Mach-O Header Fields
editMach-O Header Fields
editThese fields contain Mac OS Mach Object file format (Mach-O) metadata.
These fields are in beta and are subject to change.
Mach-O Header Field Details
editField | Description | Level |
---|---|---|
A hash of the Go language imports in a Mach-O file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). type: keyword example: |
extended |
|
List of imported Go language element names and types. type: flattened |
extended |
|
Shannon entropy calculation from the list of Go imports. type: long |
extended |
|
Variance for Shannon entropy calculation from the list of Go imports. type: long |
extended |
|
Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. type: boolean |
extended |
|
A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for symhash. type: keyword example: |
extended |
|
List of imported element names and types. type: flattened Note: this field should contain an array of values. |
extended |
|
Shannon entropy calculation from the list of imported element names and types. type: long |
extended |
|
Variance for Shannon entropy calculation from the list of imported element names and types. type: long |
extended |
|
An array containing an object for each section of the Mach-O file. The keys that should be present in these objects are defined by sub-fields underneath type: nested Note: this field should contain an array of values. |
extended |
|
Shannon entropy calculation from the section. type: long |
extended |
|
Mach-O Section List name. type: keyword |
extended |
|
Mach-O Section List physical size. type: long |
extended |
|
Variance for Shannon entropy calculation from the section. type: long |
extended |
|
Mach-O Section List virtual size. This is always the same as type: long |
extended |
|
A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a Mach-O implementation of the Windows PE imphash type: keyword example: |
extended |
Field Reuse
editThe macho
fields are expected to be nested at:
-
file.macho
-
process.macho
Note also that the macho
fields are not expected to be used directly at the root of the events.