Mach-O file signature
Magic number at the start of the file
Mach-O is the executable format on macOS and iOS. The magic is feedface or feedfacf, byte-swapped by endianness, so a modern 64-bit little-endian Mac binary starts CF FA ED FE.
What this magic number means
A magic number is a short, fixed run of bytes at a known position that tells a program what a file really is, no matter what the filename says. If a file starts with the bytes CF FA ED FE, it is a Mach-O file.
A universal (fat) binary that bundles several architectures instead starts with CA FE BA BE, the same bytes as a Java class file. See the CAFEBABE signature page for how they are told apart.
Signature variants
Mach-O appears with more than one byte pattern. These all identify the same family:
| Hex signature | Offset | Note |
|---|---|---|
| FE ED FA CE | 0 | 32-bit, big-endian |
| FE ED FA CF | 0 | 64-bit, big-endian |
| CE FA ED FE | 0 | 32-bit, little-endian |
| CF FA ED FE | 0 | 64-bit, little-endian (typical on modern macOS) |
Formats that use the CF FA ED FE signature
No single file extension owns this signature exclusively; it belongs to the Mach-O format itself.
It is also seen in: dylib, bundle.
How to check a file's signature
You can read the first bytes of any file yourself. The magic bytes are shown in hex, the same way this page lists them.
Linux & macOS
- xxd -l 16 example.bin
- hexdump -C -n 16 example.bin
- file example.bin
Windows (PowerShell)
- Format-Hex -Path example.bin -Count 16
Python
- open("example.bin","rb").read(4).hex()
In your browser
- Drop the file into the WhatFileType identifier, which reads the signature without uploading it.
Frequently asked questions
What is the Mach-O file signature?
Mach-O files start with the hex bytes CF FA ED FE. This magic number identifies the format regardless of the file's name or extension.
How do I check a file's magic number?
Open the file in a hex editor, or run a command such as xxd -l 16 example.bin on Linux or macOS, or Format-Hex -Path example.bin -Count 16 in Windows PowerShell, and read the first bytes.
Can a file fake the Mach-O signature?
Renaming a file does not change its bytes, so the extension can lie but the signature usually cannot. A genuine Mach-O file has these exact bytes; a file with the wrong bytes is not really Mach-O, whatever its name says.