MachoAnalytics

A macOS command-line utility that breaks down Mach-O ARM binaries and highlights how Swift-generated metadata, code sections, and symbols consume space.

Features

Instant CLI report

• Breaks down every Mach-O section by logical name with byte sizes, symbol counts, and largest contributors.
• Highlights oversized sections with inline ASCII samples plus Swift-specific metadata buckets (__swift5_*).
• Demangles all Swift symbols and produces both raw __TEXT hot spots and per-type ownership tables.
• Accepts optional .dSYM bundles for richer source context when symbolizing stripped binaries.

Interactive ncurses browser (--interactive)

• Full-screen terminal UI with split panes for sections, symbols, and a live hex reader for any byte range.
• Incremental search (/) that filters sections, symbols, and literal text inside each section as you type.
• Toggleable symbol grouping (detailed members vs. type-only rollups) and sort modes (size or module/type/name hierarchy).
• Pop-up inspectors for long descriptions and per-symbol hex dumps, plus ASCII previews for quick content sniffing.
• Colored progress + status bars that stream analysis progress while caches are prepared.

Workflow-friendly options

• --dsym <path> to merge companion dSYM data for better filenames and symbol samples.
• --top-sections and --top-types knobs to tailor how much output you see in both report and interactive modes.

Building

Open MachoAnalytics.xcodeproj in Xcode and build the MachoAnalytics scheme.

Usage

./.build/release/MachoAnalytics <path-to-binary> [--top-sections N] [--top-types N] [--dsym <path>] [--interactive]

Example:

./.build/release/MachoAnalytics /Applications/Notes.app/Contents/MacOS/Notes --top-sections 8 --top-types 25

Interactive walkthrough:

./.build/release/MachoAnalytics /Applications/Notes.app/Contents/MacOS/Notes --interactive --dsym /Applications/Notes.app.dSYM

Flags:

• --top-sections N (default 5) — controls how many large sections appear in the summary.
• --top-types N (default 20) — limits the number of type owners in the aggregation table.
• --dsym PATH — points to the companion dSYM bundle for symbol-rich popups and file hints.
• --interactive — launches the ncurses browser so you can search, scroll, and inspect bytes visually.

The tool prints a single textual report showing:

1. Section totals grouped by name.
2. Top sections (size, description, sample text, symbol counts).
3. Swift-generated text sections.
4. Top __TEXT symbols by size.
5. Top type-heavy owners with their largest members.

Testing Tips

• Run against both debug and release builds to see how optimizations change section composition.
• Compare binaries before/after refactors to spot unusually large types or metadata growth.
• Pair with swift demangle or otool -l for deeper inspection if needed.