This is the code repository for the "Snake & Apple" article series, which documents my research on macOS security. The primary tool developed during the creation of the series is called CrimsonUroboros. You can find its description, along with instructions for other tools in this repository, in Tools.md.

I have been writing about Apple Security across different platforms for years, compiling them in this repository. Currently, I am writing on Patreon. All articles are free, except those marked with a *, which are exclusive content for Elite Patrons—my "thank-you" to the folks who support me.

Each main article directory contains three subdirectories:

• mac - source code of macOS for references and copy of presentations.
• custom - code, for example, programs written for articles.
• python - contains the latest CrimsonUroboros and other Python scripts created during research.

The short introduction is written in Snake&Apple Intro
The tags for each article are in the Article_tags.md.
The table of contents showing links to all articles is below:

• ☑ App Bundle Extension

  • ☑ Cracking macOS apps
  • ☑ Cracking Electron Integrity
  • ☑ XPC Programming on macOS
  • ☑ AppleScript for Vulnerability Research *
  • ☑ LLDB for Vulnerability Research *
  • ☑ Scaling Vulnerability Discovery on macOS *
  • ☑ Applications Patch Diffing on macOS *

• ☑ I. Mach-O

  • ☑ Optimizing Mach-O Detection
  • ☑ Static Analysis on Decompiled Code *

• ☑ II. Code Signing

  • ☑ To allow or not to get-task-allow, that is the question

• ☑ III. Checksec

• ☑ IV. Dylibs

  • ☑ Breaking Hardened Runtime: The 0-Day Microsoft Delivered to macOS

• ☑ V. Dyld

  • ☑ DYLD — Do You Like Death? (I)
  • ☑ DYLD — Do You Like Death? (II)
  • ☑ DYLD — Do You Like Death? (III)
  • ☑ DYLD — Do You Like Death? (IV)
  • ☑ DYLD — Do You Like Death? (V)
  • ☑ DYLD — Do You Like Death? (VI)
  • ☑ DYLD — Do You Like Death? (VII)
  • ☑ DYLD — Do You Like Death? (VIII)
  • ☑ DYLD — Do You Like Death? (IX)
  • ☑ DYLD — Do You Like Death? (X)
  • ☑ DYLD — Do You Like Death? (XI)

• ☑ VI. AMFI

  • ☑ Unexpected but expected behavior

• ☑ VII. Antivirus

  • ☑ Apple Gatekeeper Bypass

• ☑ VIII. Sandbox

  • ☑ SBPL Compilator
  • ☑ Sandbox Detector
  • ☑ Sandbox Validator
  • ☑ App Sandbox startup
  • ☑ System Integrity Protection

• ☑ IX. TCC

  • ☑ Apple UUID Finder
  • ☑ Threat of TCC Bypasses on macOS
  • ☑ TCC Bypass in Visual Studio Code via misconfigured Node fuses
  • ☑ Reverse Engineering Apple’s TCC Daemon: When Decompiled Code Lies

• ☑ X. NU

  • ☑ Kernel Debugging Setup on MacOS
  • ☑ Fixing an Infinite Loop
  • ☑ Exceptions on macOS
  • ☑ MACF on macOS
  • ☑ Kernel Extensions on macOS
  • ☑ Mach IPC Security on macOS
    • ☑ Task Injection on macOS
  • ☑ Drivers on macOS
    • ☑ Case Study: Analyzing macOS IONVMeFamily NS_01 Driver Denial of Service Issue
    • ☑ Case Study: IOMobileFramebuffer NULL Pointer Dereference
    • ☑ A mouse move that crashed the system – Stack Buffer Overflow in Display Driver on macOS
    • ☑ Mapping IOKit Methods Exposed to User Space on macOS #PHRACK 💀
  • ☑ SLAP & FLOP: Apple Silicon’s Data Speculation Vulnerabilities
  • ☑ History of NULL Pointer Dereferences on macOS

• ☐ Apple Intelligence

  • ☑ AI-Enhanced Vulnerability Research *

I have studied tons of resources, crediting other researchers and their contributions at the end of each article I wrote. Thank you all for sharing your hard-earned knowledge for free. You are all awesome! However, two individuals have significantly accelerated my progress, and I want to honor them:

• Jonathan Levin – His *OS Internals trilogy helped me rapidly learn the beauty of the macOS system. If there is a single resource I would recommend for anybody, it is the masterpiece you wrote. Thank you, Jonathan.

• Patrick Wardle – He created the OBTS conference, where many brilliant minds come together to share their research. You've created something to look forward to every year. Thank you, Patrick.