Odd cputype in /bin/ls binary I just started with Charlie Miller and Dino Dai Zovi's Mac Hacker's Handbook and was doing the tutorials. This includes getting to know things like 'otool'

otool -f \bin\ls
Fat headers
fat_magic 0xcafebabe
nfat_arch 2
architecture 0
    cputype 16777223
    cpusubtype 3
    capabilities 0x80
    offset 4096
    size 39600
    align 2^12 (4096)
architecture 1
    cputype 7
    cpusubtype 3
    capabilities 0x0
    offset 45056
    size 35632
    align 2^12 (4096)


I tried to find something about that first cputype in /usr/include/mach/machine.h, but found nothing. Clearly I am missing something.
cputype 16777223 is “x86 64” (64 bit mode); 7 is “i386” (32 bit mode). Incidentally, 16777223 == 0x1000007, so bit 24 means “64 bit”.

Looking in /usr/include/mach/machine.h (pointed out by …/mach-o/fat.h, which seems like a reasonable place to start), we find the following:

⋮
typedef integer_t       cpu_type_t;
⋮
#define CPU_ARCH_ABI64  0x01000000              /* 64 bit ABI */
⋮
#define CPU_TYPE_X86            ((cpu_type_t) 7)
#define CPU_TYPE_I386           CPU_TYPE_X86            /* compatibility */
#define CPU_TYPE_X86_64         (CPU_TYPE_X86 | CPU_ARCH_ABI64)
⋮
#define CPU_TYPE_POWERPC                ((cpu_type_t) 18)
#define CPU_TYPE_POWERPC64              (CPU_TYPE_POWERPC | CPU_ARCH_ABI64)
⋮


Of course, you can also just add the -v option to your otool command to have it show the symbolic values:

% otool -vf /bin/ls
Fat headers
fat_magic FAT_MAGIC
nfat_arch 2
architecture x86_64
    cputype CPU_TYPE_X86_64
    cpusubtype CPU_SUBTYPE_X86_64_ALL
    capabilities CPU_SUBTYPE_LIB64
    offset 4096
    size 39600
    align 2^12 (4096)
architecture i386
    cputype CPU_TYPE_I386
    cpusubtype CPU_SUBTYPE_I386_ALL
    capabilities 0x0
    offset 45056
    size 35632
    align 2^12 (4096)