Skip to content

Instantly share code, notes, and snippets.

@bruienne
Created January 25, 2018 17:08
Show Gist options
  • Star 10 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save bruienne/5f84cfa559ca957dc2943c33a3098149 to your computer and use it in GitHub Desktop.
Save bruienne/5f84cfa559ca957dc2943c33a3098149 to your computer and use it in GitHub Desktop.
Find 32-bit executables in a given path. Uses the macholib module that ships with macOS.
#!/usr/bin/python
from macholib import MachO
import macholib
import os
import sys
path = sys.argv[1]
for root, dirs, files in os.walk(path):
for file in files:
abs_path = os.path.join(root,file)
if os.access(abs_path, os.X_OK):
try:
macho = MachO.MachO(abs_path)
except (ValueError, KeyError):
break
if len(macho.headers) == 1:
if not isinstance(macho.headers[0].mach_header(), macholib.mach_o.mach_header_64):
print('%s' % abs_path)
@bruienne
Copy link
Author

To run:

$ sudo ./find32bit.py </Some/Path>

Output is a newline-separated list of 32-bit only executables. You can double-check the results by running the list through file:

$ file </path/to/some/binary>
</path/to/some/binary>: Mach-O bundle i386

Let vendors know about any 32-bit binaries or libraries you find.

@aschwanb
Copy link

Thank you very much for that handy script.
I'm seeing the following error when running it against an applications folder with adobe installed:

/Applications/Adobe Illustrator CC 2017/Adobe Illustrator.app/Contents/Frameworks/AdobePSL.framework/Versions/A/Required/AdobeQTServer.app/Contents/MacOS/AdobeQTServer
Traceback (most recent call last):
  File "./find32bit.py", line 15, in <module>
    macho = MachO.MachO(abs_path)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/macholib/MachO.py", line 69, in __init__
    self.load(fp)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/macholib/MachO.py", line 76, in load
    header = struct.unpack('>I', fh.read(4))[0]
struct.error: unpack requires a string argument of length 4

Any idea on how to work around that problem?

@lazymutt
Copy link

lazymutt commented Apr 3, 2018

I modified the script to address the issue @aschwanb (and I) were seeing.

Since you can't seem to PR a gist, here it is: https://gist.github.com/lazymutt/d6b145f14437e9eae1e7174058618b1f

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment