Lab: Map the embedded code-signature structure
Use course fixtures, software you own, or binaries you are authorized to inspect.
This lab separates structural parsing from trust-policy verification.
Write a parser or analysis script that:
- locates
LC_CODE_SIGNATURE; - validates the referenced file range;
- reads the outer signing blob magic and length;
- when the blob is a SuperBlob, enumerates each indexed entry;
- identifies CodeDirectory, entitlement, DER-entitlement, requirements, and CMS-wrapper candidates using supplied Apple constants;
- reports each blob's type, magic, offset, and length;
- records CodeDirectory version and hash type when your parser supports those fields.
Your parser must not claim a CMS signature is cryptographically valid merely because a CMS blob exists.
Cross-check
On macOS, compare your structural findings with tools such as codesign -d --verbose=4 and entitlement-display options. On other platforms, compare with a second parser/library.
Deliverable
Submit a JSON map of the embedded signing region plus your parser source and sample SHA-256.
The verifier should tolerate ordering differences in JSON. It should compare normalized fields, not demand an exact byte-for-byte JSON rendering.