Skip to content

Instantly share code, notes, and snippets.

@neverpanic
neverpanic / gist:8e5dc3a75a3cff9d986954491b9d65e7
Last active October 28, 2026 10:58
Find traces of emSign Root TLS CA - G3, emSign Root CS CA - G3, AAA Certificate Services, emSign ECC Root CA - G3 in binary or base64
rg --json -uu --multiline --text \
'(?-u)(\x04\x5f\x0f\xdc\x3f\xab\x57\x16\xc4\xbe\x83\xf5\xb3\x06\x1f\xa0\x90\xe2\xef\xa0\x01\x5e\x86\x37\xdb\x3e\x3f\x04\x31\xf4\x19\x78\x84\x2f\xb4\x89\x4f\x10\x3a\x4f\x26\x58\xef\xd1\xc1\x74\x32\xd7\x40\xc2\x4b\x14\xfc\xbd\x22\x09\x0a\x51\xca\xa7\xe0\x28\xe2\xa2\x4a\x75\x87\x95\xd1\x2c\x19\xec\xb3\x10\xce\x2c\x8b\x7f\x12\x14\x39\x8e\x86\xae\x36\xbf\xb1\x01\x70\x2c\xa6\x1f\xf0\x47\x43\x5c\x0c)|(\x04\x4a\x5f\x64\x33\x90\xf4\x54\x0f\xce\x83\xbe\x9d\xcf\x95\xf3\xc3\x58\x67\x19\x0e\x1f\x49\x1f\x7d\xf7\x7f\xea\x06\x49\x2f\x23\x8f\x29\x5d\x05\x4a\x39\xdc\x87\x0a\x00\x19\x4e\x18\x16\x7a\x34\x3c\x3a\x91\x51\x89\x32\x12\x8e\x96\x9b\x9f\x8b\x5f\x44\x53\x98\xbb\x38\x40\xa5\x1f\xd7\xc4\x66\xe4\x83\xd5\xfe\xd9\xc1\x2d\x6f\x28\x21\x17\xd0\x9d\xa0\x5f\x75\x5b\x6d\x95\xfd\x1d\x84\x55\xee\x31)|(\x00\xbe\x40\x9d\xf4\x6e\xe1\xea\x76\x87\x1c\x4d\x45\x44\x8e\xbe\x46\xc8\x83\x06\x9d\xc1\x2a\xfe\x18\x1f\x8e\xe4\x02\xfa\xf3\xab\x5d\x50\x8a\x16\x31\x0b\x9a\x06\xd0\xc5\x70\x22\xcd\x49\x2d\x54
:) clemens@cBookMax:~$ otool -L /usr/sbin/sshd
/usr/sbin/sshd:
/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (compatibility version 300.0.0, current version 2302.0.0)
/usr/lib/libbsm.0.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libcrypto.46.dylib (compatibility version 47.0.0, current version 47.2.0)
/usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.12)
/System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos (compatibility version 5.0.0, current version 6.0.0)
/System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libpam.2.dylib (compatibility version 3.0.0, current version 3.0.0)
/usr/lib/libEndpointSecuritySystem.dylib (compatibility version 1.0.0, current version 458.80.2, weak)
SELECT
r.correlation_id
, r.version_name
, r.version
, count(f.file_id) as count
, min(f.version)
, max(f.version)
FROM
reports r
LEFT JOIN