Code signatures and entitlements without mythology

A Mach-O image can contain an LC_CODE_SIGNATURE load command. That command is a linkedit_data_command: it points to a region of embedded code-signing data elsewhere in the file.

That region can contain a SuperBlob, a container whose index entries identify typed signing blobs.

Important signing structures and slots in Apple's open-source definitions include:

• CSMAGIC_CODEDIRECTORY — a CodeDirectory blob;
• CSMAGIC_EMBEDDED_SIGNATURE — the embedded signature container;
• CSMAGIC_BLOBWRAPPER — commonly used for the CMS signature wrapper;
• CSMAGIC_EMBEDDED_ENTITLEMENTS and CSMAGIC_EMBEDDED_DER_ENTITLEMENTS;
• CSSLOT_CODEDIRECTORY — slot 0;
• CSSLOT_ENTITLEMENTS — slot 5;
• the CMS-signature slot.

There is not a standard Mach-O load command named LC_ENTITLEMENTS. Entitlements associated with the embedded signature are represented as code-signing blobs/slots.

The CodeDirectory

The CodeDirectory describes hashing and identity information used by code-signature validation. Depending on its version, it can include fields for the identifier, hash type, page size, code limit, special-slot counts, team identity, execution-segment flags, and other versioned data.

Treat the structure as versioned. A parser must validate lengths before reading fields that only exist in newer versions.

What cryptographic verification can establish

Successful verification can establish that covered content matches the signed hashes and that a signature/trust policy accepts the signing material under the verifier's rules.

It does not establish that:

• the program is bug-free;
• the program is non-malicious;
• every dependency is trustworthy;
• every entitlement is appropriate;
• runtime behavior matches a marketing claim.

Cryptography answers specific integrity and authenticity questions. It is not a general “safe software” bit.

Analysis sequence

1. locate LC_CODE_SIGNATURE;
2. validate its file offset and size;
3. parse the SuperBlob header and index;
4. identify CodeDirectory and entitlement/CMS-related blobs by type/slot and magic;
5. hash or inspect the appropriate structures;
6. use a platform verifier where available to compare your structural parsing with the system's policy decision.

This makes code signing part of binary analysis rather than a black box.