Zero the Hero — Documentation

Quick Start

# Analyze a binary
0tH --load /bin/ls --tree

# Inspect code signature
0tH --load /Applications/Safari.app/Contents/MacOS/Safari --codesign info

# Launch interactive mode
0tH --REPL

Installation

1. Download 0tH.dmg from zero-the-hero.run
2. Verify the download:

shasum -a 256 0tH.dmg
spctl --assess --type open --verbose=4 0tH.dmg
    

3. Open DMG and copy 0tH to your PATH:

cp /Volumes/0tH/0tH /usr/local/bin/
    

4. Verify installation:

0tH --version
    

---

CLI Reference

Synopsis

0tH [OPTIONS]

Options

Flag	Long Form	Description
-l	--load <FILE>	Load a Mach-O binary
-t	--tree [DEPTH]	Show structure tree
-s	--slice <INDEX>	Select slice of a FAT binary
-c	--cmd <INDEX>	View specific load command
-e	--export <FILE>	Export to JSON
-v		Increase verbosity
	--verbose <LEVEL>	Set verbosity 0–3
-R	--REPL	Launch REPL
	--codesign <CMD>	Run code signature commands
-h	--help	Show help
-V	--version	Print version

Codesign Subcommands

--codesign show
--codesign verify
--codesign hashes
--codesign entitlements
--codesign info
--codesign requirements
--codesign certificates
--codesign notarization

---

REPL Reference

0tH --REPL

Commands

Command	Description
load <path>	Load Mach-O binary
tree	Show hierarchical structure
cmdview <index>	View load command
select slice <n>	Select slice
codesign <cmd>	Run codesign subcommand
export <file>	Export to JSON
help	Help
quit / exit	Exit REPL

Example Session

0tH> load /Applications/Safari.app/Contents/MacOS/Safari
[+] Loaded: Safari

0tH> select slice 1
[+] Selected slice 1 (ARM64)

0tH> tree
[...]

0tH> codesign info
[...]

0tH> quit

---

Codesign Commands

codesign show

0tH --load /bin/ls --codesign show

Shows SuperBlob contents.

codesign verify

0tH --load /bin/ls --codesign verify

codesign hashes

0tH --load /bin/ls --codesign hashes

codesign entitlements

0tH --load /Applications/Safari.app/Contents/MacOS/Safari --codesign entitlements

codesign info

0tH --load /bin/ls --codesign info

codesign requirements

0tH --load /Applications/Safari.app/Contents/MacOS/Safari --codesign requirements

codesign certificates

0tH --load /Applications/Safari.app/Contents/MacOS/Safari --codesign certificates

codesign notarization

0tH --load ./0tH --codesign notarization

---

Practical Examples

# Analyze system binary
0tH --load /bin/ls --tree --codesign info

# Analyze FAT binary
0tH --load /Applications/Safari.app/... --tree

# JSON export
0tH --load /bin/ls --export analysis.json

---

Output Formats

Tree View

binary_name
├── Slice [0] - x86_64
│   ├── [0] LC_SEGMENT_64 (__PAGEZERO)
│   └── [1] LC_SEGMENT_64 (__TEXT)

JSON Export

{
  "filename": "binary_name",
  "file_type": "FAT",
  "slices": [...]
}

---

Troubleshooting

"File not found"

Point to the actual Mach-O binary inside .app bundles.

"No code signature found"

This is normal for development binaries.

"Unimplemented LC"

Command recognized but not parsed yet.

---

License

0tH is proprietary, free to use.
See LICENSE.md for details.