macho

The macho module allows you to create more fine-grained rules for Mach-O files by using attributes and features of the Mach-O file format. This module exposes most of the fields present in a Mach-O header and provides functions which can be used to write more expressive and targeted rules. Let’s see some examples:

import "macho"

rule cpu_type {
  condition:
    macho.cputype == macho.CPU_TYPE_X86_64
}

rule frameworks_rpath {
  condition:
    macho.has_rpath("@loader_path/../Frameworks")
}

rule dylib_hash {
  condition:
    macho.dylib_hash() == "c92070ad210458d5b3e8f048b1578e6d"
}

Functions#

file_index_for_arch(type_arg)#

Returns the the index of a Mach-O file within a fat binary based on CPU type.

Example#

import "macho"

rule file_index_example {
  condition:
    macho.file_index_for_arch(0x00000008) == 0
}

file_index_for_arch(type_arg, subtype_arg)#

Returns the index of a Mach-O file within a fat binary based on both CPU type and subtype.

Example#

import "macho"

rule file_index_example_sub {
  condition:
    macho.file_index_for_arch(0x00000008, 0x00000004) == 0
}

entry_point_for_arch(type_arg)#

Returns the real entry point offset for a specific CPU type within a fat Mach-O binary.

Example#

import "macho"

rule entrypoint_example {
  condition:
    macho.entry_point_for_arch(0x01000007) == 0x00004EE0
}

entry_point_for_arch(type_arg, subtype_arg))#

Returns the real entry point offset for a specific CPU type and subtype within a fat Mach-O binary.

Example#

import "macho"

rule entrypoint_example_sub {
  condition:
    macho.entry_point_for_arch(0x00000007, 0x00000003) == 0x00001EE0
}

has_entitlement(entitlement)#

Returns true if the Mach-O parsed entitlements contain entitlement

• entitlement is case-insensitive.

Example#

import "macho"

rule has_entitlement_example {
  condition:
    macho.has_entitlement("com.apple.security.network.client")
}

has_dylib(dylib_name)#

Returns true if the Mach-O parsed dylibs contain dylib_name

• dylib_name is case-insensitive.

Example#

import "macho"

rule has_dylib_example {
  condition:
    macho.has_dylib("/usr/lib/libSystem.B.dylib")
}

has_rpath(rpath)#

Returns true if the Mach-O parsed rpaths contain rpath

• rpath is case-insensitive.

Example#

import "macho"

rule has_rpath_example {
  condition:
    macho.has_rpath("@loader_path/../Frameworks")
}

dylib_hash()#

Returns an MD5 hash of the dylibs designated in the Mach-O binary.

Example#

import "macho"

rule dylib_hash_example {
  condition:
    macho.dylib_hash() == "c92070ad210458d5b3e8f048b1578e6d"
}

entitlement_hash()#

Returns an MD5 hash of the entitlements designated in the Mach-O binary.

Example#

import "macho"

rule entitlement_hash_example {
  condition:
    macho.entitlement_hash() == "cc9486efb0ce73ba411715273658da80"
}

export_hash()#

Returns an MD5 hash of the exports designated in the Mach-O binary.

Example#

import "macho"

rule export_hash_example {
  condition:
    macho.export_hash() == "6bfc6e935c71039e6e6abf097830dceb"
}

Module structure#

BuildTool#

BuildVersion#

Certificates#

DyldInfo#

Dylib#

Dysymtab#

FatArch#

File#

LinkedItData#

MinVersion#

Section#

Segment#

Symtab#

CPU_ARM_64_SUBTYPE#

CPU_ARM_SUBTYPE#

CPU_I386_SUBTYPE#

CPU_I386_TYPE#

CPU_INTEL_PENTIUM_SUBTYPE#

CPU_INTEL_SUBTYPE#

CPU_MC_SUBTYPE#

CPU_POWERPC_SUBTYPE#

CPU_SPARC_SUBTYPE#

CPU_TYPE#

CPU_X86_SUBTYPE#

DEVICE_TYPE#

FAT_HEADER#

FILE_FLAG#

FILE_TYPE#

HEADER#

MASK_64BIT#

SECTION_ATTRIBUTES#

SECTION_TYPE#

SEGMENT_FLAG#