analyzing-mach-o-binaries-on-macos
starsforks
How to install analyzing-mach-o-binaries-on-macos?
meltedinhex/analyst-ai-pack/analyzing-mach-o-binaries-on-macos
$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-mach-o-binaries-on-macosStatically analyzes macOS Mach-O malware: parsing the header and load commands,
SKILL.md
| 1 | # Analyzing Mach-O Binaries on macOS |
| 2 | |
| 3 | ## When to Use |
| 4 | |
| 5 | - You have a macOS sample (Mach-O) and need a static capability and trust read. |
| 6 | - You must handle a fat/universal binary containing multiple architecture slices. |
| 7 | - You need to inspect linked dylibs, entitlements, and code-signing status. |
| 8 | |
| 9 | **Do not use** Windows PE tooling on Mach-O — the formats differ entirely; use Mach-O-aware |
| 10 | parsers. |
| 11 | |
| 12 | ## Prerequisites |
| 13 | |
| 14 | - A Mach-O parser (Python stdlib `struct`, or `macholib`/LIEF); the sample handled inertly. |
| 15 | - For signing/entitlements on macOS, `codesign`/`otool` are authoritative. |
| 16 | |
| 17 | ## Safety & Handling |
| 18 | |
| 19 | - Parse statically; never execute the sample, especially on a real macOS host. |
| 20 | - Keep the sample password-protected at rest and reference it by hash. |
| 21 | |
| 22 | ## Workflow |
| 23 | |
| 24 | ### Step 1: Detect fat vs. thin and architecture |
| 25 | |
| 26 | Check the magic: `0xCAFEBABE` (fat/universal) vs. `0xFEEDFACE`/`0xFEEDFACF` (Mach-O 32/64). For |
| 27 | fat binaries, enumerate and analyze each slice. |
| 28 | |
| 29 | ```bash |
| 30 | python scripts/analyst.py header sample.macho |
| 31 | ``` |
| 32 | |
| 33 | ### Step 2: Parse load commands |
| 34 | |
| 35 | Read load commands for linked dylibs (`LC_LOAD_DYLIB`), entry point (`LC_MAIN`), and signing |
| 36 | (`LC_CODE_SIGNATURE`). The dylib list hints at capability (networking, crypto). |
| 37 | |
| 38 | ### Step 3: Inspect entitlements and signing |
| 39 | |
| 40 | On macOS, use `codesign`/`otool` to read entitlements and verify the signature. Ad-hoc or absent |
| 41 | signatures and suspicious entitlements are risk indicators. |
| 42 | |
| 43 | ### Step 4: Infer capability and route |
| 44 | |
| 45 | Map linked frameworks/symbols to behaviors and route to disassembly/RE for deeper analysis. |
| 46 | |
| 47 | ## Validation |
| 48 | |
| 49 | - Fat binaries are decomposed and each slice is analyzed, not just the first. |
| 50 | - Load commands, dylibs, and signing status are enumerated correctly. |
| 51 | - Capability inferences are corroborated by linked frameworks/symbols. |
| 52 | |
| 53 | ## Pitfalls |
| 54 | |
| 55 | - Analyzing only one slice of a universal binary. |
| 56 | - Trusting a present signature without verifying it (ad-hoc signatures verify but aren't trusted). |
| 57 | - Applying PE assumptions (sections/imports) to Mach-O structures. |
| 58 | |
| 59 | ## References |
| 60 | |
| 61 | - See [`references/api-reference.md`](references/api-reference.md) for the Mach-O header parser. |
| 62 | - Apple Mach-O loader.h and code signing docs (linked in frontmatter). |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
