{"id":13726507,"url":"https://github.com/michalmalik/osx-re-101","last_synced_at":"2026-02-18T17:03:11.224Z","repository":{"id":34935344,"uuid":"39006326","full_name":"michalmalik/osx-re-101","owner":"michalmalik","description":"A collection of resources for OSX/iOS reverse engineering.","archived":false,"fork":false,"pushed_at":"2019-12-19T17:32:48.000Z","size":57,"stargazers_count":1728,"open_issues_count":1,"forks_count":249,"subscribers_count":118,"default_branch":"master","last_synced_at":"2025-10-10T03:09:10.635Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/michalmalik.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-07-13T10:40:28.000Z","updated_at":"2025-10-08T17:20:17.000Z","dependencies_parsed_at":"2022-08-08T03:00:48.967Z","dependency_job_id":null,"html_url":"https://github.com/michalmalik/osx-re-101","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/michalmalik/osx-re-101","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/michalmalik%2Fosx-re-101","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/michalmalik%2Fosx-re-101/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/michalmalik%2Fosx-re-101/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/michalmalik%2Fosx-re-101/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/michalmalik","download_url":"https://codeload.github.com/michalmalik/osx-re-101/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/michalmalik%2Fosx-re-101/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29587066,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-18T16:55:40.614Z","status":"ssl_error","status_checked_at":"2026-02-18T16:55:37.558Z","response_time":162,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T01:03:09.019Z","updated_at":"2026-02-18T17:03:11.192Z","avatar_url":"https://github.com/michalmalik.png","language":null,"funding_links":[],"categories":["Others","\u003ca id=\"8c5a692b5d26527ef346687e047c5c21\"\u003e\u003c/a\u003e收集","Reverse Engineering","Others (1002)","Infosec resources","\u003ca id=\"58cd9084afafd3cd293564c1d615dd7f\"\u003e\u003c/a\u003e工具"],"sub_categories":["ColdFusion","\u003ca id=\"d0108e91e6863289f89084ff09df39d0\"\u003e\u003c/a\u003e新添加的"],"readme":"osx \u0026 ios re 101\n==========\n\nWork in progress as I am actively collecting these.\n\n#### Must read\n\n- https://reverse.put.as/\n- https://blog.paloaltonetworks.com/tag/mac-os-x/\n- https://www.synack.com/blog/r-d-projects/os-x-security-research/\n- https://pewpewthespells.com/re.html\n- https://github.com/bx/machO-tools\n- https://github.com/kpwn/iOSRE\n\n#### Keep these handy\n- \"OSX Mach-O File Format Reference\" https://pewpewthespells.com/re/Mach-O_File_Format.pdf\n- \"OSX ABI\" https://pewpewthespells.com/re/Mac_OS_X_ABI_Function_Calls.pdf\n- Mach-O structures https://opensource.apple.com/source/xnu/xnu-2050.18.24/EXTERNAL_HEADERS/mach-o/loader.h\n- \"OSX BSD system calls\" https://sigsegv.pl/osx-bsd-syscalls/\n- https://opensource.apple.com/source/xnu/xnu-2050.18.24/bsd/kern/syscalls.master\n\n#### Basics\n\n- \"Universal Binary: The Mach-O file format\" https://cocoaintheshell.whine.fr/2009/07/universal-binary-mach-o-format/\n- \"Basics of the Mach-O file format\" https://samhuri.net/posts/2010/01/basics-of-the-mach-o-file-format/\n- \"How OS X Executes Applications\" http://0xfe.blogspot.de/2006/03/how-os-x-executes-applications.html\n- \"Infecting Mach-O object format\" https://papers.put.as/papers/macosx/2005/mach-o_infection.ppt\n- \"Under the iHood\" https://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-hotchkies.pdf\n- \"Dissection of minimal Intel 32-bits, 204 bytes, Mach-O \"Hello World\" executable file\" http://seriot.ch/hello_macho.php\n- \"Crafting a Tiny Mach-O Executable\" http://osxbook.com/blog/2009/03/15/crafting-a-tiny-mach-o-executable/\n- \"Parsing Mach-O files\" http://lowlevelbits.org/parse-mach-o-files/\n- \"ELF vs. Mach-O\" http://timetobleed.com/dynamic-linking-elf-vs-mach-o/\n- \"ELF vs. Mach-O 2\" http://timetobleed.com/dynamic-symbol-table-duel-elf-vs-mach-o-round-2/\n- \"NASM Hello World for x86 and x86_64 Intel Mac OS X\" https://gist.github.com/FiloSottile/7125822\n- \"Reverse Engineering the OS: A Practical Guide\" https://www.youtube.com/watch?v=uQWH55yIgYU\n\n#### Malware, Anti-debugging, infection techniques, obfuscation, and encryption\n\n- \"Infecting Mach-O\" http://nicolascormier.com/documentation/security/Infecting_Mach-O_Files.pdf\n- \"Abusing the Mach-O format\" http://cocoaintheshell.com/2009/10/abusing-mach-o\n- \"Multi-Platform Viruses Made Easy - A Case Study\" http://vxer.org/lib/vjp00.html\n- \"Running executables on macOS from memory\" https://blog.cylance.com/running-executables-on-macos-from-memory\n- macos_execute_from_memory https://github.com/prsecurity/macos_execute_from_memory/blob/master/main.c\n- \"Understanding Apple's Binary Protection in Mac OS X\" http://osxbook.com/book/bonus/chapter7/binaryprotection/\n- \"Macs get sick too\" http://www.irongeek.com/i.php?page=videos/derbycon6/104-macs-get-sick-too-tyler-halfpop-jacob-soo\n- \"A Peek Under the Hood of iOS Malware\" http://webdiis.unizar.es/~ricardo/files/papers/GR-WMA-16.pdf\n- \"Crafting macOS Rootkits\" https://www.zdziarski.com/blog/wp-content/uploads/2017/02/Crafting-macOS-Root-Kits.pdf\n- \"Revisiting Mac OS X Kernel Rootkits\" http://phrack.org/issues/69/7.html#article\n- \"Methods of malware persistence on Mac OS X\" https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf\n- \"Let's Play: Practical OS X Malware Detection \u0026 Analysis\" https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf\n\n#### Various research \u0026 tutorials\n\n- \"Reversing and Keygenning qwertyoruiop's Crackme\" https://reverse.put.as/2018/10/06/reversing-and-keygenning-qwertyoruiop-crackme/\n- \"Cracking Tutorial #1 - \"Sandwich\" CrackMe\" http://reverse.put.as/wp-content/uploads/2012/06/Sandwich_crackme_tut_qwertyoruiop.txt\n- \"Solving crackmes with LDPRELOAD\" http://radare.today/solving-crackmes-with-ldpreload/\n- \"Analyzing Binaries with Hopper’s Decompiler\" http://abad1dea.tumblr.com/post/23487860422/analyzing-binaries-with-hoppers-decompiler\n- \"Reverse Engineering Hopper Disassembler v3.9.9\" https://www.youtube.com/watch?v=pCITcLqgS9Q\n- \"Reverse-Engineering iOS Apps: Hacking on Lyft\" https://realm.io/news/conrad-kramer-reverse-engineering-ios-apps-lyft/\n- \"Jailbreak iOS 8.1.2 and Analyze Related Exploits\" http://proteaswang.blogspot.com/2017/04/jailbreak-ios-812-and-analyze-related.html\n-  \"Attacking The XNU Kernel in El Capitan\" https://www.blackhat.com/docs/eu-15/materials/eu-15-Todesco-Attacking-The-XNU-Kernal-In-El-Capitain.pdf\n- \"Shooting the OSX El Capitan Kernel Like a Sniper\" https://speakerdeck.com/flankerhqd/shooting-the-osx-el-capitan-kernel-like-a-sniper\n- \"The Italian morons are back! What are they up to this time?\" https://reverse.put.as/2016/02/29/the-italian-morons-are-back-what-are-they-up-to-this-time/\n- \"The Journey of a complete OSX privilege escalation with a single vulnerability - Part 1\" http://keenlab.tencent.com/en/2016/07/29/The-Journey-of-a-complete-OSX-privilege-escalation-with-a-single-vulnerability-Part-1/\n- \"iOS 10 Kernel Heap Revisted\" http://gsec.hitb.org/materials/sg2016/D2%20-%20Stefan%20Esser%20-%20iOS%2010%20Kernel%20Heap%20Revisited.pdf\n- \"Who needs decrypted kernels anyways?\" http://blog.offcellresearch.com/security/apple/ios/kernel/2016/08/23/who-needs-decrypted-kernels-anyways.html\n- \"Mac OS X Privilege Escalation via Use-After-Free: CVE-2016-1828\" https://bazad.github.io/2016/05/mac-os-x-use-after-free/\n- \"PEGASUS iOS Kernel Vulnerability Explained\" http://sektioneins.de/en/blog/16-09-02-pegasus-ios-kernel-vulnerability-explained.html\n- \"Behind the Scenes with iOS Security\" https://www.blackhat.com/docs/us-16/materials/us-16-Krstic.pdf\n- \"The Apple Sandbox: Deeper Into The Quagmire\" https://www.youtube.com/watch?v=mG715HcDgO8\n- “A deep-dive into the many flavors of IPC available on OS X.” https://vimeo.com/127859750\n- \"Analysis of iOS 9.3.3 Jailbreak \u0026 Security Enhancements of iOS 10\" http://powerofcommunity.net/poc2016/pangu.pdf\n- \"Fried Apples: Jailbreak DIY\" https://speakerdeck.com/mbazaliy/fried-apples-jailbreak-diy\n- \"Reversing a macOS Kernel Extension\" (DSMOS) http://lightbulbone.com/2016/10/04/intro-to-macos-kernel-debugging.html\n- \"Demystifying the Secure Enclave Processor\" http://mista.nu/research/sep-paper.pdf\n- \"Leveraging Apple's Game Engine to Detect macOS Threats\" https://objectivebythesea.com/v1/talks/OBTS_v1_Malm_Stein.pdf\n- \"Get Cozy with OpenBSM Auditing\" https://objective-see.com/talks/Wardle_ShmooCon2018.pdf\n- \"Real-time auditing on macOS with OpenBSM\" https://meliot.me/2017/07/02/mac-os-real-time-auditing/\n\n#### Kernel extension (KEXT) development\n\n- \"KEXT Controls and Notifications\" https://developer.apple.com/library/content/documentation/Darwin/Conceptual/NKEConceptual/control/control.html\n- \"Network Kernel Extensions Reference\" https://developer.apple.com/library/content/documentation/Darwin/Conceptual/NKEConceptual/reference/reference.html#//apple_ref/doc/uid/TP40001858-CH232-BBAGGGED\n- \"Working with TrustedBSD in Mac OS X\" https://sysdev.me/trusted-bsd-in-osx/\n- \"BUILDING AN APPLE OSX KERNEL MODULE WITH CMAKE – C/C\" http://www.goodbits.ca/index.php/2017/09/25/building-an-apple-osx-kernel-module-with-cmake-cc/\n- \"Debugging macOS Kernel using VirtualBox\" https://klue.github.io/blog/2017/04/macos_kernel_debugging_vbox/\n- \"Remote Kext Debugging\" https://rednaga.io/2017/04/09/remote_kext_debugging/\n- \"Introduction to macOS Kernel Debugging\" https://lightbulbone.com/posts/2016/10/intro-to-macos-kernel-debugging/\n- \"Kernel debugging with LLDB and VMWare Fusion\" http://ddeville.me/2015/08/kernel-debugging-with-lldb-and-vmware-fusion\n- \"Monitoring Process Creation via the Kernel (Part I)\" https://objective-see.com/blog.html#blogEntry9\n- \"Monitoring Process Creation via the Kernel (Part II)\" https://objective-see.com/blog/blog_0x0A.html\n- \"Monitoring Process Creation via the Kernel (Part III)\" https://objective-see.com/blog/blog_0x0B.html\n- \"Monitoring macOS, Part I: Monitoring Process Execution via MACF\" https://www.fortinet.com/blog/threat-research/monitoring-macos--part-i--monitoring-process-execution-via-macf.html\n- \"Monitoring macOS, Part II: Monitoring File System Events and Dylib Loading via MACF\" https://www.fortinet.com/blog/threat-research/monitor-file-system-events-and-dylib-loading-via-macf-on-macos.html\n- \"Monitoring macOS, Part III: Monitoring Network Activities Using Socket Filters\" https://www.fortinet.com/blog/threat-research/monitoring-macos--part-iii--monitoring-network-activities-using-.html\n- \"A binary whitelisting/blacklisting system for Mac OS X\" https://github.com/google/santa\n\n#### Other\n- \"The Python bites your apple - fuzzing and exploiting OSX Kernel bugs\" https://speakerdeck.com/flankerhqd/the-python-bites-your-apple-fuzzing-and-exploiting-osx-kernel-bugs\n- \"Artefacts and tricks for Mac OS X\" http://sud0man.blogspot.fr/2015/05/artefacts-for-mac-os-x.html?m=1\n- \"Collection of forensics artifacs location for Mac OS X and iOS\" https://github.com/pstirparo/mac4n6\n- \"New macOS Sierra (10.12) Forensic Artifacts – Introducing Unified Logging\" https://www.mac4n6.com/blog/2016/11/13/new-macos-sierra-1012-forensic-artifacts-introducing-unified-logging\n- \"A curated list of shell commands and tools specific to OS X\" https://github.com/herrbischoff/awesome-osx-command-line\n- \"OS X Security and Privacy Guide\" https://github.com/drduh/OS-X-Security-and-Privacy-Guide\n- \"A launchd tutorial\" http://launchd.info/\n- https://objective-see.com/index.html\n- \"OS X malloc introspection tool\" https://github.com/blankwall/MacHeap\n- \"MacOS Hardening Guide\" http://newosxbook.com/files/moxii3/AppendixA.pdf by Jonathan Levin\n- \"Checkout4Mac\" http://sud0man.blogspot.sk/2016/10/new-version-of-checkout4mac-02.html\n- \"OSX kernel fuzzer\" https://github.com/SilverMoonSecurity/PassiveFuzzFrameworkOSX\n- \"iOS instrumentation without jailbreak\" https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2016/october/ios-instrumentation-without-jailbreak/\n- \"MacOS monitoring the open source way\" https://blogs.dropbox.com/tech/2018/04/4696/\n- \"Mac OS X El Capitan (10.11) and task_for_pid()\" https://attilathedud.me/mac-os-x-el-capitan-10-11-and-task_for_pid/\n\n#### Crackmes and challenges\n\n- https://reverse.put.as/crackmes/\n- \"Exercises\" section in http://beginners.re/Reverse_Engineering_for_Beginners-en.pdf\n\n#### Books\n\n- \"The Mac Hacker's Handbook\" by Charlie Miller, Dino Dai Zovi\n- \"Mac OS X and iOS Internals: To the Apple's Core\" by Jonathan Levin\n- \"Mac OS X Internals: A Systems Approach\" by Amit Singh\n- \"iOS App Reverse Engineering\" https://github.com/iosre/iOSAppReverseEngineering\n- \"iOS Hacker's Handbook\" by Charlie Miller, Dion Blazakis, Dino Dai Zovi, Stefan Esser, Vincenzo Iozzo, Ralf-Philip Weinmann \n- \"Hacking and Securing iOS Applications\" by Jonathan Zdziarski\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmichalmalik%2Fosx-re-101","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmichalmalik%2Fosx-re-101","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmichalmalik%2Fosx-re-101/lists"}