Get Mach-O binary target platform IDAPython

mach_o.py

import idaapi
import struct

MINIMUM_OS_VERSION_LOAD_COMMAND = 0x32
# https://en.wikipedia.org/wiki/Mach-O#Minimum_OS_version
PLATFORM_TYPES = {
    0x00000001: "macOS",
    0x00000002: "iOS",
    0x00000003: "tvOS",
    0x00000004: "watchOS",
    0x00000005: "bridgeOS",
    0x00000006: "Mac Catalyst",
    0x00000007: "iOS simulator",
    0x00000008: "tvOS simulator",
    0x00000009: "watchOS simulator",
    0x0000000A: "DriverKit",
    0x0000000B: "visionOS",
    0x0000000C: "visionOS simulator"
}

def get_platform() -> str | None:
    start = idaapi.get_imagebase()
    magic = idaapi.get_dword(start)

    if magic == 0xFEEDFACF:
        header_size = 32  # 64-bit Mach-O header size
    else:
        header_size = 28  # 32-bit Mach-O header size

    mach_header = idaapi.get_bytes(start, header_size)
    _, _, _, _, ncmds, sizeofcmds, _, _ = struct.unpack("<IIIIIIII", mach_header)

    offset = start + header_size

    for _ in range(ncmds):
        cmd_header = idaapi.get_bytes(offset, 8)
        if not cmd_header or len(cmd_header) < 8:
            break

        cmd, cmdsize = struct.unpack("<II", cmd_header)

        if cmd == MINIMUM_OS_VERSION_LOAD_COMMAND:
            minimum_os_version_struct = idaapi.get_bytes(offset, 24)
            _, _, platform_type, _, _, _ = struct.unpack("<IIIIII", minimum_os_version_struct)

            return PLATFORM_TYPES.get(platform_type, "Unknown platform")

        offset += cmdsize

    return "Unknown platform"