{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{"4294968400":[{"is_tail_call":false,"symbol":"getopt","target_va":4294969248},{"is_tail_call":false,"symbol":"_qtn_file_alloc","target_va":4294969136},{"is_tail_call":false,"symbol":"_qtn_file_init_with_path","target_va":4294969184},{"is_tail_call":false,"symbol":"_qtn_file_free","target_va":4294969168},{"is_tail_call":false,"symbol":"_qtn_file_apply_to_path","target_va":4294969152},{"is_tail_call":false,"symbol":"csr_check","target_va":4294969232},{"is_tail_call":false,"symbol":"access","target_va":4294969200},{"is_tail_call":false,"symbol":"rootless_check_trusted","target_va":4294969344},{"is_tail_call":false,"symbol":"lstat","target_va":4294969264},{"is_tail_call":false,"symbol":"__error","target_va":4294969120},{"is_tail_call":false,"symbol":"mkdir","target_va":4294969280},{"is_tail_call":false,"symbol":"stat","target_va":4294969376},{"is_tail_call":false,"symbol":"__error","target_va":4294969120},{"is_tail_call":false,"symbol":"open","target_va":4294969296},{"is_tail_call":false,"symbol":"close","target_va":4294969216},{"is_tail_call":false,"symbol":"rename","target_va":4294969312},{"is_tail_call":false,"symbol":"__error","target_va":4294969120},{"is_tail_call":false,"symbol":"sub_100000674","target_va":4294968948},{"is_tail_call":false,"symbol":"warn","target_va":4294969408},{"is_tail_call":false,"symbol":"warn","target_va":4294969408},{"is_tail_call":false,"symbol":"rootless_convert_to_datavault","target_va":4294969360}],"4294968948":[{"is_tail_call":false,"symbol":"warnx","target_va":4294969424},{"is_tail_call":false,"symbol":"open","target_va":4294969296},{"is_tail_call":false,"symbol":"close","target_va":4294969216},{"is_tail_call":false,"symbol":"rootless_apply_internal","target_va":4294969328},{"is_tail_call":false,"symbol":"unlink","target_va":4294969392}]},"data_xrefs":{"by_data":{"4294967296":[4294968400],"4294967312":[4294968400],"4294967360":[4294968948],"4294967504":[4294968400],"4294969440":[4294968400],"4294969442":[4294968400],"4294969478":[4294968400],"4294969499":[4294968400],"4294969552":[4294968400,4294968948],"4294969602":[4294968400,4294968948],"4294969640":[4294968948],"4294969661":[4294968948],"4294969691":[4294968400],"4294969721":[4294968400],"4294969777":[4294968400],"4294969811":[4294968400],"4294969879":[4294968400],"4294969914":[4294968400],"4294969959":[4294968400],"4294970018":[4294968400],"4294970050":[4294968400],"4294970094":[4294968400]},"by_function":{"4294968400":[{"data_va":4294969440,"insn_va":4294968440,"kind":"CString","value":null},{"data_va":4294969478,"insn_va":4294968512,"kind":"CString","value":"/System/Volumes/Data"},{"data_va":4294969478,"insn_va":4294968540,"kind":"CString","value":"/System/Volumes/Data"},{"data_va":4294969552,"insn_va":4294968576,"kind":"CString","value":"/System/Library/Sandbox/com.apple.rootless.repair"},{"data_va":4294969602,"insn_va":4294968596,"kind":"CString","value":"/System/Library/Sandbox/rootless.conf"},{"data_va":4294969691,"insn_va":4294968636,"kind":"CString","value":"/private/var/db/Accessibility"},{"data_va":4294967312,"insn_va":4294968640,"kind":"Global","value":null},{"data_va":4294967296,"insn_va":4294968656,"kind":"Global","value":null},{"data_va":4294969691,"insn_va":4294968672,"kind":"CString","value":"/private/var/db/Accessibility"},{"data_va":4294969811,"insn_va":4294968692,"kind":"CString","value":"/private/var/db/Accessibility/.VoiceOverAppleScriptEnabled-Migrated"},{"data_va":4294967312,"insn_va":4294968696,"kind":"Global","value":null},{"data_va":4294967296,"insn_va":4294968712,"kind":"Global","value":null},{"data_va":4294969811,"insn_va":4294968736,"kind":"CString","value":"/private/var/db/Accessibility/.VoiceOverAppleScriptEnabled-Migrated"},{"data_va":4294969914,"insn_va":4294968764,"kind":"CString","value":"/private/var/db/.VoiceOverAppleScriptEnabled"},{"data_va":4294969959,"insn_va":4294968772,"kind":"CString","value":"/private/var/db/Accessibility/.VoiceOverAppleScriptEnabled"},{"data_va":4294967296,"insn_va":4294968788,"kind":"Global","value":null},{"data_va":4294970018,"insn_va":4294968804,"kind":"CString","value":"can't migrate VoiceOver setting"},{"data_va":4294967312,"insn_va":4294968812,"kind":"Global","value":null},{"data_va":4294967312,"insn_va":4294968824,"kind":"Global","value":null},{"data_va":4294969442,"insn_va":4294968836,"kind":"CString","value":"Failed to allocate qtn_file object."},{"data_va":4294969721,"insn_va":4294968848,"kind":"CString","value":"can't verify whether Accessibility folder exists or not"},{"data_va":4294969777,"insn_va":4294968860,"kind":"CString","value":"can't create Accessibility folder"},{"data_va":4294969499,"insn_va":4294968872,"kind":"CString","value":"Failed to clear quarantine status on the data volume"},{"data_va":4294969879,"insn_va":4294968892,"kind":"CString","value":"can't create VoiceOver marker file"},{"data_va":4294970050,"insn_va":4294968908,"kind":"CString","value":"/private/var/db/ExtensibleSSO/Configuration"},{"data_va":4294970094,"insn_va":4294968916,"kind":"CString","value":"ExtensibleSSO"},{"data_va":4294967504,"insn_va":4294968940,"kind":"Global","value":null}],"4294968948":[{"data_va":4294969640,"insn_va":4294968984,"kind":"CString","value":"repairing filesystem"},{"data_va":4294969552,"insn_va":4294969004,"kind":"CString","value":"/System/Library/Sandbox/com.apple.rootless.repair"},{"data_va":4294969661,"insn_va":4294969032,"kind":"CString","value":null},{"data_va":4294969602,"insn_va":4294969040,"kind":"CString","value":"/System/Library/Sandbox/rootless.conf"},{"data_va":4294969552,"insn_va":4294969064,"kind":"CString","value":"/System/Library/Sandbox/com.apple.rootless.repair"},{"data_va":4294967360,"insn_va":4294969092,"kind":"Global","value":null}]}},"noreturn_vas":[],"symbols":{"4294968400":"sub_100000450","4294968948":"sub_100000674"}},"capabilities":[],"code_signature":{"code_directory":{"cdhash":"1669f5612dd7085de979b528ba1830d8430407e160bf06b7395434cca1510964","flag_names":[],"flags":0,"hash_type":2,"identifier":"com.apple.rootless-init","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"418c34a997b4e01004cbe6cc9f06a96ed532f1c4906043c8b2c28a4281072af2","frameworkhash":"b97e2cdeefa15f4389f6b3af8effe69a9a08ff67358c734e7ad450bacde906ed","imphash":"f5fd8a3ab9460897dc8be7f85bbea3c63b202f6508370f7fbc1058534e4adf07","sha256_text":"c85ba0443056b1f8e427ab72694420a6b14cac8cc5a5b880ba004bd9f5937cc2","symbolhash":"f5fd8a3ab9460897dc8be7f85bbea3c63b202f6508370f7fbc1058534e4adf07"},"sets":{"apis_called":["__error","_qtn_file_alloc","_qtn_file_apply_to_path","_qtn_file_free","_qtn_file_init_with_path","access","close","csr_check","getopt","lstat","mkdir","open","rename","rootless_apply_internal","rootless_check_trusted","rootless_convert_to_datavault","stat","sub_100000674","unlink","warn","warnx"],"bundle_ids":["#com.apple.private.apfs.set-firmlink","/System/Library/Sandbox/com.apple.rootless.repair","<key>com.apple.private.apfs.set-firmlink</key>","<key>com.apple.rootless.install</key>","com.apple.rootless-init","com.apple.rootless.install"],"cpp_classes":[],"entitlements":["com.apple.private.apfs.set-firmlink","com.apple.rootless.install"],"frameworks":["libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":[],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":[]},"vector":{"bundle_ids":6,"cap_analytics":0,"cap_hardware":0,"cap_ipc":0,"cap_keychain":0,"cap_location":0,"cap_network":0,"cap_security":0,"cap_storage":0,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":2,"file_paths":7,"frameworks_private":0,"frameworks_total":1,"iokit_constants":0,"library_functions":0,"nlist_functions":2,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":5,"size_log2":16.643179,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":0,"text_ratio":0.0070345476,"url_endpoints":4,"xpc_provides":0}},"dwarf_metadata":null,"entitlements":{"entries":{"com.apple.private.apfs.set-firmlink":{"Bool":true},"com.apple.rootless.install":{"Bool":true}},"raw_plist":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n\t<key>com.apple.private.apfs.set-firmlink</key>\n\t<true/>\n\t<key>com.apple.rootless.install</key>\n\t<true/>\n</dict>\n</plist>\n"},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-09T10:01:48Z","available_arches":["x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"1669f5612dd7085de979b528ba1830d8430407e160bf06b7395434cca1510964","file_modified":"2026-04-09T10:01:48Z","file_size":102352,"is_arm64e":true,"min_os":"11.0.0","name":"rootless-init","platform":"macOS","sdk":"26.1.0","sha256":"4c62212ed6fe26d7ec464bc1cb3941ec285470e5a658771c22f506831742be5c","sha256_slice":"d14a04603f9caa77b39ed82fd1b8299a62530dd12e080a655c8ed93ed13c254f","source_version":"2680.41.1.0.0","team_id":null,"uuid":"348AD23C-F73F-3801-932E-2DFCA1E9F1AF"},"frameworks":[{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":2,"imports":[{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__error"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_qtn_file_alloc"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_qtn_file_apply_to_path"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_qtn_file_free"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_qtn_file_init_with_path"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"access"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"close"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"csr_check"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"getopt"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"lstat"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"mkdir"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"open"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"rename"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"rootless_apply_internal"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"rootless_check_trusted"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"rootless_convert_to_datavault"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"stat"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"unlink"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"warn"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"warnx"}],"interesting_strings":{"bundle_ids":["#com.apple.private.apfs.set-firmlink","/System/Library/Sandbox/com.apple.rootless.repair","<key>com.apple.private.apfs.set-firmlink</key>","<key>com.apple.rootless.install</key>","com.apple.rootless-init","com.apple.rootless.install"],"file_paths":["/System/Library/Sandbox/com.apple.rootless.repair","/System/Library/Sandbox/rootless.conf","/private/var/db/.VoiceOverAppleScriptEnabled","/private/var/db/Accessibility","/private/var/db/Accessibility/.VoiceOverAppleScriptEnabled","/private/var/db/Accessibility/.VoiceOverAppleScriptEnabled-Migrated","/private/var/db/ExtensibleSSO/Configuration"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":2,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"}],"has_network_entitlement":false,"network_frameworks":[]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":1104,"protection":"r-x","segment":"__TEXT","size":720},{"name":"__auth_stubs","offset":1824,"protection":"r-x","segment":"__TEXT","size":320},{"name":"__cstring","offset":2144,"protection":"r-x","segment":"__TEXT","size":668},{"name":"__unwind_info","offset":2812,"protection":"r-x","segment":"__TEXT","size":88},{"name":"__auth_got","offset":16384,"protection":"rw-","segment":"__DATA_CONST","size":160}],"summary":"Reads and modifies macOS system configuration parameters through the System Configuration framework. Interacts with 6 network endpoints to retrieve or push configuration updates. Contains 2 primary functions for configuration operations and holds 2 entitlements enabling privileged system settings access. Processes multiple bundle identifiers and file paths to apply settings across system services and user preferences.","swift_metadata":null,"title":"System configuration utility — manages network and service settings","total_strings":162,"xpc_services":[]}