Machofile analyzer by IshaanXCoder · Pull Request #3268 · intelowlproject/IntelOwl

IshaanXCoder · 2026-02-03T11:04:32Z

Add MachoFile analyzer

Resolves issue: #2948

Description

Implemented a new file analyzer MachoFile to parse and extract information from Mach-O binaries

Used https://github.com/pstirparo/machofile library to extract the details. It fully supports both single-architecture binaries (ARM64, x86_64) and Universal (FAT) binaries.

Type of change

New feature (non-breaking change which adds functionality).

Checklist

Copilot

Pull request overview

This PR adds a new Mach-O file analyzer (MachoFile/MachoInfo) so IntelOwl can parse macOS/iOS Mach-O binaries, similar to how existing analyzers handle PE and ELF files. It wires the analyzer into the plugin system, playbooks, dependencies, and test suite (unit + integration) for the new Mach-O mimetype.

Changes:

Introduced MachoInfo file analyzer using the machofile library to extract headers, architectures, segments, dylibs, imports/exports, hashes, and code-signature data from Mach-O binaries.
Registered the new MachoFile analyzer via Django data migrations, added it to the FREE_TO_USE_ANALYZERS playbook, and added Mach-O support to the shared file-analyzer test base and integration tests.
Added the machofile dependency from its GitHub repository to project-requirements.txt.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`api_app/analyzers_manager/file_analyzers/macho_info.py`	Implements the `MachoInfo` `FileAnalyzer` with robust parsing of Mach-O binaries using `machofile`, including logging and report error handling.
`api_app/analyzers_manager/migrations/0175_analyzer_config_macho_info.py`	Adds the `MachoFile` analyzer configuration (module path, description, supported `application/x-mach-binary` mimetype, and settings) into the analyzers registry.
`api_app/playbooks_manager/migrations/0062_add_machofile_to_free_to_use.py`	Ensures the `MachoFile` analyzer is included in the `FREE_TO_USE_ANALYZERS` playbook via a Django migration.
`requirements/project-requirements.txt`	Introduces the `machofile` dependency via a Git URL so the analyzer can parse Mach-O binaries.
`tests/api_app/analyzers_manager/unit_tests/file_analyzers/base_test_class.py`	Extends the shared mapping of mimetype-to-sample to include `application/x-mach-binary` for unit tests.
`tests/api_app/analyzers_manager/unit_tests/file_analyzers/test_macho_info.py`	Adds unit tests for `MachoInfo`, mocking `machofile` to validate behavior over supported structures.
`tests/api_app/analyzers_manager/integration_tests/file_analyzers/test_macho_info.py`	Adds an integration test running `MachoFile` against a real Mach-O sample and asserting key report fields (header, architectures, segments, dylibs, hashes, exports, code_signature).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

api_app/analyzers_manager/file_analyzers/macho_info.py

tests/api_app/analyzers_manager/integration_tests/file_analyzers/test_macho_info.py

api_app/analyzers_manager/migrations/0175_analyzer_config_macho_info.py

requirements/project-requirements.txt

Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-03T12:47:43Z

api_app/analyzers_manager/migrations/0175_analyzer_config_macho_info.py

+    python_path = plugin.pop("model")
+    Model = apps.get_model(*python_path.split("."))
+    if not Model.objects.filter(name=plugin["name"]).exists():


plugin.pop("model") is called both in migrate and again in reverse_migrate, so after the forward migration has run once in a given process the second pop will raise a KeyError because the model key has already been removed from the shared plugin dict. To avoid this, avoid mutating plugin here (e.g. use python_path = plugin["model"]) or cache the model path in a separate module-level variable that both functions can read without popping.

tests/api_app/analyzers_manager/integration_tests/file_analyzers/test_macho_info.py

IshaanXCoder · 2026-02-03T13:31:19Z

@mlodic could you please review this PR? I've made multiple commits trying to fix these CICD Fails. ruff is passing all checks locally but fails here. I'll try to fix this in the meanwhile. Will make a clean PR later post your review fixes and cicd fixes.

Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/api_app/analyzers_manager/integration_tests/file_analyzers/test_macho_info.py

mlodic · 2026-02-03T13:53:01Z

pull from develop and re-install pre-commit then try again please

…-MachoFile

Copilot

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-04T05:20:25Z

api_app/analyzers_manager/migrations/0176_analyzer_config_macho_info.py

+        else:
+            no_mtm[field] = value
+    try:
+        o = Model.objects.get(**no_mtm)


Variable o is not used.

Suggested change

o = Model.objects.get(**no_mtm)

Model.objects.get(**no_mtm)

mlodic · 2026-02-05T13:54:36Z

api_app/analyzers_manager/file_analyzers/macho_info.py

+                        self.job_id, self.analyzer_name, self.md5, error_msg
+                    )
+                )
+                raise Exception(error_msg)


AnalyzerRunException must be raised here. Also, this should not be a warning, it is too noisy. It should only be added to the report in the errors list. see other analyzers as a reference

mlodic · 2026-02-05T13:56:33Z

api_app/analyzers_manager/file_analyzers/macho_info.py

+        else:
+            results["architectures"] = []
+
+        if hasattr(macho, "uuid"):


you are just converting an object into a dict. refactor all of this in a more convenient way. If the supported tool changes, we should change this too here...it is unfeasible...also this code is unreadable. please find a workaround

mlodic · 2026-02-05T13:56:46Z

api_app/analyzers_manager/file_analyzers/macho_info.py

+                results["hashes"] = macho.get_similarity_hashes(formatted=True)
+
+        except Exception as e:
+            warning_message = "job_id:{} analyzer:{} md5:{} filename:{} MachoFile parsing error: {}".format(


f-strings everywhere

IshaanXCoder · 2026-02-06T09:32:27Z

api_app/analyzers_manager/file_analyzers/macho_info.py

+        try:
+            macho = self._parse_macho()
+            if macho is None:
+                raise Exception("Failed to create MachO object")


this check can be removed as _parse_macho() raises only on failure. works?

if macho is None: raise Exception("Failed to create MachO object")

Copilot

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/api_app/analyzers_manager/unit_tests/file_analyzers/base_test_class.py

Copilot · 2026-02-06T15:16:08Z

tests/api_app/analyzers_manager/integration_tests/file_analyzers/test_macho_info.py

+            "80cc133a33786ceeacbd3acacd025dfc",
+            # not hardcoded, MD5 of tested data
+            "application/x-mach-binary",
+            "MachoFile",


The analyzer config name in the migration is "MachoInfo" but the integration test is trying to retrieve an AnalyzerConfig with name "MachoFile". This mismatch will cause the test to fail with a DoesNotExist error. Please update line 17 to use "MachoInfo" instead of "MachoFile" to match the analyzer configuration name.

Suggested change

"MachoFile",

"MachoInfo",

Copilot · 2026-02-06T15:16:08Z

api_app/analyzers_manager/file_analyzers/macho_info.py

+        except AnalyzerRunException:
+            raise
+        except Exception as e:
+            error_msg = f"job_id:{self.job_id} analyzer:{self.analyzer_name} md5:{self.md5} filename:{self.filename} MachoFile parsing error: {e}"


The error message refers to "MachoFile" but the analyzer class is named "MachoInfo". For consistency, consider changing "MachoFile parsing error" to "MachoInfo parsing error" or use a generic term like "Mach-O parsing error".

Suggested change

error_msg = f"job_id:{self.job_id} analyzer:{self.analyzer_name} md5:{self.md5} filename:{self.filename} MachoFile parsing error: {e}"

error_msg = f"job_id:{self.job_id} analyzer:{self.analyzer_name} md5:{self.md5} filename:{self.filename} Mach-O parsing error: {e}"

Copilot · 2026-02-06T15:16:08Z

api_app/playbooks_manager/migrations/0063_add_machofile_to_free_to_use.py

+    pc.analyzers.add(AnalyzerConfig.objects.get(name="MachoFile").id)
+    pc.full_clean()
+    pc.save()
+
+
+def reverse_migrate(apps, schema_editor):
+    playbook_config = apps.get_model("playbooks_manager", "PlaybookConfig")
+    AnalyzerConfig = apps.get_model("analyzers_manager", "AnalyzerConfig")
+    pc = playbook_config.objects.get(name="FREE_TO_USE_ANALYZERS")
+    pc.analyzers.remove(AnalyzerConfig.objects.get(name="MachoFile").id)


The playbook migration is trying to retrieve an AnalyzerConfig with name "MachoFile", but the analyzer config migration (0176_analyzer_config_macho_info.py) creates it with name "MachoInfo". This mismatch will cause the migration to fail. Please update "MachoFile" to "MachoInfo" on both lines 12 and 21 to match the analyzer configuration name.

Copilot

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

api_app/analyzers_manager/file_analyzers/macho_info.py

tests/api_app/analyzers_manager/integration_tests/file_analyzers/test_macho_info.py

api_app/analyzers_manager/migrations/0176_analyzer_config_macho_info.py

Copilot · 2026-02-07T06:50:42Z

api_app/analyzers_manager/migrations/0176_analyzer_config_macho_info.py

+    "supported_filetypes": [
+        "application/x-mach-binary",
+        "application/mac-binary",
+        "application/x-binary",
+        "application/x-executable",
+    ],


The supported_filetypes list includes very broad MIME types like "application/x-executable" and "application/x-binary", which are commonly used for non–Mach-O binaries (e.g., ELF). This will cause MachoInfo to run (and likely fail) on unrelated files; restrict supported_filetypes to Mach-O-specific MIME types (and/or add explicit signature checks + early exit) to avoid noisy failures and unnecessary work.

api_app/analyzers_manager/file_analyzers/macho_info.py

Copilot

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-07T09:45:51Z

api_app/analyzers_manager/migrations/0176_analyzer_config_macho_info.py

+        "application/x-binary",
+        "application/x-executable",


supported_filetypes includes very generic executable mimetypes (e.g. application/x-executable, application/x-binary). Those often match ELF/Linux binaries too, which conflicts with the “mac samples only” intent and will cause the analyzer to be offered/run on non‑Mach‑O files (likely failing at runtime). Consider restricting this list to Mach-O specific mimetypes only, or add an early magic-byte check in run() that exits with a clear "not a Mach-O" error before attempting to parse.

Suggested change

"application/x-binary",

"application/x-executable",

IshaanXCoder · 2026-02-07T10:16:24Z

@mlodic pls review this, fixed yours and copilot recommendations

api_app/playbooks_manager/migrations/0063_add_machofile_to_free_to_use.py

api_app/analyzers_manager/file_analyzers/macho_info.py

tests/api_app/analyzers_manager/unit_tests/file_analyzers/base_test_class.py

IshaanXCoder · 2026-02-07T19:13:11Z

I checked out the cause behind failing backend tests,

The Mach-O sample added in this PR caused BlintAnalyzer tests to run on application/x-mach-binary revealing a recursion limit bug during metadata export
I've patched blint_scan.py to skip export_metadata, which resolves the crash

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-07T19:23:07Z

api_app/analyzers_manager/migrations/0176_analyzer_config_macho_info.py

+    "supported_filetypes": [
+        "application/x-mach-binary",
+        "application/mac-binary",
+        "application/x-binary",
+        "application/x-executable",
+    ],


supported_filetypes includes generic MIME types like application/x-binary and application/x-executable. Since this analyzer is Mach-O specific (macOS/iOS), this configuration will make MachoInfo run on many non–Mach-O samples (e.g., ELF binaries commonly labeled application/x-executable), producing avoidable failures/noise in default playbooks. Consider restricting supported_filetypes to Mach-O specific MIME types (e.g., application/x-mach-binary and/or application/mac-binary) and removing the generic ones, or moving generic types to a separate opt-in config.

tests/api_app/analyzers_manager/integration_tests/file_analyzers/test_macho_info.py

Copilot · 2026-02-07T19:23:07Z

api_app/analyzers_manager/file_analyzers/macho_info.py

+            macho = machofile.MachO(self.filepath)
+            try:
+                macho.parse()
+            except AttributeError:


'except' clause does nothing but pass and there is no explanatory comment.

Copilot · 2026-02-07T19:23:08Z

api_app/analyzers_manager/file_analyzers/macho_info.py

+                macho = machofile.UniversalMachO(self.filepath)
+                try:
+                    macho.parse()
+                except AttributeError:


'except' clause does nothing but pass and there is no explanatory comment.

IshaanXCoder · 2026-02-08T17:54:41Z

@mlodic i made the changes, ptal whenever free

* feature/analyzer : machofile analyzer * fix/added unit tests, freeToUse, test_files.zip * fix/cicd and copilot recommendations * fix: precommit using ruff * fix: precommit using ruff(again) * fix: precommit using ruff(again) * fix/cicd * fix/cicd * fix/cicd * fix/migration-conflicts * fix/migration-conflicts * fix/cicd migrations * fix/cicd migrations due to zip * fix/add macho_sample * fix/copilot and maintainer recommendations * fix/cicd * fix/zip-pass * fix/cicd * minor fixes : copilot recommendations * fix/maintainer-feedback * fix/cicd failure due to BlintAnalyzer

IshaanXCoder added 2 commits February 3, 2026 15:56

feature/analyzer : machofile analyzer

6f01a28

fix/added unit tests, freeToUse, test_files.zip

a185d08

Copilot AI review requested due to automatic review settings February 3, 2026 11:04

Copilot started reviewing on behalf of IshaanXCoder February 3, 2026 11:04 View session

Copilot AI reviewed Feb 3, 2026

View reviewed changes

IshaanXCoder added 2 commits February 3, 2026 18:04

fix/cicd and copilot recommendations

40a9ebc

fix: precommit using ruff

b4cd43b

Copilot AI review requested due to automatic review settings February 3, 2026 12:40

Copilot started reviewing on behalf of IshaanXCoder February 3, 2026 12:40 View session

fix: precommit using ruff(again)

3e6bc3d

Copilot AI reviewed Feb 3, 2026

View reviewed changes

IshaanXCoder added 2 commits February 3, 2026 18:35

fix: precommit using ruff(again)

a66781c

fix/cicd

946e43a

Copilot AI review requested due to automatic review settings February 3, 2026 13:28

Copilot started reviewing on behalf of IshaanXCoder February 3, 2026 13:29 View session

Copilot AI reviewed Feb 3, 2026

View reviewed changes

tests/api_app/analyzers_manager/integration_tests/file_analyzers/test_macho_info.py Show resolved Hide resolved

IshaanXCoder added 3 commits February 3, 2026 19:44

Merge remote-tracking branch 'upstream/develop' into feature/analyzer…

933989b

…-MachoFile

fix/cicd

3da2d8e

fix/cicd

8c7f00f

Copilot AI review requested due to automatic review settings February 3, 2026 15:52

Copilot started reviewing on behalf of IshaanXCoder February 3, 2026 15:53 View session

Copilot AI reviewed Feb 3, 2026

View reviewed changes

IshaanXCoder added 2 commits February 3, 2026 22:11

fix/migration-conflicts

520cf62

fix/migration-conflicts

94a3c65

Copilot AI review requested due to automatic review settings February 4, 2026 05:14

Copilot started reviewing on behalf of IshaanXCoder February 4, 2026 05:14 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

fix/cicd migrations

395a2a3

mlodic reviewed Feb 5, 2026

View reviewed changes

IshaanXCoder commented Feb 6, 2026

View reviewed changes

fix/copilot and maintainer recommendations

e1b3822

Copilot AI review requested due to automatic review settings February 6, 2026 15:06

Copilot started reviewing on behalf of IshaanXCoder February 6, 2026 15:07 View session

Copilot AI reviewed Feb 6, 2026

View reviewed changes

IshaanXCoder added 2 commits February 7, 2026 12:00

fix/cicd

11d1bab

fix/zip-pass

3907083

Copilot AI review requested due to automatic review settings February 7, 2026 06:44

Copilot started reviewing on behalf of IshaanXCoder February 7, 2026 06:45 View session

Copilot AI reviewed Feb 7, 2026

View reviewed changes

IshaanXCoder added 2 commits February 7, 2026 13:00

fix/cicd

c6526c5

minor fixes : copilot recommendations

5a9b7db

Copilot AI review requested due to automatic review settings February 7, 2026 09:39

Copilot started reviewing on behalf of IshaanXCoder February 7, 2026 09:40 View session

Copilot AI reviewed Feb 7, 2026

View reviewed changes

mlodic requested changes Feb 7, 2026

View reviewed changes

fix/maintainer-feedback

6185f41

fix/cicd failure due to BlintAnalyzer

f65ca9f

Copilot AI review requested due to automatic review settings February 7, 2026 19:14

Copilot started reviewing on behalf of IshaanXCoder February 7, 2026 19:14 View session

Copilot AI reviewed Feb 7, 2026

View reviewed changes

mlodic approved these changes Feb 9, 2026

View reviewed changes

mlodic merged commit e8dcbff into intelowlproject:develop Feb 9, 2026
14 of 15 checks passed

	error_msg = f"job_id:{self.job_id} analyzer:{self.analyzer_name} md5:{self.md5} filename:{self.filename} MachoFile parsing error: {e}"
	error_msg = f"job_id:{self.job_id} analyzer:{self.analyzer_name} md5:{self.md5} filename:{self.filename} Mach-O parsing error: {e}"

Uh oh!

Conversation

IshaanXCoder commented Feb 3, 2026

Add MachoFile analyzer

Description

Type of change

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

IshaanXCoder commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

mlodic commented Feb 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

mlodic Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

mlodic Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

mlodic Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

IshaanXCoder Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

IshaanXCoder commented Feb 3, 2026 •

edited

Loading