How to Use the macOS otool Command to Inspect Mach-O Binaries

When engineering software on macOS, compiling a C++ program or auditing a third-party application requires an understanding of how the operating system reads compiled code. On Linux, developers use objdump to inspect ELF binaries. However, macOS uses its own proprietary binary format called Mach-O (Mach Object). If you need to verify which dynamic libraries an application requires, view the assembly instructions of a compiled executable, or check the architectural slice of a Universal Binary, you must use the macOS-specific otool command.

Why Use the otool Command?

The otool (Object File Display Tool) command is a core component of the Xcode command-line utilities. It acts as a mathematical disassembler and binary analysis tool specifically designed for the Mach-O format. Without the source code, otool allows security researchers and systems engineers to mathematically reverse-engineer an executable, extract its load commands, dump its raw assembly code, or prove whether a binary was compiled exclusively for Intel (x86_64) or natively for Apple Silicon (arm64).

Step 1: Verify Binary Architecture

Since the introduction of Apple Silicon, macOS frequently utilizes \”Universal Binaries\” (fat binaries) that mathematically contain both Intel and ARM code in a single file. You can use otool to inspect the architecture.

1. Open the macOS Terminal.
2. Locate an executable file, such as the system’s calculator application: /Applications/Calculator.app/Contents/MacOS/Calculator
3. Run otool with the -f (fat header) flag:

otool -f /Applications/Calculator.app/Contents/MacOS/Calculator

1. Press Enter. The terminal will output the mathematical fat header information, explicitly listing the CPU architectures embedded within the file (e.g., architecture x86_64 and architecture arm64).

Step 2: List Shared Library Dependencies

If an application crashes immediately upon launch with a \”Library not loaded\” error, it is missing a dynamic dependency. You can mathematically map these requirements.

1. Run otool with the -L (List shared libraries) flag on the target executable:

otool -L /bin/bash

1. The tool will mathematically extract the load commands from the Mach-O header and print a list of every single .dylib (dynamic library) and framework the executable physically requires to run (such as /usr/lib/libSystem.B.dylib).

Step 3: Disassemble the Binary (Assembly Code)

For deep security auditing, you can force the tool to mathematically decompile the executable’s text segment back into raw assembly instructions.

1. Use the -t (text segment) and -V (verbose disassembly) flags:

otool -tV /bin/echo

1. Press Enter. The terminal will flood with mathematical assembly code (e.g., pushq %rbp, movq %rsp, %rbp), allowing you to physically analyze the low-level execution logic of the program.

By mastering the otool command, macOS engineers can mathematically dissect proprietary Mach-O binaries, audit dependencies, and debug complex compilation errors.