Final assessment

The final assessment tests whether you can reason from Mach-O structures rather than memorize names.

Expect questions that require you to:

• interpret header and load-command values;
• validate parser boundaries;
• translate between file offsets and preferred virtual addresses;
• distinguish symbols from executable behavior;
• reason about stripped binaries;
• interpret what code-signing evidence does and does not establish;
• choose appropriate evidence for a stated hypothesis.

A passing score is necessary but not sufficient for a verified credential. The capstone evidence package is also required.