   _____                .__              ________   
  /     \ _____    ____ |  |__           \_____  \  
 /  \ /  \\__  \ _/ ___\|  |  \   ______  /   |   \ 
/    Y    \/ __ \\  \___|   Y  \ /_____/ /    |    \
\____|__  (____  /\___  >___|  /         \_______  /
        \/     \/     \/     \/                  \/ 
__________.__               .__        
\______   \  |  __ __  ____ |__| ____  
 |     ___/  | |  |  \/ ___\|  |/    \ 
 |    |   |  |_|  |  / /_/  >  |   |  \
 |____|   |____/____/\___  /|__|___|  /
                    /_____/         \/ 
 
(c) 2011, fG! - reverser@put.as - http://reverse.put.as

This is a very simple IDA plugin to display Mach-O header information.
A custom view is created with this information and the header fields inside the IDA
disassembly are commented and put together.
It's more or less a port of otool functionality into IDA.
Never understood why IDA doesn't solve executable headers :-)
Supports x86, x86_64, ppc, arm (iOS) mach-o binaries.

Some commands aren't implemented (obsolete/rare ones) and the LC_UNIXTHREAD/LC_THREAD
for now only displays thread state flavors (the most common case).

The 64bits version has some problems in the header comments.
I can't get the Quadro word command to work right (bug?).

Tested with Mac OS X version and Windows. Should also work in Linux :-)

To compile for OS X use the Makefile or the XCode Project.
You will need to edit the Makefile or the XCode project and set the paths to the SDK.
Refer to http://reverse.put.as/2011/10/31/how-to-create-ida-cc-plugins-with-xcode/ for XCode.
Set the environment variable __EA64__ if you want the plugin for IDA 64bits.

For Windows, DEVC++ project file is included for IDA 32 and 64 bits versions.
You will need to edit the DEVC++ project and set the paths to the SDK and plugin binary output.
Please refer to http://www.binarypool.com/idapluginwriting/ for more information.
You should do a Rebuild All in DEVC++ (especially if you switch from 32 to 64 project or vice-versa).

The default shortcut is set to Alt+X. You maybe want to modify it.
Edit IDAP_hotkey at machoplugin.cpp to your preference.

Bug reports, fixes and patches are welcome: reverser@put.as

That's it! Enjoy :-)
fG!