devzkndeMacBook-Pro:mach-o devzkn$ tree -L 4
.
├── arch.h
├── arm64
│   └── reloc.h
├── compact_unwind_encoding.h
├── dyld.h
├── dyld_images.h
├── fat.h
├── getsect.h
├── i386
│   └── swap.h
├── ldsyms.h
├── loader.h
├── module.map
├── nlist.h
├── ppc
│   ├── reloc.h
│   └── swap.h
├── ranlib.h
├── reloc.h
├── stab.h
├── swap.h
└── x86_64
    └── reloc.h

struct mach_header_64 {
	uint32_t	magic;		/* mach magic number identifier */
	cpu_type_t	cputype;	/* cpu specifier */
	cpu_subtype_t	cpusubtype;	/* machine specifier */
	uint32_t	filetype;	/* type of file */
	uint32_t	ncmds;		/* number of load commands */
	uint32_t	sizeofcmds;	/* the size of all the load commands */
	uint32_t	flags;		/* flags */
	uint32_t	reserved;	/* reserved */
};

file 就是根据Magic 来判断的
file ~/tmp
/Users/devzkn/tmp: Mach-O universal binary with 2 architectures: [arm_v7:Mach-O dynamically linked shared library arm_v7] [arm64:Mach-O 64-bit dynamically linked shared library arm64]

<!-- 所有 commands 的大小总和即为 Header->sizeofcmds 字段，共有 Header->ncmds 条加载命令。 -->
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
 0xfeedface      12          9  0x00           6    33       3640 0x00100085

<!-- 看加载命令区 -->
devzkndeMacBook-Pro:~ devzkn$ otool -l tmp
tmp (architecture armv7):
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
 0xfeedface      12          9  0x00           6    33       3640 0x00100085

<!--LC_SEGMENT_64  将对应的段中的数据加载并映射到进程的内存空间去 -->
Load command 0
      cmd LC_SEGMENT
  cmdsize 668
  segname __TEXT
   vmaddr 0x00000000
   vmsize 0x00044000

   Load command 1
      cmd LC_SEGMENT
  cmdsize 1144
    segname __DATA
Load command 2
      cmd LC_SEGMENT
  cmdsize 56
  segname __LINKEDIT
   vmaddr 0x0004c000
   vmsize 0x00028000
  fileoff 311296
 filesize 154080
  maxprot 0x00000001
 initprot 0x00000001
   nsects 0
    flags 0x0
Load command 3
          cmd LC_ID_DYLIB
      cmdsize 84
         name /Library/MobileSubstrate/DynamicLibraries/.dylib (offset 24)
   time stamp 1 Thu Jan  1 08:00:01 1970
      current version 1.0.0
compatibility version 1.0.0

Load command 4
            cmd LC_DYLD_INFO_ONLY
        cmdsize 48
     rebase_off 311296

<!-- 符号表信息 -->
Load command 5
     cmd LC_SYMTAB
 cmdsize 24
  symoff 323260
   nsyms 4023
  stroff 372600
 strsize 76988
 <!-- LC_DYSYMTAB符号表  动态符号表信息
 -->
Load command 6
            cmd LC_DYSYMTAB
        cmdsize 80
      ilocalsym 0
<!-- 唯一的 UUID，标示该二进制文件，128bit -->
Load command 7
     cmd LC_UUID
 cmdsize 24
    uuid 5A3F7C11---ADC9-

<!-- 要求的最低系统版本（Xcode中的Deployment Target） -->
Load command 8
      cmd LC_VERSION_MIN_IPHONEOS
  cmdsize 16
  version 9.1
      sdk 10.3

Load command 9
      cmd LC_SOURCE_VERSION
  cmdsize 16
  version 0.0
  <!-- 加密信息   grep cryptid 可以查看是否加密。 -->
Load command 10
          cmd LC_ENCRYPTION_INFO
      cmdsize 20
     cryptoff 16384
    cryptsize 262144
      cryptid 0
<!-- 加载的动态库，包括动态库地址、名称、版本号等 load a dynamically linked shared library,load a dynamically linked shared library that is allowed to be missing -->
Load command 11
          cmd LC_LOAD_DYLIB
      cmdsize 96
         name /System/Library/PrivateFrameworks/StoreServices.framework/StoreServices (offset 24) 名称
   time stamp 2 Thu Jan  1 08:00:02 1970
      current version 1440.12.0  版本号
compatibility version 1.0.0

Load command 27
          cmd LC_RPATH
      cmdsize 32
         path @executable_path (offset 12)

         Load command 28
          cmd LC_RPATH
      cmdsize 56
         path /Library/MobileSubstrate/DynamicLibraries (offset 12)
Load command 29
          cmd LC_RPATH
      cmdsize 36
         path /var/mobile/frameworks/ (offset 12)

<!-- 函数地址起始表 -->

Load command 30
      cmd LC_FUNCTION_STARTS
  cmdsize 16
  dataoff 322000
 datasize 852

Load command 31
      cmd LC_DATA_IN_CODE
  cmdsize 16
  dataoff 322852
 datasize 408
 <!-- 代码签名信息 : code_signature-->
Load command 32
      cmd LC_CODE_SIGNATURE
  cmdsize 16
  dataoff 449600
 datasize 15776

命名规则标识段-区的表示方法为(__SEGMENT.__section)SEGMENT所有字母大写，加两个下横线作为前缀；section为小写，同样加两个下横线作为前缀。

devzkndeMacBook-Pro:knMoknKKKKKKokkn.decrypted.4.0 devzkn$ otool -o MKNooJn.dec* |grep password
            name 0x82b11e passwordTextFieldFrame
            name 0x82b135 passwordPlaceholder
                name 0x82b11e passwordTextFieldFrame
                name 0x82b135 passwordPlaceholder
                name 0x82b11e passwordTextFieldFrame
                name 0x82b135 passwordPlaceholder

struct symtab_command {
    uint32_t    cmd;        /* LC_SYMTAB */
    uint32_t    cmdsize;    /* sizeof(struct symtab_command) */
    uint32_t    symoff;        /* symbol table offset */
    uint32_t    nsyms;        /* number of symbol table entries */
    uint32_t    stroff;        /* string table offset */
    uint32_t    strsize;    /* string table size in bytes */
};

<!-- 符号表在 Mach-O目标文件中的地址可以通过LC_SYMTAB加载命令指定的 symoff找到，对应的符号名称在stroff，总共有nsyms条符号信息 -->

__TEXT,__text — the code itself

__TEXT,__cstring — constant strings (in double quotes)

__TEXT,__const — different constants

__DATA,__data — initialized variables (strings and arrays)

__DATA,__la_symbol_ptr — table of pointers to imported functions

__DATA,__bss — non-initialized static variables

__IMPORT,__jump_table — stubs for calls of imported functions

<!-- 代码签名信息 : code_signature-->
Load command 32
      cmd LC_CODE_SIGNATURE
  cmdsize 16
  dataoff 449600
 datasize 15776