Mach-O signature (FE ED FA CE / CF, fat: CA FE BA BE)

Apple's Mach-O executable format starts with a magic word: 0xFEEDFACE (32-bit) or 0xFEEDFACF (64-bit), with byte order indicating endianness. Universal ('fat') binaries that bundle multiple architectures begin with 0xCAFEBABE.

aka: Mach-O magic · MH_MAGIC · MH_MAGIC_64 · fat binary · FEEDFACE · FEEDFACF

file signature

magic: FE ED FA CE @ offset 0

ascii: \xfe\xed\xfa\xce

..o.dylib.bundle application/x-mach-binary

spec: Apple Mach-O loader.h

32-bit: MH_MAGIC = FE ED FA CE; 64-bit: MH_MAGIC_64 = FE ED FA CF.
Opposite byte order (MH_CIGAM/MH_CIGAM_64) appears reversed: CE FA ED FE / CF FA ED FE.
Universal 'fat' binaries begin with FAT_MAGIC = CA FE BA BE (big-endian), then a count of architecture slices. FAT_MAGIC_64 = CA FE BA BF.
CAUTION: CA FE BA BE is identical to the Java .class magic; disambiguate by the following bytes (Java .class next is the minor/major version; Mach-O fat next is a big-endian architecture count).

provenance

source: https://github.com/apple-oss-distributions/xnu/blob/main/EXTERNAL_HEADERS/mach-o/loader.h
version: xnu EXTERNAL_HEADERS/mach-o/loader.h (MH_MAGIC 0xfeedface, MH_MAGIC_64 0xfeedfacf); fat.h FAT_MAGIC 0xcafebabe
retrieved: 2026-05-29 · updated: 2026-05-29T00:00:00Z

per-fact attribution:

ext.magic_hex — https://github.com/apple-oss-distributions/xnu/blob/main/EXTERNAL_HEADERS/mach-o/loader.h MH_MAGIC = 0xfeedface, MH_MAGIC_64 = 0xfeedfacf; reversed (MH_CIGAM) forms for the opposite byte order.
ext.notes — https://en.wikipedia.org/wiki/Mach-O Corroborates magic values and FAT_MAGIC 0xcafebabe for universal binaries, and the clash with Java .class magic.

agent: curl -H 'accept: application/json' wire.phall.io/magic/mach-o or /magic/mach-o.json

Mach-O signature (FE ED FA CE / CF, fat: CA FE BA BE)

file signature

provenance

see also