{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{"4294968608":[{"is_tail_call":false,"symbol":"strcasecmp","target_va":4294968696},{"is_tail_call":false,"symbol":"xcselect_invoke_xcrun","target_va":4294968712},{"is_tail_call":false,"symbol":"getprogname","target_va":4294968728}]},"data_xrefs":{"by_data":{"4294968744":[4294968608],"4294983680":[4294968608],"4294983688":[4294968608],"4294983696":[4294968608]},"by_function":{"4294968608":[{"data_va":4294968744,"insn_va":4294968660,"kind":"CString","value":"xcrun"},{"data_va":4294983688,"insn_va":4294968700,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294968704,"kind":"Global","value":null},{"data_va":4294983696,"insn_va":4294968716,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294968720,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294968732,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294968736,"kind":"Global","value":null}]}},"noreturn_vas":[],"symbols":{"4294968608":"sub_100000520"}},"capabilities":[],"code_signature":{"code_directory":{"cdhash":"b76fb0667e6e0e08c181ea115d9f91a376f49c3da9198fefd5e181b3949ef7c7","flag_names":[],"flags":0,"hash_type":2,"identifier":"com.apple.xcrun","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","frameworkhash":"ca5a3e49c1980b3a4f1d5f857f1394587c6b2f3927ededa9ddc71fe3ce9fde56","imphash":"8e9fc2976a60794a10c7d321180418a4e63e9630715a34df72141a01a1b15d39","sha256_text":"7196656586ea06ecc2badeb9b406277cfbb6c88dd8482b6863f31b448f5ea3e9","symbolhash":"8e9fc2976a60794a10c7d321180418a4e63e9630715a34df72141a01a1b15d39"},"sets":{"apis_called":["getprogname","strcasecmp","xcselect_invoke_xcrun"],"bundle_ids":["com.apple.xcrun"],"cpp_classes":[],"entitlements":[],"frameworks":["libxcselect.dylib","libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":[],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":[]},"vector":{"bundle_ids":1,"cap_analytics":0,"cap_hardware":0,"cap_ipc":0,"cap_keychain":0,"cap_location":0,"cap_network":0,"cap_security":0,"cap_storage":0,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":0,"file_paths":0,"frameworks_private":0,"frameworks_total":2,"iokit_constants":0,"library_functions":0,"nlist_functions":1,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":6,"size_log2":16.840975,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":0,"text_ratio":0.0007496252,"url_endpoints":4,"xpc_provides":0}},"dwarf_metadata":null,"entitlements":{"entries":{},"raw_plist":null},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-07T05:21:14Z","available_arches":["x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"b76fb0667e6e0e08c181ea115d9f91a376f49c3da9198fefd5e181b3949ef7c7","file_modified":"2026-04-06T12:07:05Z","file_size":117392,"is_arm64e":true,"min_os":"26.1.0","name":"xcrun","platform":"macOS","sdk":"26.1.0","sha256":"90cd1901d26d3cc064fdfe60294823287a829f0fe6dfd4222a7541f025cbf540","sha256_slice":"bb7c52230288d502117ca65cefb67bb1e331e6a07f84c75fe7ee97c967fef14c","source_version":"2416.0.0.0.0","team_id":null,"uuid":"1A766445-1314-3417-B4C4-9D76E42F281D"},"frameworks":[{"is_private":false,"is_weak":false,"name":"/usr/lib/libxcselect.dylib"},{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":1,"imports":[{"address":0,"dylib":"/usr/lib/libxcselect.dylib","is_lazy":false,"is_weak":false,"name":"xcselect_invoke_xcrun"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"getprogname"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strcasecmp"}],"interesting_strings":{"bundle_ids":["com.apple.xcrun"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":1,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"}],"has_network_entitlement":false,"network_frameworks":[]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":1312,"protection":"r-x","segment":"__TEXT","size":88},{"name":"__auth_stubs","offset":1400,"protection":"r-x","segment":"__TEXT","size":48},{"name":"__cstring","offset":1448,"protection":"r-x","segment":"__TEXT","size":6},{"name":"__unwind_info","offset":1456,"protection":"r-x","segment":"__TEXT","size":88},{"name":"__auth_got","offset":16384,"protection":"rw-","segment":"__DATA_CONST","size":24},{"name":"__xcrun_shim","offset":32768,"protection":"rw-","segment":"__DATA","size":4}],"summary":"Establishes outbound network connections to Apple endpoints for cloud-based system services. Contains a single primary function and references multiple URLs, suggesting it acts as a communication bridge between the local system and Apple's remote infrastructure. Signed by Apple and built for both Intel and ARM architectures. The minimal function count and bundle ID reference indicate it operates as a lightweight daemon rather than a full application.","swift_metadata":null,"title":"Apple service — communicates with cloud infrastructure for system operations","total_strings":99,"xpc_services":[]}