even if it has a harmless-looking name or no execute permission. Do not launch it merely to identify it. Static analysis tools still parse complex attacker-controlled structures, so inspect hostile samples in an isolated, patched environment.

On macOS, code signing can show whether bytes changed after signing and identify a signer under a particular trust policy. It does not prove that a program is free of vulnerabilities or unsafe behavior.¹⁰ Gatekeeper adds checks for identified developers, notarization, tampering, and known malicious content when downloaded software is opened, but those controls are not a substitute for verifying the source and purpose of a binary.¹¹

Compatibility depends on more than the arm64 or x86_64 slice name. Mach-O load commands can declare a minimum operating-system version and platform, while the binary may rely on specific libraries, entitlements, CPU features, or runtime behavior. Use otool -l or llvm-objdump to inspect those requirements before assuming a file will run on another Apple device.