Hacker News new | past | comments | ask | show | jobs | submit login
Tell HN: All macOS executables in /sbin start with 'cafe babe'
16 points by keepamovin 9 months ago | hide | past | favorite | 11 comments

  find /sbin -type f -print0 | xargs -0 -I{} bash -c "xxd {} | head -n 1"
And get:

  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0003 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
  00000000: cafe babe 0000 0002 0100 0007 0000 0003  ................
At least on Darwin Kernel Version 22.5.0: Thu Jun 8 22:22:19 PDT 2023; root:xnu-8796.121.3~7/RELEASE_ARM64_T8103 arm64



https://en.wikipedia.org/wiki/Mach-O#Multi-architecture_bina...

It was previously 0xfeedface. Personally, I quite like 0xdeadbeef (I'm not vegetarian), less morbid than 0xdeadbabe anyway.


"Every class begins with a babe, in a cafe.”

https://aphyr.com/posts/341-hexing-the-technical-interview


They probably are not Java bytecode despite using the same magic number:

https://en.wikipedia.org/wiki/Java_class_file


I hope they are. Or else what is the use of a magic number?



AFAICT the magic number here is cafe babe 0000 0002 0100 0007 0000 0003.


Yes.

The same magic number (0xCAFEBABE) is being used for Java bytecode and Mach-O Multi-architecture binaries:

https://en.wikipedia.org/wiki/Java_class_file

https://en.wikipedia.org/wiki/Mach-O#Multi-architecture_bina...


So 0000 0002 0100 0007 isn’t part of the magic number?


The fact that there's a sole 0000 0003 in there should be a clue :D


(As per Wikipedia, those are CPU type etc)


This is hilarious:D




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: