{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{"4294968784":[{"is_tail_call":false,"symbol":"getauditflagsbin","target_va":4294973308},{"is_tail_call":false,"symbol":"optarg","target_va":4294973452},{"is_tail_call":false,"symbol":"strdup","target_va":4294973580},{"is_tail_call":false,"symbol":"setvbuf","target_va":4294973532},{"is_tail_call":false,"symbol":"malloc_type_calloc","target_va":4294973388},{"is_tail_call":false,"symbol":"__stdoutp","target_va":4294973260},{"is_tail_call":false,"symbol":"strerror","target_va":4294973596},{"is_tail_call":false,"symbol":"fwrite","target_va":4294973292},{"is_tail_call":false,"symbol":"strerror","target_va":4294973596},{"is_tail_call":false,"symbol":"getauevnonam","target_va":4294973324},{"is_tail_call":false,"symbol":"strerror","target_va":4294973596},{"is_tail_call":false,"symbol":"fwrite","target_va":4294973292},{"is_tail_call":false,"symbol":"strdup","target_va":4294973580},{"is_tail_call":false,"symbol":"setvbuf","target_va":4294973532},{"is_tail_call":false,"symbol":"malloc_type_calloc","target_va":4294973388},{"is_tail_call":false,"symbol":"strdup","target_va":4294973580},{"is_tail_call":false,"symbol":"setvbuf","target_va":4294973532},{"is_tail_call":false,"symbol":"malloc_type_calloc","target_va":4294973388},{"is_tail_call":false,"symbol":"strerror","target_va":4294973596},{"is_tail_call":false,"symbol":"getauevnonam","target_va":4294973324},{"is_tail_call":false,"symbol":"getpwnam","target_va":4294973372},{"is_tail_call":false,"symbol":"strerror","target_va":4294973596},{"is_tail_call":false,"symbol":"getauevnonam","target_va":4294973324},{"is_tail_call":false,"symbol":"optind","target_va":4294973468},{"is_tail_call":false,"symbol":"regcomp","target_va":4294973484},{"is_tail_call":false,"symbol":"regcomp","target_va":4294973484},{"is_tail_call":false,"symbol":"regcomp","target_va":4294973484},{"is_tail_call":false,"symbol":"regcomp","target_va":4294973484},{"is_tail_call":false,"symbol":"regcomp","target_va":4294973484},{"is_tail_call":false,"symbol":"regcomp","target_va":4294973484},{"is_tail_call":false,"symbol":"strerror","target_va":4294973596},{"is_tail_call":false,"symbol":"getopt","target_va":4294973356},{"is_tail_call":false,"symbol":"strerror","target_va":4294973596},{"is_tail_call":false,"symbol":"au_fetch_tok","target_va":4294973276},{"is_tail_call":false,"symbol":"regerror","target_va":4294973500},{"is_tail_call":false,"symbol":"strcmp","target_va":4294973564},{"is_tail_call":false,"symbol":"strchr","target_va":4294973548},{"is_tail_call":false,"symbol":"getgrnam","target_va":4294973340},{"is_tail_call":false,"symbol":"regerror","target_va":4294973500},{"is_tail_call":false,"symbol":"malloc_type_malloc","target_va":4294973404},{"is_tail_call":false,"symbol":"strcmp","target_va":4294973564},{"is_tail_call":false,"symbol":"fprintf","target_va":4294973212},{"is_tail_call":false,"symbol":"au_preselect","target_va":4294973020},{"is_tail_call":false,"symbol":"regexec","target_va":4294973516},{"is_tail_call":false,"symbol":"malloc_type_realloc","target_va":4294973420},{"is_tail_call":false,"symbol":"fopen","target_va":4294973196},{"is_tail_call":false,"symbol":"errx","target_va":4294973132},{"is_tail_call":false,"symbol":"sub_100001144","target_va":4294971716},{"is_tail_call":false,"symbol":"sub_100000ef8","target_va":4294971128},{"is_tail_call":false,"symbol":"sub_100000ef8","target_va":4294971128},{"is_tail_call":false,"symbol":"sub_100000ef8","target_va":4294971128},{"is_tail_call":false,"symbol":"sub_100000ef8","target_va":4294971128},{"is_tail_call":false,"symbol":"fileno","target_va":4294973180},{"is_tail_call":false,"symbol":"fclose","target_va":4294973164},{"is_tail_call":false,"symbol":"free","target_va":4294973228},{"is_tail_call":false,"symbol":"optarg","target_va":4294973452},{"is_tail_call":false,"symbol":"sub_100001144","target_va":4294971716},{"is_tail_call":false,"symbol":"exit","target_va":4294973148},{"is_tail_call":false,"symbol":"errx","target_va":4294973132},{"is_tail_call":false,"symbol":"sub_100000ef8","target_va":4294971128},{"is_tail_call":false,"symbol":"difftime","target_va":4294973100},{"is_tail_call":false,"symbol":"err","target_va":4294973116},{"is_tail_call":false,"symbol":"sub_100000ef8","target_va":4294971128}],"4294971128":[{"is_tail_call":false,"symbol":"fopen","target_va":4294973196},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"errx","target_va":4294973132}],"4294971716":[{"is_tail_call":false,"symbol":"__stdinp","target_va":4294973068},{"is_tail_call":false,"symbol":"__error","target_va":4294973036},{"is_tail_call":false,"symbol":"mktime","target_va":4294973436},{"is_tail_call":false,"symbol":"__stderrp","target_va":4294973052},{"is_tail_call":false,"symbol":"au_read_rec","target_va":4294973084},{"is_tail_call":false,"symbol":"au_read_rec","target_va":4294973084},{"is_tail_call":false,"symbol":"__stderrp","target_va":4294973052},{"is_tail_call":false,"symbol":"strerror","target_va":4294973596},{"is_tail_call":false,"symbol":"strerror","target_va":4294973596},{"is_tail_call":false,"symbol":"fstat","target_va":4294973244},{"is_tail_call":false,"symbol":"fprintf","target_va":4294973212},{"is_tail_call":false,"symbol":"__stdinp","target_va":4294973068}]},"data_xrefs":{"by_data":{"4294970992":[4294968784],"4294971616":[4294968784],"4294973612":[4294968784],"4294973640":[4294968784],"4294973668":[4294968784],"4294973681":[4294968784],"4294973697":[4294968784],"4294973731":[4294968784],"4294973738":[4294968784],"4294973745":[4294968784],"4294973753":[4294968784],"4294973774":[4294968784],"4294973789":[4294968784],"4294973791":[4294968784],"4294973808":[4294971128],"4294973812":[4294971128],"4294973853":[4294971128],"4294973870":[4294971128],"4294973889":[4294971128],"4294973929":[4294971128],"4294973970":[4294971128],"4294974000":[4294971128],"4294974024":[4294971128],"4294974058":[4294971128],"4294974093":[4294971128],"4294974123":[4294971128],"4294974148":[4294971128],"4294974184":[4294971128],"4294974212":[4294971128],"4294974232":[4294971128],"4294974248":[4294971128],"4294974261":[4294971128],"4294974276":[4294971128],"4294974291":[4294971128],"4294974319":[4294971128],"4294974348":[4294971128],"4294974373":[4294971128],"4294974408":[4294968784],"4294974413":[4294968784],"4294974420":[4294968784],"4294974424":[4294968784],"4294974430":[4294968784],"4294974436":[4294968784],"4294974441":[4294968784],"4294974462":[4294968784],"4294974474":[4294968784],"4294983680":[4294968784,4294971128,4294971716],"4294983688":[4294968784],"4294983976":[4294968784,4294971128],"4294983984":[4294968784],"4294983992":[4294968784,4294971716],"4294984000":[4294968784],"4294984008":[4294968784],"4295000064":[4294968784,4294971716],"4295000072":[4294968784],"4295000080":[4294968784,4294971716],"4295000088":[4294971716],"4295000096":[4294971716],"4295000104":[4294968784,4294971716],"4295000112":[4294971716],"4295000116":[4294971716],"4295000120":[4294971716],"4295000124":[4294971716],"4295000128":[4294968784,4294971716],"4295000136":[4294968784],"4295000140":[4294968784],"4295000144":[4294971716],"4295000148":[4294971716],"4295000160":[4294971716],"4295000168":[4294971716],"4295000176":[4294971716],"4295000184":[4294971716]},"by_function":{"4294968784":[{"data_va":4294973612,"insn_va":4294968840,"kind":"CString","value":"Aa:b:c:d:e:f:g:j:m:o:r:Uu:v"},{"data_va":4294983992,"insn_va":4294968852,"kind":"Global","value":null},{"data_va":4294984000,"insn_va":4294968860,"kind":"Global","value":null},{"data_va":4294970992,"insn_va":4294968928,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294968948,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294968980,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294968996,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969032,"kind":"Global","value":null},{"data_va":4294973731,"insn_va":4294969044,"kind":"CString","value":"%Y%m%d"},{"data_va":4294983680,"insn_va":4294969108,"kind":"Global","value":null},{"data_va":4295000104,"insn_va":4294969116,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294969128,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969144,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969180,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294969204,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969220,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969256,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294969280,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969296,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969332,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294969356,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294969372,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969404,"kind":"Global","value":null},{"data_va":4294973668,"insn_va":4294969416,"kind":"CString","value":"%Y%m%d%H%M%S"},{"data_va":4295000080,"insn_va":4294969468,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969500,"kind":"Global","value":null},{"data_va":4294973668,"insn_va":4294969512,"kind":"CString","value":"%Y%m%d%H%M%S"},{"data_va":4294983680,"insn_va":4294969564,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969600,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294969624,"kind":"Global","value":null},{"data_va":4295000128,"insn_va":4294969644,"kind":"Global","value":null},{"data_va":4295000136,"insn_va":4294969656,"kind":"Global","value":null},{"data_va":4295000140,"insn_va":4294969664,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969724,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969760,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294969784,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969800,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969824,"kind":"Global","value":null},{"data_va":4294974408,"insn_va":4294969836,"kind":"CString","value":"file"},{"data_va":4294974413,"insn_va":4294969856,"kind":"CString","value":"msgqid"},{"data_va":4294974420,"insn_va":4294969876,"kind":"CString","value":"pid"},{"data_va":4294974424,"insn_va":4294969896,"kind":"CString","value":"semid"},{"data_va":4294974430,"insn_va":4294969916,"kind":"CString","value":"shmid"},{"data_va":4294974436,"insn_va":4294969936,"kind":"CString","value":"sock"},{"data_va":4294983680,"insn_va":4294969964,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294969988,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294970004,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294970084,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294970112,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294970132,"kind":"Global","value":null},{"data_va":4295000064,"insn_va":4294970276,"kind":"Global","value":null},{"data_va":4295000064,"insn_va":4294970336,"kind":"Global","value":null},{"data_va":4295000072,"insn_va":4294970460,"kind":"Global","value":null},{"data_va":4294983992,"insn_va":4294970516,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294970520,"kind":"Global","value":null},{"data_va":4294983976,"insn_va":4294970572,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294970576,"kind":"Global","value":null},{"data_va":4294974462,"insn_va":4294970600,"kind":"CString","value":"calloc: %s\n"},{"data_va":4294983976,"insn_va":4294970636,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294970640,"kind":"Global","value":null},{"data_va":4294974474,"insn_va":4294970652,"kind":"CString","value":"regcomp: %s\n"},{"data_va":4294984008,"insn_va":4294970680,"kind":"Global","value":null},{"data_va":4294983984,"insn_va":4294970700,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294970704,"kind":"Global","value":null},{"data_va":4294973640,"insn_va":4294970720,"kind":"CString","value":"d is exclusive with a and b"},{"data_va":4294973774,"insn_va":4294970732,"kind":"CString","value":"Unknown option"},{"data_va":4294973697,"insn_va":4294970744,"kind":"CString","value":"'d' is exclusive with 'a' and 'b'"},{"data_va":4294973681,"insn_va":4294970756,"kind":"CString","value":"Incorrect class"},{"data_va":4294973789,"insn_va":4294970780,"kind":"CString","value":null},{"data_va":4294983680,"insn_va":4294970784,"kind":"Global","value":null},{"data_va":4294971616,"insn_va":4294970836,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294970864,"kind":"Global","value":null},{"data_va":4294983688,"insn_va":4294970900,"kind":"Global","value":null},{"data_va":4294973738,"insn_va":4294970924,"kind":"CString","value":"malloc"},{"data_va":4294973753,"insn_va":4294970936,"kind":"CString","value":"Incorrect event name"},{"data_va":4294973745,"insn_va":4294970948,"kind":"CString","value":"realloc"},{"data_va":4294973791,"insn_va":4294970968,"kind":"CString","value":"Couldn't open %s"},{"data_va":4294974441,"insn_va":4294970984,"kind":"CString","value":"unknown value for -o"}],"4294971128":[{"data_va":4294983976,"insn_va":4294971152,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294971156,"kind":"Global","value":null},{"data_va":4294973808,"insn_va":4294971168,"kind":"CString","value":"%s\n"},{"data_va":4294983680,"insn_va":4294971180,"kind":"Global","value":null},{"data_va":4294973812,"insn_va":4294971188,"kind":"CString","value":"Usage: auditreduce [options] [file ...]\n"},{"data_va":4294983680,"insn_va":4294971204,"kind":"Global","value":null},{"data_va":4294973853,"insn_va":4294971212,"kind":"CString","value":"\tOptions are : \n"},{"data_va":4294983680,"insn_va":4294971228,"kind":"Global","value":null},{"data_va":4294973870,"insn_va":4294971236,"kind":"CString","value":"\t-A : all records\n"},{"data_va":4294983680,"insn_va":4294971252,"kind":"Global","value":null},{"data_va":4294973889,"insn_va":4294971260,"kind":"CString","value":"\t-a YYYYMMDD[HH[[MM[SS]]] : after date\n"},{"data_va":4294983680,"insn_va":4294971276,"kind":"Global","value":null},{"data_va":4294973929,"insn_va":4294971284,"kind":"CString","value":"\t-b YYYYMMDD[HH[[MM[SS]]] : before date\n"},{"data_va":4294983680,"insn_va":4294971300,"kind":"Global","value":null},{"data_va":4294973970,"insn_va":4294971308,"kind":"CString","value":"\t-c <flags> : matching class\n"},{"data_va":4294983680,"insn_va":4294971324,"kind":"Global","value":null},{"data_va":4294974000,"insn_va":4294971332,"kind":"CString","value":"\t-d YYYYMMDD : on date\n"},{"data_va":4294983680,"insn_va":4294971348,"kind":"Global","value":null},{"data_va":4294974024,"insn_va":4294971356,"kind":"CString","value":"\t-e <uid|name>  : effective user\n"},{"data_va":4294983680,"insn_va":4294971372,"kind":"Global","value":null},{"data_va":4294974058,"insn_va":4294971380,"kind":"CString","value":"\t-f <gid|group> : effective group\n"},{"data_va":4294983680,"insn_va":4294971396,"kind":"Global","value":null},{"data_va":4294974093,"insn_va":4294971404,"kind":"CString","value":"\t-g <gid|group> : real group\n"},{"data_va":4294983680,"insn_va":4294971420,"kind":"Global","value":null},{"data_va":4294974123,"insn_va":4294971428,"kind":"CString","value":"\t-j <pid> : subject id \n"},{"data_va":4294983680,"insn_va":4294971444,"kind":"Global","value":null},{"data_va":4294974148,"insn_va":4294971452,"kind":"CString","value":"\t-m <evno|evname> : matching event\n"},{"data_va":4294983680,"insn_va":4294971468,"kind":"Global","value":null},{"data_va":4294974184,"insn_va":4294971476,"kind":"CString","value":"\t-o objecttype=objectvalue\n"},{"data_va":4294983680,"insn_va":4294971492,"kind":"Global","value":null},{"data_va":4294974212,"insn_va":4294971500,"kind":"CString","value":"\t\t file=<pathname>\n"},{"data_va":4294983680,"insn_va":4294971516,"kind":"Global","value":null},{"data_va":4294974232,"insn_va":4294971524,"kind":"CString","value":"\t\t msgqid=<ID>\n"},{"data_va":4294983680,"insn_va":4294971540,"kind":"Global","value":null},{"data_va":4294974248,"insn_va":4294971548,"kind":"CString","value":"\t\t pid=<ID>\n"},{"data_va":4294983680,"insn_va":4294971564,"kind":"Global","value":null},{"data_va":4294974261,"insn_va":4294971572,"kind":"CString","value":"\t\t semid=<ID>\n"},{"data_va":4294983680,"insn_va":4294971588,"kind":"Global","value":null},{"data_va":4294974276,"insn_va":4294971596,"kind":"CString","value":"\t\t shmid=<ID>\n"},{"data_va":4294983680,"insn_va":4294971612,"kind":"Global","value":null},{"data_va":4294974291,"insn_va":4294971620,"kind":"CString","value":"\t-r <uid|name> : real user\n"},{"data_va":4294983680,"insn_va":4294971636,"kind":"Global","value":null},{"data_va":4294974319,"insn_va":4294971644,"kind":"CString","value":"\t-u <uid|name> : audit user\n"},{"data_va":4294983680,"insn_va":4294971660,"kind":"Global","value":null},{"data_va":4294974348,"insn_va":4294971668,"kind":"CString","value":"\t-U : unbuffered output\n"},{"data_va":4294983680,"insn_va":4294971684,"kind":"Global","value":null},{"data_va":4294974373,"insn_va":4294971692,"kind":"CString","value":"\t-v : select non-matching records\n"}],"4294971716":[{"data_va":4295000064,"insn_va":4294971972,"kind":"Global","value":null},{"data_va":4295000104,"insn_va":4294972084,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294972112,"kind":"Global","value":null},{"data_va":4295000088,"insn_va":4294972132,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294972152,"kind":"Global","value":null},{"data_va":4295000096,"insn_va":4294972164,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294972184,"kind":"Global","value":null},{"data_va":4295000104,"insn_va":4294972200,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294972224,"kind":"Global","value":null},{"data_va":4295000128,"insn_va":4294972256,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294972308,"kind":"Global","value":null},{"data_va":4295000148,"insn_va":4294972324,"kind":"Global","value":null},{"data_va":4295000112,"insn_va":4294972348,"kind":"Global","value":null},{"data_va":4295000116,"insn_va":4294972368,"kind":"Global","value":null},{"data_va":4295000120,"insn_va":4294972388,"kind":"Global","value":null},{"data_va":4295000144,"insn_va":4294972408,"kind":"Global","value":null},{"data_va":4295000124,"insn_va":4294972428,"kind":"Global","value":null},{"data_va":4295000160,"insn_va":4294972488,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294972512,"kind":"Global","value":null},{"data_va":4295000148,"insn_va":4294972528,"kind":"Global","value":null},{"data_va":4295000112,"insn_va":4294972552,"kind":"Global","value":null},{"data_va":4295000116,"insn_va":4294972572,"kind":"Global","value":null},{"data_va":4295000120,"insn_va":4294972592,"kind":"Global","value":null},{"data_va":4295000144,"insn_va":4294972612,"kind":"Global","value":null},{"data_va":4295000168,"insn_va":4294972632,"kind":"Global","value":null},{"data_va":4295000176,"insn_va":4294972696,"kind":"Global","value":null},{"data_va":4295000184,"insn_va":4294972720,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294972860,"kind":"Global","value":null},{"data_va":4295000080,"insn_va":4294972896,"kind":"Global","value":null},{"data_va":4294983992,"insn_va":4294972920,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294972924,"kind":"Global","value":null}]}},"noreturn_vas":[],"symbols":{"4294968784":"sub_1000005d0","4294970992":"sub_100000e70","4294971128":"sub_100000ef8","4294971716":"sub_100001144"}},"capabilities":[],"code_signature":{"code_directory":{"cdhash":"6b23c2820fd33e25d5e2f7e68639e8e6904a34a0921c4bee304793f9bb46de5c","flag_names":[],"flags":0,"hash_type":2,"identifier":"com.apple.auditreduce","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","frameworkhash":"821b9f412c19e16a935f95418b1f75e62d49f7a1fd21178778e954e5a9e0edb6","imphash":"5d82a0d2917f95a77155f8859d04b0ba1bf8823d4f6515e840834760406d493b","sha256_text":"365b16678fd1f325106a6fc64bb2b346fb3f00fbab3d712db7fc07723532b96d","symbolhash":"5d82a0d2917f95a77155f8859d04b0ba1bf8823d4f6515e840834760406d493b"},"sets":{"apis_called":["__error","__stderrp","__stdinp","__stdoutp","au_fetch_tok","au_preselect","au_read_rec","difftime","err","errx","exit","fclose","fileno","fopen","fprintf","free","fstat","fwrite","getauditflagsbin","getauevnonam","getgrnam","getopt","getpwnam","malloc_type_calloc","malloc_type_malloc","malloc_type_realloc","mktime","optarg","optind","regcomp","regerror","regexec","setvbuf","strchr","strcmp","strdup","strerror","sub_100000ef8","sub_100001144"],"bundle_ids":["com.apple.auditreduce"],"cpp_classes":[],"entitlements":[],"frameworks":["libbsm.0.dylib","libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":[],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":[]},"vector":{"bundle_ids":1,"cap_analytics":0,"cap_hardware":0,"cap_ipc":0,"cap_keychain":0,"cap_location":0,"cap_network":0,"cap_security":0,"cap_storage":0,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":0,"file_paths":0,"frameworks_private":0,"frameworks_total":2,"iokit_constants":0,"library_functions":0,"nlist_functions":4,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":8,"size_log2":17.04951,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":0,"text_ratio":0.031227885,"url_endpoints":4,"xpc_provides":0}},"dwarf_metadata":null,"entitlements":{"entries":{},"raw_plist":null},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-07T05:21:13Z","available_arches":["x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"6b23c2820fd33e25d5e2f7e68639e8e6904a34a0921c4bee304793f9bb46de5c","file_modified":"2026-04-06T12:08:24Z","file_size":135648,"is_arm64e":true,"min_os":"26.1.0","name":"auditreduce","platform":"macOS","sdk":"26.1.0","sha256":"8c38df7df68308cc02ece875b426e239d268540fb22c31b36f81ba06199a8659","sha256_slice":"7423c1fa52875aeb2f9859f2b16a3673702f6dc759f96a455dcdf4b06e5d6ac7","source_version":"90.0.0.0.0","team_id":null,"uuid":"3C6E7CC8-6AE6-3A2C-B001-163F7618F2CF"},"frameworks":[{"is_private":false,"is_weak":false,"name":"/usr/lib/libbsm.0.dylib"},{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":4,"imports":[{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"au_fetch_tok"},{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"au_preselect"},{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"au_read_rec"},{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"getauditflagsbin"},{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"getauevnonam"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__error"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"difftime"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"err"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"errx"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"exit"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fclose"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fileno"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fopen"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fprintf"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"free"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fstat"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fwrite"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"getgrnam"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"getopt"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"getpwnam"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"malloc_type_calloc"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"malloc_type_malloc"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"malloc_type_realloc"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"mktime"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"regcomp"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"regerror"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"regexec"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"setvbuf"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strchr"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strcmp"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strdup"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strerror"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strftime"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strlcpy"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strlen"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strptime"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strtol"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stderrp"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stdinp"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stdoutp"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"optarg"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"optind"}],"interesting_strings":{"bundle_ids":["com.apple.auditreduce"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":4,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Ipv6","value":"Aa:b:c:d:e:f"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"}],"has_network_entitlement":false,"network_frameworks":[]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":1488,"protection":"r-x","segment":"__TEXT","size":4236},{"name":"__auth_stubs","offset":5724,"protection":"r-x","segment":"__TEXT","size":592},{"name":"__cstring","offset":6316,"protection":"r-x","segment":"__TEXT","size":875},{"name":"__unwind_info","offset":7192,"protection":"r-x","segment":"__TEXT","size":112},{"name":"__auth_got","offset":16384,"protection":"rw-","segment":"__DATA_CONST","size":296},{"name":"__got","offset":16680,"protection":"rw-","segment":"__DATA_CONST","size":40},{"name":"__data","offset":32768,"protection":"rw-","segment":"__DATA","size":16},{"name":"__bss","offset":0,"protection":"rw-","segment":"__DATA","size":120}],"summary":"Runs as a signed Apple system daemon that exposes functionality through XPC service endpoints. Communicates with 7 network endpoints and contains 4 exported functions for inter-process communication. The service handles platform-specific tasks across both Intel and ARM64 architectures, leveraging 2 system frameworks for its operations. Registers a bundle identifier for service discovery and receives requests from authorized client processes.","swift_metadata":null,"title":"System service — manages platform-specific operations via private XPC interfaces","total_strings":233,"xpc_services":[]}