{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{"4294968576":[{"is_tail_call":false,"symbol":"localtime","target_va":4294969472},{"is_tail_call":false,"symbol":"strftime","target_va":4294969536},{"is_tail_call":false,"symbol":"time","target_va":4294969552},{"is_tail_call":false,"symbol":"__stdinp","target_va":4294969392},{"is_tail_call":false,"symbol":"__stderrp","target_va":4294969376},{"is_tail_call":false,"symbol":"fgets","target_va":4294969424},{"is_tail_call":false,"symbol":"__stderrp","target_va":4294969376},{"is_tail_call":false,"symbol":"sub_1000006e8","target_va":4294969064},{"is_tail_call":false,"symbol":"sleep","target_va":4294969520},{"is_tail_call":false,"symbol":"fork","target_va":4294969440},{"is_tail_call":false,"symbol":"sub_1000006e8","target_va":4294969064}],"4294969064":[{"is_tail_call":false,"symbol":"exit","target_va":4294969408},{"is_tail_call":false,"symbol":"printf","target_va":4294969488},{"is_tail_call":false,"symbol":"printf","target_va":4294969488},{"is_tail_call":false,"symbol":"time","target_va":4294969552},{"is_tail_call":false,"symbol":"sleep","target_va":4294969520},{"is_tail_call":false,"symbol":"fork","target_va":4294969440},{"is_tail_call":false,"symbol":"setlocale","target_va":4294969504},{"is_tail_call":false,"symbol":"fwrite","target_va":4294969456},{"is_tail_call":false,"symbol":"printf","target_va":4294969488},{"is_tail_call":false,"symbol":"time","target_va":4294969552},{"is_tail_call":false,"symbol":"printf","target_va":4294969488},{"is_tail_call":false,"symbol":"time","target_va":4294969552},{"is_tail_call":false,"symbol":"time","target_va":4294969552},{"is_tail_call":false,"symbol":"__stderrp","target_va":4294969376}]},"data_xrefs":{"by_data":{"4294967300":[4294968576],"4294967302":[4294968576],"4294967304":[4294968576],"4294967308":[4294968576],"4294969634":[4294968576],"4294969635":[4294968576],"4294969645":[4294968576],"4294969673":[4294969064],"4294969676":[4294969064],"4294969704":[4294969064],"4294969739":[4294969064],"4294969764":[4294969064],"4294969782":[4294969064],"4294969829":[4294968576],"4294983680":[4294968576,4294969064],"4294983688":[4294969064],"4294983696":[4294969064],"4294983704":[4294969064],"4294983712":[4294969064],"4294983720":[4294969064],"4294983728":[4294969064],"4294983736":[4294969064],"4294983744":[4294969064],"4294983752":[4294969064],"4294983760":[4294969064],"4294983768":[4294969064],"4294983776":[4294968576],"4294983784":[4294968576]},"by_function":{"4294968576":[{"data_va":4294969634,"insn_va":4294968612,"kind":"CString","value":null},{"data_va":4294969635,"insn_va":4294968632,"kind":"CString","value":"setlocale"},{"data_va":4294969645,"insn_va":4294968656,"kind":"CString","value":"When do you have to leave? "},{"data_va":4294983784,"insn_va":4294968676,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294968680,"kind":"Global","value":null},{"data_va":4294967302,"insn_va":4294968684,"kind":"Global","value":null},{"data_va":4294983776,"insn_va":4294968840,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294968844,"kind":"Global","value":null},{"data_va":4294969829,"insn_va":4294968852,"kind":"CString","value":"usage: leave [[+]hhmm]\n"},{"data_va":4294967304,"insn_va":4294968940,"kind":"Global","value":null},{"data_va":4294967308,"insn_va":4294968964,"kind":"Global","value":null},{"data_va":4294967300,"insn_va":4294968976,"kind":"Global","value":null},{"data_va":4294967300,"insn_va":4294969000,"kind":"Global","value":null}],"4294969064":[{"data_va":4294969704,"insn_va":4294969132,"kind":"CString","value":"\u0007\u0007You have to leave in 5 minutes.\n"},{"data_va":4294969673,"insn_va":4294969208,"kind":"CString","value":"%+"},{"data_va":4294969676,"insn_va":4294969236,"kind":"CString","value":"Alarm set for %s. (pid %d)\n"},{"data_va":4294969739,"insn_va":4294969268,"kind":"CString","value":"\u0007\u0007Just one more minute!\n"},{"data_va":4294969764,"insn_va":4294969300,"kind":"CString","value":"\u0007\u0007Time to leave!\n"},{"data_va":4294969782,"insn_va":4294969352,"kind":"CString","value":"\u0007\u0007That was the last time I'll tell you.  Bye.\n"},{"data_va":4294983680,"insn_va":4294969380,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969384,"kind":"Global","value":null},{"data_va":4294983688,"insn_va":4294969396,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969400,"kind":"Global","value":null},{"data_va":4294983696,"insn_va":4294969412,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969416,"kind":"Global","value":null},{"data_va":4294983704,"insn_va":4294969428,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969432,"kind":"Global","value":null},{"data_va":4294983712,"insn_va":4294969444,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969448,"kind":"Global","value":null},{"data_va":4294983720,"insn_va":4294969460,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969464,"kind":"Global","value":null},{"data_va":4294983728,"insn_va":4294969476,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969480,"kind":"Global","value":null},{"data_va":4294983736,"insn_va":4294969492,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969496,"kind":"Global","value":null},{"data_va":4294983744,"insn_va":4294969508,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969512,"kind":"Global","value":null},{"data_va":4294983752,"insn_va":4294969524,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969528,"kind":"Global","value":null},{"data_va":4294983760,"insn_va":4294969540,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969544,"kind":"Global","value":null},{"data_va":4294983768,"insn_va":4294969556,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969560,"kind":"Global","value":null}]}},"noreturn_vas":[],"symbols":{"4294968576":"sub_100000500","4294969064":"sub_1000006e8"}},"capabilities":[],"code_signature":{"code_directory":{"cdhash":"149ab30cfc9bd50557b2f655dcb4a408f7f2f22fda0e29fcea9a1dd91b0ae464","flag_names":[],"flags":0,"hash_type":2,"identifier":"com.apple.leave","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","frameworkhash":"b97e2cdeefa15f4389f6b3af8effe69a9a08ff67358c734e7ad450bacde906ed","imphash":"60088da693e786a29a778c574fd710bc9dc9703f577f1a03556c39b4ab7d10f9","sha256_text":"2bb3df64ea6f5ee866e7a151e00a2ce37535f744a5b66a1665e6be1b7d7e2537","symbolhash":"60088da693e786a29a778c574fd710bc9dc9703f577f1a03556c39b4ab7d10f9"},"sets":{"apis_called":["__stderrp","__stdinp","exit","fgets","fork","fwrite","localtime","printf","setlocale","sleep","strftime","sub_1000006e8","time"],"bundle_ids":["com.apple.leave"],"cpp_classes":[],"entitlements":[],"frameworks":["libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":[],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":[]},"vector":{"bundle_ids":1,"cap_analytics":0,"cap_hardware":0,"cap_ipc":0,"cap_keychain":0,"cap_location":0,"cap_network":0,"cap_security":0,"cap_storage":0,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":0,"file_paths":0,"frameworks_private":0,"frameworks_total":1,"iokit_constants":0,"library_functions":0,"nlist_functions":2,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":7,"size_log2":16.628445,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":0,"text_ratio":0.007896399,"url_endpoints":4,"xpc_provides":0}},"dwarf_metadata":null,"entitlements":{"entries":{},"raw_plist":null},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-07T05:21:16Z","available_arches":["x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"149ab30cfc9bd50557b2f655dcb4a408f7f2f22fda0e29fcea9a1dd91b0ae464","file_modified":"2026-04-06T11:53:57Z","file_size":101312,"is_arm64e":true,"min_os":"26.1.0","name":"leave","platform":"macOS","sdk":"26.1.0","sha256":"e96927f7a77820c427f71cbe6c482d5888a0a7dc7809771b0b477001fd23c7f2","sha256_slice":"3ba05b6de3650e05fb928c42487bd81c65fe77b71c6645e5adf899c4da7ec857","source_version":"45.0.0.0.0","team_id":null,"uuid":"3E28369D-3622-3A7D-804A-46540B967D2A"},"frameworks":[{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":2,"imports":[{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"exit"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fgets"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fork"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fwrite"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"localtime"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"printf"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"setlocale"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"sleep"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"strftime"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"time"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"warn"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"write"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stderrp"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stdinp"}],"interesting_strings":{"bundle_ids":["com.apple.leave"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":2,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"}],"has_network_entitlement":false,"network_frameworks":[]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":1280,"protection":"r-x","segment":"__TEXT","size":800},{"name":"__auth_stubs","offset":2080,"protection":"r-x","segment":"__TEXT","size":192},{"name":"__const","offset":2272,"protection":"r-x","segment":"__TEXT","size":66},{"name":"__cstring","offset":2338,"protection":"r-x","segment":"__TEXT","size":219},{"name":"__unwind_info","offset":2560,"protection":"r-x","segment":"__TEXT","size":96},{"name":"__auth_got","offset":16384,"protection":"rw-","segment":"__DATA_CONST","size":96},{"name":"__got","offset":16480,"protection":"rw-","segment":"__DATA_CONST","size":16}],"summary":"A signed Apple executable that establishes connections to six network endpoints, suggesting a system utility or daemon with cloud communication capabilities. Contains minimal code surface (2 functions) and no private framework dependencies, indicating a lightweight tool with focused functionality. Includes one bundle identifier and four embedded URLs, likely directing traffic to Apple services or infrastructure. The sparse implementation and network-centric design suggest this binary handles a specific system task involving remote communication.","swift_metadata":null,"title":"Unknown system executable — communicates with Apple network endpoints","total_strings":133,"xpc_services":[]}