This should be very simple, but I am unable to find a straightforward answer to this question. I have a few Mach-O binaries that have certificates embedded in them. Some of these might not be signatures, but rather root certificates that the code uses to verify other signatures with. Some of these might also be signatures. I'm working on some of Apple's core executables here, so that might help. How can I extract these from them?

  • How do you know the executable binaries have certificates embedded within them? Are you able to see the certificates using the object file format tools? – Graham Miln Aug 29 '16 at 14:56
  • @GrahamMiln I opened them using a hex editor. – Melab Aug 29 '16 at 15:02

Apple's root certificates are available via Keychain.app in the System keychain. Both expending too much effort, confirm the certificates you are trying to extract truly differ from those in the System keychain.

Be sure to review Apple's published source code for their tools, code signing, and signature verification at https://opensource.apple.com or ask on the Apple cryptography mailing list to chat directly with Apple's security engineers.

Mach-O Maybe?

Assuming the embedded certificates are stored in a data segment of the Mach-O files, see the article Parsing Mach-O files for details about how to access this content.

The open source tool MachOView will probably provide enough insight to judge if the certificate is encoded as a Mach-O segment.

  • Would the certificate used to verify kernel extensions be stored in kextload? I don't think Apple's public source code includes anything about the keys used to verify executables and extensions. – Melab Aug 29 '16 at 15:37
  • You should ask Apple directly on their cryptography mailing list; no need to guess. – Graham Miln Aug 29 '16 at 16:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .