I've made a start trying to differentiate between exe-mach-o-intel-64 and what I've dubbed exe-mach-o-arm-64 (Apple's new M1, a.k.a. "Apple Silicon"), and I'm running into some troubles.
As things stand right now, TrID just looks at the file signature at the start of the file, which is CF-FA-ED-FE, but unfortunately, Apple has chosen to reuse that same signature for ARM executables, instead of, say, incrementing that first byte (which they did when moving from 32-bit to 64-bit), or coming up with an entirely new signature. So in my preliminary testing, all ARM apps are reported as "Mac OS X Mach-O 64bit Intel executable".
It looks like some more work will need to be done to differentiate between the two formats, and I don't really have the time to do an in-depth analysis comparing them. What I've come up with (for now at least) is to just extend the "signature" to 5 bytes: Intel is CF-FA-ED-FE-07 and ARM is CF-FA-ED-FE-0C. It seems to work, but I think that more work needs to be done to confirm that this is the only change needed (but again, I don't really have the time to do it myself).
I've sent the new defs to Mark0 to look at.
