{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{"4294968632":[{"is_tail_call":false,"symbol":"geteuid","target_va":4294969536},{"is_tail_call":false,"symbol":"stat","target_va":4294969600},{"is_tail_call":false,"symbol":"__error","target_va":4294969392},{"is_tail_call":false,"symbol":"open","target_va":4294969552},{"is_tail_call":false,"symbol":"strlen","target_va":4294969616},{"is_tail_call":false,"symbol":"write","target_va":4294969680},{"is_tail_call":false,"symbol":"close","target_va":4294969424},{"is_tail_call":false,"symbol":"open","target_va":4294969552},{"is_tail_call":false,"symbol":"fcntl","target_va":4294969488},{"is_tail_call":false,"symbol":"flock","target_va":4294969504},{"is_tail_call":false,"symbol":"getenv","target_va":4294969520},{"is_tail_call":false,"symbol":"strrchr","target_va":4294969632},{"is_tail_call":false,"symbol":"vfork","target_va":4294969648},{"is_tail_call":false,"symbol":"waitpid","target_va":4294969664},{"is_tail_call":false,"symbol":"raise","target_va":4294969584},{"is_tail_call":false,"symbol":"waitpid","target_va":4294969664},{"is_tail_call":false,"symbol":"sub_1000007a0","target_va":4294969248}],"4294969148":[{"is_tail_call":false,"symbol":"errx","target_va":4294969440}],"4294969176":[{"is_tail_call":false,"symbol":"errx","target_va":4294969440}],"4294969220":[{"is_tail_call":false,"symbol":"errx","target_va":4294969440}],"4294969248":[{"is_tail_call":false,"symbol":"errx","target_va":4294969440}],"4294969276":[{"is_tail_call":false,"symbol":"errx","target_va":4294969440}],"4294969304":[{"is_tail_call":false,"symbol":"errx","target_va":4294969440}],"4294969348":[{"is_tail_call":false,"symbol":"errx","target_va":4294969440}]},"data_xrefs":{"by_data":{"4294967296":[4294968632],"4294967324":[4294968632],"4294967328":[4294968632],"4294967520":[4294968632],"4294969876":[4294969148],"4294969896":[4294968632,4294969176,4294969304,4294969348],"4294969907":[4294969348],"4294969925":[4294969176],"4294969943":[4294969304],"4294969960":[4294969276],"4294969988":[4294969220],"4294970001":[4294968632],"4294970008":[4294968632],"4294970020":[4294969248],"4294983680":[4294969348],"4294983688":[4294969348],"4294983696":[4294969348],"4294983704":[4294969348],"4294983712":[4294969348],"4294983720":[4294969348],"4294983728":[4294969348],"4294983736":[4294969348],"4294983744":[4294969348],"4294983752":[4294969348],"4294983760":[4294969348],"4294983768":[4294969348],"4294983776":[4294969348],"4294983784":[4294969348],"4294983792":[4294969348],"4294983800":[4294969348],"4294983808":[4294969348],"4294983816":[4294969348],"4294983824":[4294969348],"4295000064":[4294968632]},"by_function":{"4294968632":[{"data_va":4294969896,"insn_va":4294968700,"kind":"CString","value":"/etc/fstab"},{"data_va":4294967328,"insn_va":4294968704,"kind":"Global","value":null},{"data_va":4294967296,"insn_va":4294968720,"kind":"Global","value":null},{"data_va":4294969896,"insn_va":4294968748,"kind":"CString","value":"/etc/fstab"},{"data_va":4295000064,"insn_va":4294968772,"kind":"Global","value":null},{"data_va":4294969896,"insn_va":4294968824,"kind":"CString","value":"/etc/fstab"},{"data_va":4294970001,"insn_va":4294968892,"kind":"CString","value":"EDITOR"},{"data_va":4294970008,"insn_va":4294968904,"kind":"CString","value":"/usr/bin/vi"},{"data_va":4294967324,"insn_va":4294968940,"kind":"Global","value":null},{"data_va":4294967324,"insn_va":4294968968,"kind":"Global","value":null},{"data_va":4294967324,"insn_va":4294968972,"kind":"Global","value":null},{"data_va":4294967520,"insn_va":4294969060,"kind":"Global","value":null}],"4294969148":[{"data_va":4294969876,"insn_va":4294969164,"kind":"CString","value":"need to run as root"}],"4294969176":[{"data_va":4294969896,"insn_va":4294969196,"kind":"CString","value":"/etc/fstab"},{"data_va":4294969925,"insn_va":4294969208,"kind":"CString","value":"could not stat %s"}],"4294969220":[{"data_va":4294969988,"insn_va":4294969236,"kind":"CString","value":"file is busy"}],"4294969248":[{"data_va":4294970020,"insn_va":4294969264,"kind":"CString","value":"editing error"}],"4294969276":[{"data_va":4294969960,"insn_va":4294969292,"kind":"CString","value":"error setting close on exit"}],"4294969304":[{"data_va":4294969896,"insn_va":4294969324,"kind":"CString","value":"/etc/fstab"},{"data_va":4294969943,"insn_va":4294969336,"kind":"CString","value":"error opening %s"}],"4294969348":[{"data_va":4294969896,"insn_va":4294969368,"kind":"CString","value":"/etc/fstab"},{"data_va":4294969907,"insn_va":4294969380,"kind":"CString","value":"error creating %s"},{"data_va":4294983680,"insn_va":4294969396,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969400,"kind":"Global","value":null},{"data_va":4294983688,"insn_va":4294969412,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969416,"kind":"Global","value":null},{"data_va":4294983696,"insn_va":4294969428,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969432,"kind":"Global","value":null},{"data_va":4294983704,"insn_va":4294969444,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969448,"kind":"Global","value":null},{"data_va":4294983712,"insn_va":4294969460,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969464,"kind":"Global","value":null},{"data_va":4294983720,"insn_va":4294969476,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969480,"kind":"Global","value":null},{"data_va":4294983728,"insn_va":4294969492,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969496,"kind":"Global","value":null},{"data_va":4294983736,"insn_va":4294969508,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969512,"kind":"Global","value":null},{"data_va":4294983744,"insn_va":4294969524,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969528,"kind":"Global","value":null},{"data_va":4294983752,"insn_va":4294969540,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969544,"kind":"Global","value":null},{"data_va":4294983760,"insn_va":4294969556,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969560,"kind":"Global","value":null},{"data_va":4294983768,"insn_va":4294969572,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969576,"kind":"Global","value":null},{"data_va":4294983776,"insn_va":4294969588,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969592,"kind":"Global","value":null},{"data_va":4294983784,"insn_va":4294969604,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969608,"kind":"Global","value":null},{"data_va":4294983792,"insn_va":4294969620,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969624,"kind":"Global","value":null},{"data_va":4294983800,"insn_va":4294969636,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969640,"kind":"Global","value":null},{"data_va":4294983808,"insn_va":4294969652,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969656,"kind":"Global","value":null},{"data_va":4294983816,"insn_va":4294969668,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969672,"kind":"Global","value":null},{"data_va":4294983824,"insn_va":4294969684,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969688,"kind":"Global","value":null}]}},"noreturn_vas":[],"symbols":{"4294968632":"sub_100000538","4294969148":"sub_10000073c","4294969176":"sub_100000758","4294969220":"sub_100000784","4294969248":"sub_1000007a0","4294969276":"sub_1000007bc","4294969304":"sub_1000007d8","4294969348":"sub_100000804"}},"capabilities":[],"code_signature":{"code_directory":{"cdhash":"382d47b823ee1c1e8ca51026862e25f49c2e9be339eab0f6036f681664380daa","flag_names":[],"flags":0,"hash_type":2,"identifier":"com.apple.vifs","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","frameworkhash":"b97e2cdeefa15f4389f6b3af8effe69a9a08ff67358c734e7ad450bacde906ed","imphash":"09d77ab5dbb5105b5db825b516a48137200a66f73a2e1c15394f84add89eb4a4","sha256_text":"5f283a02b2471762a8db1fc3f3b091d30980bf3880a3d2203d0f2837ae56ff49","symbolhash":"09d77ab5dbb5105b5db825b516a48137200a66f73a2e1c15394f84add89eb4a4"},"sets":{"apis_called":["__error","close","errx","fcntl","flock","getenv","geteuid","open","raise","stat","strlen","strrchr","sub_1000007a0","vfork","waitpid","write"],"bundle_ids":["com.apple.vifs"],"cpp_classes":[],"entitlements":[],"frameworks":["libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":[],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":[]},"vector":{"bundle_ids":1,"cap_analytics":0,"cap_hardware":0,"cap_ipc":0,"cap_keychain":0,"cap_location":0,"cap_network":0,"cap_security":0,"cap_storage":0,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":0,"file_paths":0,"frameworks_private":0,"frameworks_total":1,"iokit_constants":0,"library_functions":0,"nlist_functions":8,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":7,"size_log2":16.849014,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":0,"text_ratio":0.0064380593,"url_endpoints":4,"xpc_provides":0}},"dwarf_metadata":null,"entitlements":{"entries":{},"raw_plist":null},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-07T05:21:12Z","available_arches":["x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"382d47b823ee1c1e8ca51026862e25f49c2e9be339eab0f6036f681664380daa","file_modified":"2026-04-06T12:15:35Z","file_size":118048,"is_arm64e":true,"min_os":"26.1.0","name":"vifs","platform":"macOS","sdk":"26.1.0","sha256":"530201b5626fc8a98d4b6c5d13cad9e0bc78a4c2938c3443318bcde13499ac80","sha256_slice":"2cb7b8508f15ab4f2918ff2b1fc3a5632910270975a471d495c80af19754da82","source_version":"1039.0.0.0.0","team_id":null,"uuid":"5649F5AE-4334-3B35-A4BD-08A5C2ABFE97"},"frameworks":[{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":8,"imports":[{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__error"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"_exit"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"close"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"errx"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"execlp"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"exit"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fcntl"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"flock"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"getenv"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"geteuid"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"open"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"puts"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"raise"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"stat"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strlen"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strrchr"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"vfork"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"waitpid"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"write"}],"interesting_strings":{"bundle_ids":["com.apple.vifs"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":8,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"}],"has_network_entitlement":false,"network_frameworks":[]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":1336,"protection":"r-x","segment":"__TEXT","size":760},{"name":"__auth_stubs","offset":2096,"protection":"r-x","segment":"__TEXT","size":304},{"name":"__const","offset":2400,"protection":"r-x","segment":"__TEXT","size":56},{"name":"__cstring","offset":2456,"protection":"r-x","segment":"__TEXT","size":294},{"name":"__unwind_info","offset":2752,"protection":"r-x","segment":"__TEXT","size":96},{"name":"__auth_got","offset":16384,"protection":"rw-","segment":"__DATA_CONST","size":152},{"name":"__data","offset":32768,"protection":"rw-","segment":"__DATA","size":8}],"summary":"This binary is signed by Apple and runs on both Intel and Apple Silicon Macs, but the provided analysis lacks sufficient detail to describe its purpose or behavior. The presence of 4 URLs/endpoints and 6 network destinations suggests network activity, while 8 functions and minimal string data provide insufficient context for security characterization. A full binary audit would require string extraction, behavioral analysis, and entitlement review to determine its actual function.","swift_metadata":null,"title":"Unknown utility — insufficient analysis data to determine function","total_strings":149,"xpc_services":[]}