{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{"4294968632":[{"is_tail_call":false,"symbol":"fwrite","target_va":4294969348},{"is_tail_call":false,"symbol":"host_get_special_port","target_va":4294969396},{"is_tail_call":false,"symbol":"geteuid","target_va":4294969364},{"is_tail_call":false,"symbol":"exit","target_va":4294969332},{"is_tail_call":false,"symbol":"NDR_record","target_va":4294969268},{"is_tail_call":false,"symbol":"mach_host_self","target_va":4294969428},{"is_tail_call":false,"symbol":"__stderrp","target_va":4294969300},{"is_tail_call":false,"symbol":"sub_1000006a4","target_va":4294968996},{"is_tail_call":false,"symbol":"auditon","target_va":4294969316},{"is_tail_call":false,"symbol":"sub_10000074c","target_va":4294969164},{"is_tail_call":false,"symbol":"printf","target_va":4294969476},{"is_tail_call":false,"symbol":"__stderrp","target_va":4294969300},{"is_tail_call":false,"symbol":"getopt","target_va":4294969380}],"4294968996":[{"is_tail_call":false,"symbol":"__error","target_va":4294969284},{"is_tail_call":false,"symbol":"NDR_record","target_va":4294969268},{"is_tail_call":false,"symbol":"mach_host_self","target_va":4294969428},{"is_tail_call":false,"symbol":"mach_msg","target_va":4294969444},{"is_tail_call":false,"symbol":"mach_msg","target_va":4294969444},{"is_tail_call":false,"symbol":"perror","target_va":4294969460},{"is_tail_call":false,"symbol":"__stderrp","target_va":4294969300}],"4294969164":[{"is_tail_call":false,"symbol":"mach_error","target_va":4294969412}]},"data_xrefs":{"by_data":{"4294967308":[4294968632],"4294969492":[4294968632],"4294969499":[4294968632],"4294969541":[4294968996],"4294969572":[4294968996],"4294969590":[4294968996],"4294969610":[4294968996],"4294969626":[4294968996],"4294969641":[4294968632],"4294969672":[4294968632],"4294969709":[4294968632],"4294969733":[4294968632],"4294969752":[4294969164],"4294983680":[4294968632,4294969164],"4294983792":[4294969164],"4294983800":[4294968632]},"by_function":{"4294968632":[{"data_va":4294969492,"insn_va":4294968676,"kind":"CString","value":"einstc"},{"data_va":4294969641,"insn_va":4294968860,"kind":"CString","value":"audit requires root privileges"},{"data_va":4294983800,"insn_va":4294968892,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294968896,"kind":"Global","value":null},{"data_va":4294969499,"insn_va":4294968904,"kind":"CString","value":"Usage: audit -e | -i | -n | -s | -t | -c\n"},{"data_va":4294967308,"insn_va":4294968924,"kind":"Global","value":null},{"data_va":4294969733,"insn_va":4294968944,"kind":"CString","value":"Trigger sent."},{"data_va":4294969672,"insn_va":4294968964,"kind":"CString","value":"Cannot get auditd_control Mach port:"},{"data_va":4294969709,"insn_va":4294968984,"kind":"CString","value":"Error sending trigger: "}],"4294968996":[{"data_va":4294969541,"insn_va":4294969052,"kind":"CString","value":"Error querying audit condition"},{"data_va":4294969572,"insn_va":4294969060,"kind":"CString","value":"Audit not present"},{"data_va":4294969590,"insn_va":4294969088,"kind":"CString","value":"audit condition: %d"},{"data_va":4294969626,"insn_va":4294969120,"kind":"CString","value":" (AUC_NOAUDIT)"},{"data_va":4294969610,"insn_va":4294969132,"kind":"CString","value":" (AUC_AUDITING)"}],"4294969164":[{"data_va":4294983792,"insn_va":4294969184,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969188,"kind":"Global","value":null},{"data_va":4294969752,"insn_va":4294969204,"kind":"Global","value":null}]}},"noreturn_vas":[],"symbols":{"4294968632":"sub_100000538","4294968996":"sub_1000006a4","4294969164":"sub_10000074c"}},"capabilities":[],"code_signature":{"code_directory":{"cdhash":"c11234df5d4dd7240c1b6df49856bfb8b9071093e58744747ae7eeb404f44a53","flag_names":[],"flags":0,"hash_type":2,"identifier":"com.apple.audit","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","frameworkhash":"821b9f412c19e16a935f95418b1f75e62d49f7a1fd21178778e954e5a9e0edb6","imphash":"a622f5b89cfe0eb95949a852f0fe333f86c16485d73b3b45e61031ccefb3a6f2","sha256_text":"f0f00ca03a56d394f338177847d889da5c354144752f2df87ec45fa197bc8910","symbolhash":"a622f5b89cfe0eb95949a852f0fe333f86c16485d73b3b45e61031ccefb3a6f2"},"sets":{"apis_called":["NDR_record","__error","__stderrp","auditon","exit","fwrite","geteuid","getopt","host_get_special_port","mach_error","mach_host_self","mach_msg","perror","printf","sub_1000006a4","sub_10000074c"],"bundle_ids":["com.apple.audit"],"cpp_classes":[],"entitlements":[],"frameworks":["libbsm.0.dylib","libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":[],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":[]},"vector":{"bundle_ids":1,"cap_analytics":0,"cap_hardware":0,"cap_ipc":0,"cap_keychain":0,"cap_location":0,"cap_network":0,"cap_security":0,"cap_storage":0,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":0,"file_paths":0,"frameworks_private":0,"frameworks_total":2,"iokit_constants":0,"library_functions":0,"nlist_functions":3,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":7,"size_log2":16.630722,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":0,"text_ratio":0.006267739,"url_endpoints":4,"xpc_provides":0}},"dwarf_metadata":null,"entitlements":{"entries":{},"raw_plist":null},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-07T05:21:14Z","available_arches":["x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"c11234df5d4dd7240c1b6df49856bfb8b9071093e58744747ae7eeb404f44a53","file_modified":"2026-04-06T12:08:20Z","file_size":101472,"is_arm64e":true,"min_os":"26.1.0","name":"audit","platform":"macOS","sdk":"26.1.0","sha256":"a8c13b9ebd2c71db61680eb919571caf7a959960084803e3d8d7c507073af84c","sha256_slice":"58a1873df0c2a29017a14ddc75f9aea8b618c777b039c1ab55dd3ad2e1085b25","source_version":"90.0.0.0.0","team_id":null,"uuid":"6C798987-954D-3C7E-A73B-BE0869C679C5"},"frameworks":[{"is_private":false,"is_weak":false,"name":"/usr/lib/libbsm.0.dylib"},{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":3,"imports":[{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__error"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"auditon"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"exit"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fwrite"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"geteuid"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"getopt"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"host_get_special_port"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"mach_error"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"mach_host_self"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"mach_msg"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"perror"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"printf"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"putchar"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"puts"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"NDR_record"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stderrp"}],"interesting_strings":{"bundle_ids":["com.apple.audit"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":3,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"}],"has_network_entitlement":false,"network_frameworks":[]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":1336,"protection":"r-x","segment":"__TEXT","size":636},{"name":"__auth_stubs","offset":1972,"protection":"r-x","segment":"__TEXT","size":224},{"name":"__cstring","offset":2196,"protection":"r-x","segment":"__TEXT","size":255},{"name":"__const","offset":2456,"protection":"r-x","segment":"__TEXT","size":8},{"name":"__unwind_info","offset":2464,"protection":"r-x","segment":"__TEXT","size":96},{"name":"__auth_got","offset":16384,"protection":"rw-","segment":"__DATA_CONST","size":112},{"name":"__got","offset":16496,"protection":"rw-","segment":"__DATA_CONST","size":16}],"summary":"Apple-signed daemon that handles network-related operations across macOS systems. Communicates with multiple network endpoints to retrieve or sync device configuration and system state. Interacts with bundled system services and exposes networking capabilities through standard macOS frameworks. Operates as a background system service with no direct user interface.","swift_metadata":null,"title":"System service — manages network connectivity and device configuration","total_strings":138,"xpc_services":[]}