ZDX ACADEMY

Understanding Apple Mach-O Binary Internals · Code signatures, entitlements and trust metadata

Language:English

Lab: Map the embedded code-signature structure

Use course fixtures, software you own, or binaries you are authorized to inspect.

This lab separates structural parsing from trust-policy verification.

Write a parser or analysis script that:

  1. locates LC_CODE_SIGNATURE;
  2. validates the referenced file range;
  3. reads the outer signing blob magic and length;
  4. when the blob is a SuperBlob, enumerates each indexed entry;
  5. identifies CodeDirectory, entitlement, DER-entitlement, requirements, and CMS-wrapper candidates using supplied Apple constants;
  6. reports each blob's type, magic, offset, and length;
  7. records CodeDirectory version and hash type when your parser supports those fields.

Your parser must not claim a CMS signature is cryptographically valid merely because a CMS blob exists.

Cross-check

On macOS, compare your structural findings with tools such as codesign -d --verbose=4 and entitlement-display options. On other platforms, compare with a second parser/library.

Deliverable

Submit a JSON map of the embedded signing region plus your parser source and sample SHA-256.

The verifier should tolerate ordering differences in JSON. It should compare normalized fields, not demand an exact byte-for-byte JSON rendering.

Course outline