{"arch":"arm64","build_provenance":null,"call_graph":{"calls":{"4294968784":[{"is_tail_call":false,"symbol":"fopen","target_va":4294969928},{"is_tail_call":false,"symbol":"au_fetch_tok","target_va":4294969784},{"is_tail_call":false,"symbol":"sub_1000007dc","target_va":4294969308},{"is_tail_call":false,"symbol":"fclose","target_va":4294969880},{"is_tail_call":false,"symbol":"sub_1000007dc","target_va":4294969308},{"is_tail_call":false,"symbol":"au_print_xml_header","target_va":4294969832},{"is_tail_call":false,"symbol":"free","target_va":4294969944},{"is_tail_call":false,"symbol":"__stdoutp","target_va":4294969768}],"4294969308":[{"is_tail_call":false,"symbol":"exit","target_va":4294969864},{"is_tail_call":false,"symbol":"optarg","target_va":4294969992},{"is_tail_call":false,"symbol":"au_print_flags_tok","target_va":4294969800},{"is_tail_call":false,"symbol":"__stderrp","target_va":4294969736},{"is_tail_call":false,"symbol":"__stdinp","target_va":4294969752},{"is_tail_call":false,"symbol":"fwrite","target_va":4294969960},{"is_tail_call":false,"symbol":"getopt","target_va":4294969976},{"is_tail_call":false,"symbol":"fflush","target_va":4294969896},{"is_tail_call":false,"symbol":"getopt","target_va":4294969976},{"is_tail_call":false,"symbol":"au_read_rec","target_va":4294969848},{"is_tail_call":false,"symbol":"au_print_flags_tok","target_va":4294969800}]},"data_xrefs":{"by_data":{"4294967296":[4294968784],"4294967304":[4294968784],"4294970008":[4294968784],"4294970017":[4294968784],"4294970075":[4294969308],"4294983680":[4294968784,4294969308],"4294983824":[4294968784],"4294983832":[4294968784,4294969308],"4294983840":[4294968784],"4294983848":[4294968784],"4295000064":[4294969308],"4295000076":[4294968784,4294969308]},"by_function":{"4294968784":[{"data_va":4294983840,"insn_va":4294968828,"kind":"Global","value":null},{"data_va":4294970008,"insn_va":4294968856,"kind":"CString","value":"d:lnprsx"},{"data_va":4295000076,"insn_va":4294968908,"kind":"Global","value":null},{"data_va":4295000076,"insn_va":4294968952,"kind":"Global","value":null},{"data_va":4295000076,"insn_va":4294968984,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969008,"kind":"Global","value":null},{"data_va":4295000076,"insn_va":4294969036,"kind":"Global","value":null},{"data_va":4294983832,"insn_va":4294969076,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969080,"kind":"Global","value":null},{"data_va":4294983848,"insn_va":4294969092,"kind":"Global","value":null},{"data_va":4294983824,"insn_va":4294969112,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969116,"kind":"Global","value":null},{"data_va":4294970017,"insn_va":4294969148,"kind":"CString","value":null},{"data_va":4294967296,"insn_va":4294969152,"kind":"Global","value":null},{"data_va":4294967304,"insn_va":4294969184,"kind":"Global","value":null},{"data_va":4294967296,"insn_va":4294969200,"kind":"Global","value":null},{"data_va":4294983832,"insn_va":4294969224,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969228,"kind":"Global","value":null}],"4294969308":[{"data_va":4294983832,"insn_va":4294969496,"kind":"Global","value":null},{"data_va":4294970075,"insn_va":4294969516,"kind":"CString","value":"%s"},{"data_va":4294983680,"insn_va":4294969560,"kind":"Global","value":null},{"data_va":4295000064,"insn_va":4294969564,"kind":"Global","value":null},{"data_va":4295000076,"insn_va":4294969568,"kind":"Global","value":null},{"data_va":4295000064,"insn_va":4294969604,"kind":"Global","value":null},{"data_va":4294983680,"insn_va":4294969672,"kind":"Global","value":null}]}},"noreturn_vas":[],"symbols":{"4294968784":"sub_1000005d0","4294969308":"sub_1000007dc"}},"capabilities":[],"code_signature":{"code_directory":{"cdhash":"37239bddf141465c8d81cb8185f37a115ba17218cadfc07585cb7ea732677eca","flag_names":[],"flags":0,"hash_type":2,"identifier":"com.apple.praudit","platform":26,"team_id":null},"signing_status":"AppleSigned"},"cpp_hierarchy":null,"data_in_code":[],"dna":{"hashes":{"classhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","cpp_classhash":null,"entitlementhash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","frameworkhash":"821b9f412c19e16a935f95418b1f75e62d49f7a1fd21178778e954e5a9e0edb6","imphash":"d0a4afb7bfbe6418dd66796b2db8c582e9f9e7ba6ad0288cbdd03facec8329e2","sha256_text":"1d16a1a27edfa2092dbe84203f36f01c14acd46beda633fb56e6e520b3cc9112","symbolhash":"d0a4afb7bfbe6418dd66796b2db8c582e9f9e7ba6ad0288cbdd03facec8329e2"},"sets":{"apis_called":["__stderrp","__stdinp","__stdoutp","au_fetch_tok","au_print_flags_tok","au_print_xml_header","au_read_rec","exit","fclose","fflush","fopen","free","fwrite","getopt","optarg","sub_1000007dc"],"bundle_ids":["com.apple.praudit"],"cpp_classes":[],"entitlements":[],"frameworks":["libbsm.0.dylib","libSystem.B.dylib"],"iokit_constants":[],"objc_classes":[],"private_frameworks":[],"protocols":[],"signing_status":"Apple Signed","static_libs":[],"swift_protocol_names":[],"swift_type_names":[],"xpc_services":[]},"vector":{"bundle_ids":1,"cap_analytics":0,"cap_hardware":0,"cap_ipc":0,"cap_keychain":0,"cap_location":0,"cap_network":0,"cap_security":0,"cap_storage":0,"cap_system":0,"cpp_classes":0,"cpp_vtable_entries":0,"entitlements_total":0,"file_paths":0,"frameworks_private":0,"frameworks_total":2,"iokit_constants":0,"library_functions":0,"nlist_functions":2,"objc_classes":0,"objc_ivars":0,"objc_methods":0,"objc_protocols":0,"section_count":8,"size_log2":16.851944,"static_lib_count":0,"swift_conformances":0,"swift_protocols":0,"swift_types":0,"telemetry_strings":0,"text_ratio":0.0080481535,"url_endpoints":4,"xpc_provides":0}},"dwarf_metadata":null,"entitlements":{"entries":{},"raw_plist":null},"exports":[{"address":0,"is_reexport":false,"is_thread_local":false,"is_weak":false,"name":"_mh_execute_header"}],"fileset_entries":[],"fingerprint":{"analyzed_at":"2026-04-07T05:21:16Z","available_arches":["x86_64","arm64"],"binary_type":"executable","bundle_id":null,"cdhash":"37239bddf141465c8d81cb8185f37a115ba17218cadfc07585cb7ea732677eca","file_modified":"2026-04-06T12:12:33Z","file_size":118288,"is_arm64e":true,"min_os":"26.1.0","name":"praudit","platform":"macOS","sdk":"26.1.0","sha256":"ea379c35a506f7df930e6ce4ff925c371408984a81b0d123cd7a4253ef910382","sha256_slice":"38e73403447e18bbff4442305d35ad22a179c2c36b6bdf8807632adfc588f5e1","source_version":"90.0.0.0.0","team_id":null,"uuid":"87E12770-A187-3D00-87D9-7A26B48A920C"},"frameworks":[{"is_private":false,"is_weak":false,"name":"/usr/lib/libbsm.0.dylib"},{"is_private":false,"is_weak":false,"name":"/usr/lib/libSystem.B.dylib"}],"function_starts_count":2,"imports":[{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"au_fetch_tok"},{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"au_print_flags_tok"},{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"au_print_xml_footer"},{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"au_print_xml_header"},{"address":0,"dylib":"/usr/lib/libbsm.0.dylib","is_lazy":false,"is_weak":false,"name":"au_read_rec"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"exit"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fclose"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fflush"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fgetc"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fopen"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"free"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"fwrite"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"getopt"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"perror"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"printf"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"putchar"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"ungetc"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stderrp"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stdinp"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"__stdoutp"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"optarg"},{"address":0,"dylib":"/usr/lib/libSystem.B.dylib","is_lazy":false,"is_weak":false,"name":"optind"}],"interesting_strings":{"bundle_ids":["com.apple.praudit"],"urls_and_endpoints":["$http://crl.apple.com/codesigning.crl0","%http://www.apple.com/appleca/root.crl0","<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">","https://www.apple.com/appleca/0"]},"iokit_surface":null,"library_matches":[],"library_profile":{"libraries":{},"library_ratio":0.0,"total_functions":2,"total_identified":0},"network_surface":{"api_usage":{"callers":[],"classes":[],"methods":[]},"endpoints":[{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/appleca/root.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"www.apple.com"},{"is_dynamic":false,"kind":"Url","value":"http://crl.apple.com/codesigning.crl0"},{"is_dynamic":false,"kind":"Hostname","value":"crl.apple.com"},{"is_dynamic":false,"kind":"Url","value":"https://www.apple.com/appleca/0"},{"is_dynamic":false,"kind":"Url","value":"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">"}],"has_network_entitlement":false,"network_frameworks":[]},"objc_classes":{},"objc_metadata":{"classes":{}},"sections":[{"name":"__text","offset":1488,"protection":"r-x","segment":"__TEXT","size":952},{"name":"__auth_stubs","offset":2440,"protection":"r-x","segment":"__TEXT","size":272},{"name":"__cstring","offset":2712,"protection":"r-x","segment":"__TEXT","size":70},{"name":"__unwind_info","offset":2784,"protection":"r-x","segment":"__TEXT","size":88},{"name":"__auth_got","offset":16384,"protection":"rw-","segment":"__DATA_CONST","size":136},{"name":"__got","offset":16520,"protection":"rw-","segment":"__DATA_CONST","size":40},{"name":"__data","offset":32768,"protection":"rw-","segment":"__DATA","size":8},{"name":"__bss","offset":0,"protection":"rw-","segment":"__DATA","size":9}],"summary":"This Apple-signed executable contains minimal code footprint with just 2 functions and communicates with 6 network endpoints. It references 4 URLs or endpoints and one bundle identifier, indicating it either orchestrates network requests or reports data to external services. The lack of standard macOS frameworks and small function count suggest it performs a focused utility task rather than general-purpose system functionality. Without visibility into the specific function implementations and network destinations, the exact purpose cannot be determined from metadata alone.","swift_metadata":null,"title":"System utility — performs binary-specific task with network communication","total_strings":146,"xpc_services":[]}