Mach-O file signature
Magic number at the start of the file
Mach-O is the executable format on macOS and iOS. The magic is feedface or feedfacf, byte-swapped by endianness, so a modern 64-bit little-endian Mac binary starts CF FA ED FE.
What this magic number means
A magic number is a short, fixed run of bytes at a known position that tells a program what a file really is, no matter what the filename says. If a file starts with the bytes CF FA ED FE, it is a Mach-O file.
A universal (fat) binary that bundles several architectures instead starts with CA FE BA BE, the same bytes as a Java class file. See the CAFEBABE signature page for how they are told apart.
What each byte of CF FA ED FE means
Here is the signature byte by byte, the way a hex editor shows it: the position in the file, the value in hex and in decimal, and the character that value stands for in ASCII. Bytes with no printable character show a dot.
| Byte offset | Hex | Decimal | ASCII |
|---|---|---|---|
| 0 | CF | 207 | . |
| 1 | FA | 250 | . |
| 2 | ED | 237 | . |
| 3 | FE | 254 | . |
Signature variants
Mach-O appears with more than one byte pattern. These all identify the same family:
| Hex signature | Offset | Note |
|---|---|---|
| FE ED FA CE | 0 | 32-bit, big-endian |
| FE ED FA CF | 0 | 64-bit, big-endian |
| CE FA ED FE | 0 | 32-bit, little-endian |
| CF FA ED FE | 0 | 64-bit, little-endian (typical on modern macOS) |
Formats that use the CF FA ED FE signature
No extension in our database is documented under this signature: the bytes belong to the Mach-O format itself, which usually appears as a wrapper around something else. Files that carry it are normally named dylib, bundle.
How to check a file's signature
You can read the bytes of any file yourself. They are shown in hex, the same way this page lists them.
Linux & macOS
- xxd -l 16 example.dylib
- hexdump -C -n 16 example.dylib
- file example.dylib
Windows (PowerShell)
- Format-Hex -Path example.dylib -Count 16
Python
- open("example.dylib","rb").read(4).hex()
In your browser
- Drop the file into the WhatFileType identifier, which reads the signature without uploading it.
Frequently asked questions
What is the Mach-O file signature?
Mach-O files start with the hex bytes CF FA ED FE. This magic number identifies the format regardless of the file's name or extension.
How do I check a file's magic number?
Open the file in a hex editor, or run a command such as xxd -l 16 example.dylib on Linux or macOS, or Format-Hex -Path example.dylib -Count 16 in Windows PowerShell, and read the first bytes.
Can a file fake the Mach-O signature?
Renaming a file does not change its bytes, so the extension can lie but the signature usually cannot. A genuine Mach-O file has these exact bytes; a file with the wrong bytes is not really Mach-O, whatever its name says.
Related signatures
Sources
Reuse this signature
This entry is part of the WhatFileType file signature reference, published under a CC BY 4.0 licence with the full provenance for every entry, a copy-paste embed and a JSON export. Credit WhatFileType and the data is yours to republish.