MachLift

Native macOS · Static analysis

Understand
the binary.

Explore Apple application binaries.
Follow the code. Recover what the evidence supports.

Download for macOSExplore the documentation

Version 0.1.0 · macOS 14+ on Apple Silicon

ANALYSIS PATHSTATIC / ARM64
  1. 01
    Open an IPAInventory the package. Select an executable.
    INPUT
  2. 02
    Follow the machine codeInstructions, function candidates, resolved targets.
    ANALYZE
  3. 03
    Read what can be recoveredSwift declarations and approximate pseudocode.
    INTERPRET

Evidence stays visible.
Uncertainty stays explicit.

Conceptual workflow · recovery depends on the input and supported semantics.
Built around the evidence
  • Authorized IPA inputs
  • ARM64 / ARM64e
  • Approximate Swift
  • Explicit limitations

A closer look

Make the code
easier to reason about.

Move from package contents to instructions and supported pseudocode, with the underlying evidence in reach.

01Package inventory

Start with the binary.

Open an authorized IPA, inspect its contents, and select the executable you want to understand.

Explore the workflow
02Machine code

Follow the instructions.

Explore ARM64 and ARM64e disassembly, browse function candidates, and follow resolved control-flow targets.

See the current scope
03Approximate recovery

Recover meaning carefully.

Inspect recovered Swift declarations and request approximate Swift-like pseudocode for supported functions.

Understand the evidence

Inside the workspace

The code.
The interpretation.

Real captures from MachLift, analyzing a controlled ARM64 test fixture. Disassembly and approximate Swift-like pseudocode share the same function view.

01 / Arithmetic

From instructions to an expression.

Full resolution
MachLift displaying ARM64 add instructions and approximate Swift-like pseudocode for the demo blend function side by side.
Three ARM64 instructions alongside the generated expression. Register-based parameters and address-derived names remain visible.

02 / Control flow

Follow the branches.

Full resolution
MachLift displaying ARM64 branches, a call and stores alongside conditional pseudocode for the demo classify function.
A conditional function with an early return, a call and memory stores. Its call interpretation depends on assumptions about code outside this function.

The demo was compiled from C for ARM64/macOS and packaged in an IPA-shaped archive. These examples show approximate output, with generated names and explicit assumptions.

Read the code walkthrough

MachLift for Mac

Your next look
inside the binary.

A native workspace for exploring the code.
Download MachLift and start with an authorized IPA.

Download for macOS

Version 0.1.0 3.8 MB DMG
macOS 14+ Apple Silicon

Installation guide

Notarized by Apple

  1. Download & openOpen the MachLift disk image.
  2. Drag to ApplicationsMove MachLift into the Applications shortcut.
  3. Start exploringOpen MachLift from your Applications folder.
Verify your download SHA-256

Compare the file’s SHA-256 with this value:

84ede75252e178e32109cc2bf16adc9adca5294bd89cc62cbaa5802933c942f2Download checksum file

A deliberate approach

Clarity includes
the unknowns.

Compiled code rarely tells the whole story. MachLift keeps approximate recovery, unsupported cases, and unresolved destinations explicit.

How to read the results

Evidence before inference

A decoded instruction, a symbol, and an inferred function tell you different things.

Approximate source, honestly presented

Readable pseudocode helps analysis. It does not promise the original Swift source.

A visible path back to the code

Inspect the disassembly and use address mappings to examine supported recovered output.

The knowledge base

Get to know MachLift.

Start with the requirements, explore the workflow,
and learn what the current analysis can tell you.

Start reading