{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{"4294968536":[{"is_tail_call":false,"symbol":"fprintf","target_va":4294969116},{"is_tail_call":false,"symbol":"getaudit_addr","target_va":4294969132},{"is_tail_call":false,"symbol":"au_sflagstostr","target_va":4294969084},{"is_tail_call":false,"symbol":"sub_1000005e8","target_va":4294968808},{"is_tail_call":false,"symbol":"sub_100000620","target_va":4294968864},{"is_tail_call":false,"symbol":"__stack_chk_guard","target_va":4294969068},{"is_tail_call":false,"symbol":"sub_1000005e8","target_va":4294968808},{"is_tail_call":false,"symbol":"sub_100000620","target_va":4294968864}],"4294968808":[{"is_tail_call":false,"symbol":"audit_set_sflags","target_va":4294969100}],"4294968864":[{"is_tail_call":false,"symbol":"__stack_chk_fail","target_va":4294969052},{"is_tail_call":false,"symbol":"perror","target_va":4294969180},{"is_tail_call":false,"symbol":"getprogname","target_va":4294969164}]},"data_xrefs":{"by_data":{"4294968352":[4294968864],"4294969196":[4294968536],"4294969215":[4294968536],"4294969245":[4294968864],"4294969253":[4294968864],"4294983680":[4294968536,4294968864],"4294983760":[4294968864],"4294983768":[4294968536]},"by_function":{"4294968536":[{"data_va":4294969196,"insn_va":4294968584,"kind":"CString","value":null},{"data_va":4294983768,"insn_va":4294968592,"kind":"Global","value":null},{"data_va":4294969215,"insn_va":4294968600,"kind":"CString","value":"Usage: %s [-v]\n"},{"data_va":4294983680,"insn_va":4294968636,"kind":"Global","value":null}],"4294968864":[{"data_va":4294983760,"insn_va":4294968896,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294968900,"kind":"Global","value":null},{"data_va":4294969245,"insn_va":4294968944,"kind":"CString","value":"0x%0llx"},{"data_va":4294969253,"insn_va":4294968980,"kind":"CString","value":"asid=0x%08x auid=%-6d flags=%s\n"},{"data_va":4294983760,"insn_va":4294968996,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969000,"kind":"Global","value":null},{"data_va":4294968352,"insn_va":4294969012,"kind":"Global","value":null}]}},"noreturn_vas":[],"symbols":{"4294968536":"sub_1000004d8","4294968808":"sub_1000005e8","4294968864":"sub_100000620"}},"capabilities":[],"code_signature":{"code_directory":{"cdhash":"1c75487711330f512278c947a5514f29149decb6be45731805945dc357c2a13b","flag_names":[],"flags":0,"hash_type":2,"identifier":"com.apple.graphicssession","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","frameworkhash":"821b9f412c19e16a935f95418b1f75e62d49f7a1fd21178778e954e5a9e0edb6","imphash":"180edb775718b0ca7eb5dec35056f7e12685b90d6d077269aa932551e55f4fa2","sha256_text":"72a1bc1f9bda12bb6dfd7056734f9c6c01db0fc2fc2f38fe8f5bc24271151449","symbolhash":"180edb775718b0ca7eb5dec35056f7e12685b90d6d077269aa932551e55f4fa2"},"sets":{"apis_called":["__stack_chk_fail","__stack_chk_guard","au_sflagstostr","audit_set_sflags","fprintf","getaudit_addr","getprogname","perror","sub_1000005e8","sub_100000620"],"bundle_ids":["com.apple.graphicssession"],"cpp_classes":[],"entitlements":[],"frameworks":["libbsm.0.dylib","libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":[],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":[]},"vector":{"bundle_ids":1,"cap_analytics":0,"cap_hardware":0,"cap_ipc":0,"cap_keychain":0,"cap_location":0,"cap_network":0,"cap_security":0,"cap_storage":0,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":0,"file_paths":0,"frameworks_private":0,"frameworks_total":2,"iokit_constants":0,"library_functions":0,"nlist_functions":3,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":6,"size_log2":16.6289,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":0,"text_ratio":0.004933691,"url_endpoints":4,"xpc_provides":0}},"dwarf_metadata":null,"entitlements":{"entries":{},"raw_plist":null},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-07T05:21:12Z","available_arches":["x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"1c75487711330f512278c947a5514f29149decb6be45731805945dc357c2a13b","file_modified":"2026-04-06T12:10:01Z","file_size":101344,"is_arm64e":true,"min_os":"26.1.0","name":"graphicssession","platform":"macOS","sdk":"26.1.0","sha256":"52742896ba6cb9f4423a601f7b13dee124ddd5ba8ad141da871d96a8d38691f4","sha256_slice":"eb13c4f717afa3e83686b660d2297e816c108ef3274bfad7248c4060f9f706dc","source_version":"864.0.1.0.0","team_id":null,"uuid":"E9954FFC-C65A-366F-AA77-099C05C95E6C"},"frameworks":[{"is_private":false,"is_weak":false,"name":"/usr/lib/libbsm.0.dylib"},{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":3,"imports":[{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"au_sflagstostr"},{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"audit_set_sflags"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stack_chk_fail"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fprintf"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"getaudit_addr"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"getopt"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"getprogname"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"perror"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"printf"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"snprintf"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stack_chk_guard"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stderrp"}],"interesting_strings":{"bundle_ids":["com.apple.graphicssession"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":3,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"}],"has_network_entitlement":false,"network_frameworks":[]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":1240,"protection":"r-x","segment":"__TEXT","size":500},{"name":"__auth_stubs","offset":1740,"protection":"r-x","segment":"__TEXT","size":160},{"name":"__cstring","offset":1900,"protection":"r-x","segment":"__TEXT","size":89},{"name":"__unwind_info","offset":1992,"protection":"r-x","segment":"__TEXT","size":104},{"name":"__auth_got","offset":16384,"protection":"rw-","segment":"__DATA_CONST","size":80},{"name":"__got","offset":16464,"protection":"rw-","segment":"__DATA_CONST","size":16}],"summary":"Apple-signed executable that performs specific system operations across x86_64 and arm64 architectures. Communicates with 6 distinct network endpoints to handle signed bundle identifiers and remote services. Contains minimal function complexity (3 functions) and references 4 URLs or endpoints, suggesting focused interaction with Apple infrastructure or external services. Runs as a specialized utility with no public-facing interface.","swift_metadata":null,"title":"Apple system utility — manages signed executable operations and network communication","total_strings":121,"xpc_services":[]}