@timac Though, that said, I can think of one pretty reliable way: If you dump the instructions (otool -xV) of an arm64e binary (SEP uses arm64e), and if you spot PAC sequences using the #0x6ae1 and #0xbbbf constants, then that's a very strong signal about the code being Swift. The constants are coming from this code in the Swift runtime: https://github.com/swiftlang/swift/blob/main/stdlib/public/SwiftShims/swift/shims/EmbeddedShims.h#L49,L60