ckksctl
executablemacOS200.0 KBx86_64, arm64
Code signing verification tool — validates and verifies macOS application signatures
Validates code signatures on macOS binaries and bundles using the Security framework and Keychain to access certificates. Verifies cryptographic signatures against trusted roots, checks for code signing entitlements, and confirms bundle integrity. Makes network connections to reach certificate authorities and revocation endpoints for signature validation. Collects telemetry during verification operations and references multiple bundle identifiers and file paths during analysis.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 200.0 KB
- UUID
- 5CA680BA-E608-340D-91D2-689C9E4241CB
- Analyzed
- 2026-04-07T05:21:13Z
- CDHash
- 5e453b76df52260470cc9c41b2e54aee30184d3549849e64157995a4eb50f123
Capabilities
SecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityEntitlements1
Interesting Strings
File Paths(3)
telemetry(6)
Network Surface
Networking Frameworks
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
6
File Paths
3
Bundle IDs
3
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 52 functions identified
Functions(52)
0x100000ce8sub_100000ce8
0x100000e18sub_100000e18
0x100000e90sub_100000e90
0x100001460sub_100001460
0x100001518-[CKKSControlCLI .cxx_destruct]
0x100001524-[CKKSControlCLI setControl:]
0x10000152c-[CKKSControlCLI control]
0x100001538-[CKKSControlCLI toggleHavoc]
0x100001688sub_100001688
0x10000173csub_10000173c
0x10000177csub_10000177c
0x1000017c4-[CKKSControlCLI deleteSEZone:]
0x100001984sub_100001984
0x100001a14-[CKKSControlCLI modifySEZone:tlkShareJsonStrings:deletetlkShareJsonStrings:]
0x100001e84sub_100001e84
0x100001f14-[CKKSControlCLI fetchSEView:json:]
0x1000020e4sub_1000020e4
0x1000022e0sub_1000022e0
0x1000023d4sub_1000023d4
0x10000255csub_10000255c
Imports72 symbols from 5 dylibs
Exports1
_mh_execute_header0x0