LDID(1)

💅 LDID(1) — Link Identity Editor

okay so bestie, welcome to the ldid page 💖 this one's from the General Commands Manual, and honestly it's a whole personality. Grab a snack 🍓, we're doing signatures.

---

✨ SYNOPSIS ✨

ldid [-Acputype:subtype] [-a]
     [-C[adhoc | enforcement | expires | hard | host | kill | library-validation | restrict | runtime]]
     [-D] [-d] [-Enum:file] [-e] [-H[sha1 | sha256]] [-h] [-Iname]
     [-Kkey.p12 [-Upassword]] [-M] [-P[num]] [-Qrequirements] [-q]
     [-r | -Sfile.xml | -s] [-u] [-w] [-arch arch_type] file ...

like, that's the whole vibe chart, and we're about to go through every single one 🫶

---

🌸 DESCRIPTION 🌸

So what does ldid actually do? It adds SHA1 and SHA256 hashes to a Mach-O file so that they can be run on a system that has validation, but not signature verification. Basically it's giving "let me in" energy to a system that checks vibes but not full IDs 😌💅

🎀 the options, one by one, no skips

• -Acputype:subtype — when you use it with -a, -D, -e, -h, -q, or -u, it only acts on the slice specified by cputype and subtype. Both cputype and subtype should be integers, no cap. 🔢
• -a — prints the CPU types and subtypes in hexadecimal. cute little hex dump of the architecture situation ✨
• -arch arch_type — literally the same as -A, except the name of the architecture is used instead. The list of currently known arch_types can be found in arch(3). 🗂️ This is a Procursus extension.
• -C[adhoc | enforcement | expires | hard | host | kill | library-validation | restrict | runtime | linker-signed] — specify the option flags to embed in the code signature. See codesign(1) for details about these options, because bestie I am not about to make up what they do 🫶
• -D — reset the cryptid. just ✨ wiping it ✨
• -d — print the cryptid in the binaries if it exists. if it doesn't exist, well, nothing to print, we move on 💀
• -Enum:file — embed the hashes of file in the special codesign slot at num. slot machine but make it code signing 🎰
• -e — print the entitlements in each slice to stdout, or the slice specified by -A or -arch. chef's kiss, exactly what you need 🧑‍🍳
• -H[sha1 | sha256] — disable the hash not specified. This is useful to replicate the default behavior of codesign(1), which only provides a sha256 signature. one of them stays, one of them leaves the group chat 🚪
• -h — print information about the signature to stdout: hash types, flags, CDHash, and CodeDirectory version. the receipts, basically 🧾
• -Iname — set the identifier used in the binaries signature to name. If not specified, the basename of the binary is used. default behavior understood, understood 💅
• -Kkey.p12 — sign using the identity in key.p12. This will give the binary a valid signature so that it can be run on a system with signature validation. If key.p12 has a password you will be prompted for it, or you can specify from the command line with -U. 🔐 main character keyfile energy
• -M — when used with -S, merge the new and existing entitlements instead of replacing the existing entitlements. This is useful for adding a few specific entitlements to a handful of binaries. merging, not deleting, we love a collaborator 🤝
• -P[num] — mark the Mach-O as a platform binary. If num is specified, the platform field in the CodeDirectory will be set to that number. The default number is 13, as per Apple binaries. Specifying the platform using -P is a Procursus extension. 👑
• -Qrequirements.xml — embed the requirements found in requirements. 📎
• -q — print embedded requirements of the binaries. say it with me: requirements 🗣️
• -r — remove the signature from the Mach-O. byeeee 👋
• -S[file.xml] — pseudo-sign the Mach-O binaries. If file.xml is specified then the entitlements found in file.xml will be embedded in the Mach-O. this is the classic fakesign move, iykyk 🌈
• -s — resign the Mach-O binaries while keeping the existing entitlements. glow-up, not rebrand ✨
• -Upassword — use password as the password for the p12 certificate instead of prompting. 🗝️ This is a Procursus extension.
• -u — if the binary was linked against UIKit, then print the UIKit version that the Mach-O binary was linked against. if it wasn't, don't expect anything 🦋
• -w — shallow sign. Only the main binary of the specified bundle will be signed, as specified by CFBundleIdentifier in Info.plist. Any nested bundles and/or stray binaries will be completely left alone and interpreted at face-value. Applicable only when the signing target is a bundle directory, and not a specific Mach-O file. -w can be used on any bundle, not just the root .app, including frameworks, appexes, and more. 🫧 like, surface level only, we are NOT going deep today

---

🔥 EXAMPLES 🔥

okay so these are the actual moves, straight up. 💖

to fakesign file with no entitlements

ldid -S file

to sign file using the key in /path/to/key.p12 with entitlements found in ent.xml, marking it as an adhoc signature

ldid -Cadhoc -K/path/to/key.p12 -Sent.xml file

to add entitlements from ent.xml to the entitlements already in file

ldid -S -Cadhoc,linker-signed file

will fakesign file with no entitlements, and mark it as adhoc and linker-signed signature. (yes, that's literally what the page says — I'm not editing the original's whole thing, I'm just here to make it readable 😭)

the command:

ldid -Sent.xml -M file

to save the entitlements found in each slice of file to ent.xml

ldid -e file > ent.xml

redirect go brrr 🌀

---

👀 SEE ALSO 👀

• codesign(1) — the sibling, the reference, the one we keep pointing at 💜

---

🧚 HISTORY 🧚

okay the lore is genuinely iconic, listen:

The ldid utility was written by Jay ("Saurik") Freeman. 🫶

• iPhoneOS 1.2.0 and 2.0 support was added on April 6, 2008.
• -S was added on June 13, 2008.
• SHA256 support was added on August 25, 2016, fixing iOS 11 support.
• iOS 14 support was added on July 31, 2020 by Kabir Oberai.
• iOS 15 support was added on June 11, 2021.

a whole timeline, a whole legacy, we stan a long-running project 👑✨

---

🎀 and that's the page, bestie! this one's from the Debian build, dated January 20, 2022 — same manual slot, same name, and it goes out right alongside the LDID(1) header at the top. go sign something, slay, and remember: keep the hashes, keep the entitlements, keep the vibes 💅💖🌸