agentsclimarketplace

Analyzing mach o binaries on macos

Skill meltedinhex/analyst-ai-pack/skills/analyzing-mach-o-binaries-on-macos

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-mach-o-binaries-on-macos

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Statically analyzes macOS Mach-O malware: parsing the header and load commands, handling fat/universal binaries, reading linked dylibs and entitlements, and checking code signatures to infer capability and trust. Activates for requests to analyze a Mach-O binary, inspect macOS malware, or parse load commands and entitlements.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.1 KB, as published. Nobody here has run it

Analyzing Mach-O Binaries on macOS

When to Use

  • You have a macOS sample (Mach-O) and need a static capability and trust read.
  • You must handle a fat/universal binary containing multiple architecture slices.
  • You need to inspect linked dylibs, entitlements, and code-signing status.

Do not use Windows PE tooling on Mach-O — the formats differ entirely; use Mach-O-aware parsers.

Prerequisites

  • A Mach-O parser (Python stdlib struct, or macholib/LIEF); the sample handled inertly.
  • For signing/entitlements on macOS, codesign/otool are authoritative.

Safety & Handling

  • Parse statically; never execute the sample, especially on a real macOS host.
  • Keep the sample password-protected at rest and reference it by hash.

Workflow

Step 1: Detect fat vs. thin and architecture

Check the magic: 0xCAFEBABE (fat/universal) vs. 0xFEEDFACE/0xFEEDFACF (Mach-O 32/64). For fat binaries, enumerate and analyze each slice.

python scripts/analyst.py header sample.macho

Step 2: Parse load commands

Read load commands for linked dylibs (LC_LOAD_DYLIB), entry point (LC_MAIN), and signing (LC_CODE_SIGNATURE). The dylib list hints at capability (networking, crypto).

Step 3: Inspect entitlements and signing

On macOS, use codesign/otool to read entitlements and verify the signature. Ad-hoc or absent signatures and suspicious entitlements are risk indicators.

Step 4: Infer capability and route

Map linked frameworks/symbols to behaviors and route to disassembly/RE for deeper analysis.

Validation

  • Fat binaries are decomposed and each slice is analyzed, not just the first.
  • Load commands, dylibs, and signing status are enumerated correctly.
  • Capability inferences are corroborated by linked frameworks/symbols.

Pitfalls

  • Analyzing only one slice of a universal binary.
  • Trusting a present signature without verifying it (ad-hoc signatures verify but aren't trusted).
  • Applying PE assumptions (sections/imports) to Mach-O structures.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.