From: Charles Davis Subject: [PATCH] kernel32: Recognize 64-bit Mach-O modules, too. Message-Id: <1421994657-3972-2-git-send-email-cdavis5x@gmail.com> Date: Thu, 22 Jan 2015 23:30:55 -0700 64-bit Mach-O modules have the low bit set in their magic (in addition to having a bit set in their cputype fields). --- dlls/kernel32/module.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/dlls/kernel32/module.c b/dlls/kernel32/module.c index 2a87e66..f495e81 100644 --- a/dlls/kernel32/module.c +++ b/dlls/kernel32/module.c @@ -289,10 +289,11 @@ void MODULE_get_binary_info( HANDLE hfile, struct binary_info *info ) } } /* Mach-o File with Endian set to Big Endian or Little Endian */ - else if (header.macho.magic == 0xfeedface || header.macho.magic == 0xcefaedfe) + else if (header.macho.magic == 0xfeedface || header.macho.magic == 0xcefaedfe || + header.macho.magic == 0xfeedfacf || header.macho.magic == 0xcffaedfe) { if ((header.macho.cputype >> 24) == 1) info->flags |= BINARY_FLAG_64BIT; - if (header.macho.magic == 0xcefaedfe) + if (header.macho.magic == 0xcefaedfe || header.macho.magic == 0xcffaedfe) { header.macho.filetype = RtlUlongByteSwap( header.macho.filetype ); header.macho.cputype = RtlUlongByteSwap( header.macho.cputype ); -- 2.2.2