This should be very simple, but I am unable to find a straightforward answer to this question. I have a few Mach-O binaries that have certificates embedded in them. Some of these might not be signatures, but rather root certificates that the code uses to verify other signatures with. Some of these might also be signatures. I'm working on some of Apple's core executables here, so that might help. How can I extract these from them?
Apple's root certificates are available via Keychain.app in the System keychain. Both expending too much effort, confirm the certificates you are trying to extract truly differ from those in the System keychain.
Be sure to review Apple's published source code for their tools, code signing, and signature verification at https://opensource.apple.com or ask on the Apple cryptography mailing list to chat directly with Apple's security engineers.
Assuming the embedded certificates are stored in a
data segment of the Mach-O files, see the article Parsing Mach-O files for details about how to access this content.
The open source tool MachOView will probably provide enough insight to judge if the certificate is encoded as a Mach-O segment.