Analyzing mach o binaries on macos
Skill meltedinhex/analyst-ai-pack/skills/analyzing-mach-o-binaries-on-macos
An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-mach-o-binaries-on-macosAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Statically analyzes macOS Mach-O malware: parsing the header and load commands, handling fat/universal binaries, reading linked dylibs and entitlements, and checking code signatures to infer capability and trust. Activates for requests to analyze a Mach-O binary, inspect macOS malware, or parse load commands and entitlements.
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.1 KB, as published. Nobody here has run it
Analyzing Mach-O Binaries on macOS
When to Use
- You have a macOS sample (Mach-O) and need a static capability and trust read.
- You must handle a fat/universal binary containing multiple architecture slices.
- You need to inspect linked dylibs, entitlements, and code-signing status.
Do not use Windows PE tooling on Mach-O — the formats differ entirely; use Mach-O-aware parsers.
Prerequisites
- A Mach-O parser (Python stdlib
struct, ormacholib/LIEF); the sample handled inertly. - For signing/entitlements on macOS,
codesign/otoolare authoritative.
Safety & Handling
- Parse statically; never execute the sample, especially on a real macOS host.
- Keep the sample password-protected at rest and reference it by hash.
Workflow
Step 1: Detect fat vs. thin and architecture
Check the magic: 0xCAFEBABE (fat/universal) vs. 0xFEEDFACE/0xFEEDFACF (Mach-O 32/64). For
fat binaries, enumerate and analyze each slice.
python scripts/analyst.py header sample.macho
Step 2: Parse load commands
Read load commands for linked dylibs (LC_LOAD_DYLIB), entry point (LC_MAIN), and signing
(LC_CODE_SIGNATURE). The dylib list hints at capability (networking, crypto).
Step 3: Inspect entitlements and signing
On macOS, use codesign/otool to read entitlements and verify the signature. Ad-hoc or absent
signatures and suspicious entitlements are risk indicators.
Step 4: Infer capability and route
Map linked frameworks/symbols to behaviors and route to disassembly/RE for deeper analysis.
Validation
- Fat binaries are decomposed and each slice is analyzed, not just the first.
- Load commands, dylibs, and signing status are enumerated correctly.
- Capability inferences are corroborated by linked frameworks/symbols.
Pitfalls
- Analyzing only one slice of a universal binary.
- Trusting a present signature without verifying it (ad-hoc signatures verify but aren't trusted).
- Applying PE assumptions (sections/imports) to Mach-O structures.
References
- See
references/api-reference.mdfor the Mach-O header parser. - Apple Mach-O loader.h and code signing docs (linked in frontmatter).