USING THE MACH-O MODULE IN YARA-X

Summary from the TLDR InfoSec newsletter

This post introduces some of the improvements that the new Yara-X Mach-O module makes over the original. The new Mach-O module parses many of the core structures that are used in Mach-O binaries including the symbol table, imports, exports, entitlements, remote paths, and dylibs. The module also allows for calculating binary similarities by hashing the above structures.