[38;5;12mosx-security-awesome[39m[38;5;12m [39m[38;5;14m[1m![0m[38;5;12mAwesome[39m[38;5;14m[1m [0m[38;5;14m[1m(https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)[0m[38;5;12m [39m[38;5;12m(https://github.com/sindresorhus/awesome)[39m[38;5;14m[1m![0m[38;5;12mTravis[39m[38;5;14m[1m [0m
[38;5;14m[1m(https://api.travis-ci.org/kai5263499/osx-security-awesome.svg?branch=master)[0m[38;5;12m [39m[38;5;12m(https://travis-ci.org/kai5263499/osx-security-awesome)[39m

[38;5;238m――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――[39m

[38;5;12mA collection of OSX/iOS security related resources[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mNews[39m[38;5;12m (#news)[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mHardening[39m[38;5;12m (#hardening)[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mMalware sample sources[39m[38;5;12m (#malware-sample-sources)[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mDFIR[39m[38;5;12m (#digital-forensics--incident-response-dfir)[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mReverse engineering[39m[38;5;12m (#reverse-engineering)[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mPresentations and Papers[39m[38;5;12m (#presentations-and-papers)[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mVirus and exploit writeups[39m[38;5;12m (#virus-and-exploit-writeups)[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mUseful tools and guides[39m[38;5;12m (#useful-tools-and-guides)[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mRemote Access Toolkits[39m[38;5;12m (#remote-access-toolkits)[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mWorth following on Twitter[39m[38;5;12m (#worth-following-on-twitter)[39m


[38;5;238m――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――[39m

[38;2;255;187;0m[4mNews[0m

[38;5;238m――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――[39m
[38;5;14m[1m[4mLinking a microphone[0m[38;2;255;187;0m[4m (https://ubrigens.com/posts/linking_a_microphone.html)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mThe Story of CVE-2018-4184 or how a vulnearbility in OSX's Speech system allowed apps with access to the microphone to escape sandbox restrictions[39m
[38;5;14m[1m[4miOS vulnerability write-up[0m[38;2;255;187;0m[4m (https://github.com/writeups/iOS)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mA repository of iOS vulnerability write-ups as they are released[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mAlso includes conference papers[39m
[38;5;14m[1m[4miOS display bugs[0m[38;2;255;187;0m[4m (https://docs.google.com/document/d/1TDCVavaqDJCFjcQxZsL6InzHxPEYWwMMMh9QtfRGjbY/edit)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mRegularly updated list of iOS display bugs[39m

[38;5;14m[1m[4mMac Virus[0m[38;2;255;187;0m[4m (https://macviruscom.wordpress.com)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mFrequently updated blog that provides a good summary of the latest unique mac malware.[39m

[38;5;14m[1m[4mIntego Mac Security Blog[0m[38;2;255;187;0m[4m (https://www.intego.com/mac-security-blog/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mIntego's corporate Mac security blog often contains recent and in-depth analysis of mac malware and other security issues[39m

[38;5;14m[1m[4mObjective-See[0m[38;2;255;187;0m[4m (https://objective-see.com/blog.html)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mObjective-See's blog often contains in-depth breakdowns of malware they've reverse engineered and vulnarabilities they've discovered.[39m

[38;5;14m[1m[4mThe Safe Mac[0m[38;2;255;187;0m[4m (https://www.thesafemac.com/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mResource to help educate Mac users about security issues. Contains historical as well as timely security updates.[39m

[38;5;14m[1m[4mMac Security[0m[38;2;255;187;0m[4m (https://macsecurity.net/news)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mAnother Mac security blog. This often includes more in-depth analysis of specific threats.[39m

[38;5;14m[1m[4mOSX Daily[0m[38;2;255;187;0m[4m (https://osxdaily.com/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mNot strictly security-specific but it contains jailbreaking information which has security implications[39m

[38;2;255;187;0m[4mHardening[0m

[38;5;14m[1m[4mmacops[0m[38;2;255;187;0m[4m (https://github.com/google/macops)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mUtilities, tools, and scripts for managing and tracking a fleet of Macintoshes in a corporate environment collected by Google[39m

[38;5;14m[1m[4mSUpraudit[0m[38;2;255;187;0m[4m (http://newosxbook.com/tools/supraudit.html)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mSystem monitoring tool[39m

[38;5;14m[1m[4mEFIgy[0m[38;2;255;187;0m[4m (https://github.com/duo-labs/EFIgy)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mA RESTful API and client that helps Apple Mac users determine if they are running the expected EFI firmware version given their Mac hardware and OS build version[39m

[38;5;14m[1m[4mLaunchd[0m[38;2;255;187;0m[4m (https://www.launchd.info/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mEverything you need to know about the launchd service[39m

[38;5;14m[1m[4mOSX startup sequence[0m[38;2;255;187;0m[4m (http://osxbook.com/book/bonus/ancient/whatismacosx/arch_startup.html)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mStep-by-step guide to the startup process[39m

[38;5;14m[1m[4mGoogle OSX hardening[0m[38;2;255;187;0m[4m (https://www.usenix.org/conference/lisa13/os-x-hardening-securing-large-global-mac-fleet)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mGoogle's system hardening guide[39m

[38;5;14m[1m[4mRun any command in a sandbox[0m[38;2;255;187;0m[4m (https://www.davd.io/os-x-run-any-command-in-a-sandbox/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mHow to for using OSX's sandbox system[39m

[38;5;14m[1m[4mSandblaster[0m[38;2;255;187;0m[4m (https://github.com/malus-security/sandblaster)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mReversing the Apple sandbox[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPaper[0m[38;5;12m (https://arxiv.org/pdf/1608.04303.pdf)[39m

[38;5;14m[1m[4mOSX El Capitan Hardening Guide[0m[38;2;255;187;0m[4m (https://github.com/ernw/hardening/blob/master/operating_system/osx/10.11/ERNW_Hardening_OS_X_EL_Captain.md)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mHardening guide for El Capitan[39m

[38;5;14m[1m[4mHardening hardware and choosing a good BIOS[0m[38;2;255;187;0m[4m (https://media.ccc.de/v/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mProtecting your hardware from "evil maid" attacks[39m

[38;2;255;187;0m[4mMalware sample sources[0m
[38;5;14m[1m[4mObjective-See[0m[38;2;255;187;0m[4m (https://objective-see.com/malware.html)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mCurated list of malware samples. Use this list if you're looking for interesting samples to reverse engineer[39m
[38;5;14m[1m[4mAlien Vault[0m[38;2;255;187;0m[4m (https://www.alienvault.com/blogs/labs-research/os-x-malware-samples-analyzed)[0m
[38;5;14m[1m[4mContagio malware dump[0m[38;2;255;187;0m[4m (http://contagiodump.blogspot.com/2013/11/osx-malware-and-exploit-collection-100.html)[0m

[38;2;255;187;0m[4mDigital Forensics / Incident Response (DFIR)[0m
[38;2;255;187;0m[4mAPOLLO tool[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mPython tool for advanced forensics analysis[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPresentation slides[0m[38;5;12m (https://github.com/mac4n6/Presentations/blob/master/LaunchingAPOLLO/LaunchingAPOLLO.pdf)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSource code[0m[38;5;12m (https://github.com/mac4n6/APOLLO)[39m
[38;5;14m[1m[4mvenator[0m[38;2;255;187;0m[4m (https://posts.specterops.io/introducing-venator-a-macos-tool-for-proactive-detection-34055a017e56)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mPython tool for proactive detection tool for malware and trojans[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSource[0m[38;5;12m (https://github.com/richiercyrus/Venator)[39m
[38;5;14m[1m[4mlynis[0m[38;2;255;187;0m[4m (https://github.com/CISOfy/lynis/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mSecurity auditing tool for UNIX-based systems, including macOS[39m
[38;5;14m[1m[4mAutoMacTC[0m[38;2;255;187;0m[4m (https://github.com/CrowdStrike/automactc)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mModular forensic triage collection framework[0m[38;5;12m (https://www.crowdstrike.com/blog/automating-mac-forensic-triage/) from CrowdStrike [39m
[38;5;14m[1m[4mLegacy Exec History[0m[38;2;255;187;0m[4m (https://github.com/knightsc/system_policy)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mOSQuery module to give you a report of 32bit processes running on a 10.14 machine[39m
[38;5;14m[1m[4mUsing the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage[0m
[38;2;255;187;0m[4m (https://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-and-ios-to-determine-precise-user-and-application-usage)[0m
[38;5;14m[1m[4mArtefacts for Mac OSX[0m[38;2;255;187;0m[4m (http://sud0man.blogspot.com/2015/05/artefacts-for-mac-os-x.html?m=1)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mLocations of sensitive files[39m
[38;5;14m[1m[4mPac4Mac[0m[38;2;255;187;0m[4m (https://github.com/sud0man/pac4mac)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mForensics framework[39m
[38;5;14m[1m[4mInception[0m[38;2;255;187;0m[4m (https://github.com/carmaa/inception)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mPhysical memory manipulation[39m
[38;5;14m[1m[4mVolafox[0m[38;2;255;187;0m[4m (https://github.com/n0fate/volafox)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mMemory analysis toolkit[39m
[38;5;14m[1m[4mMac4n6[0m[38;2;255;187;0m[4m (https://github.com/pstirparo/mac4n6)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mCollection of OSX and iOS artifacts[39m
[38;5;14m[1m[4mKeychain analysis with Mac OSX Forensics[0m[38;2;255;187;0m[4m (https://repo.zenk-security.com/Forensic/Keychain%20Analysis%20with%20Mac%20OS%20X%20Memory%20Forensics.pdf)[0m
[38;5;14m[1m[4mOSX Collector[0m[38;2;255;187;0m[4m (https://github.com/Yelp/osxcollector)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mForensics utility developed by Yelp[39m
[38;5;14m[1m[4mOSX incident response[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=gNJ10Kt4I9E)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mOSX incident response at GitHub [39m[38;5;14m[1mSlides[0m[38;5;12m (https://speakerdeck.com/sroberts/hipster-dfir-on-osx-bsidescincy)[39m
[38;5;14m[1m[4miOS Instrumentation without jailbreaking[0m[38;2;255;187;0m[4m (https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2016/october/ios-instrumentation-without-jailbreak/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mHow to debug an iOS application that you didn't create[39m
[38;5;14m[1m[4mCerto[0m[38;2;255;187;0m[4m (https://www.certosoftware.com/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mPaid service for analyzing the iTunes backup of your iOS device[39m
[38;5;14m[1m[4mBlackbag Tech free tools[0m[38;2;255;187;0m[4m (https://www.blackbagtech.com/resources/free-tools/)[0m
[38;5;14m[1m[4mOSX (Mac) Memory Acquisition and Analysis Using OSXpmem and Volatility[0m[38;2;255;187;0m[4m (https://ponderthebits.com/2017/02/osx-mac-memory-acquisition-and-analysis-using-osxpmem-and-volatility/)[0m
[38;5;14m[1m[4mmac-apt[0m[38;2;255;187;0m[4m (https://github.com/ydkhatri/mac_apt)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mMac Artifact Parsing Tool for processing full disk images and extracting useful information[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mThe author also has a collection of [39m[38;5;14m[1mDFIR scripts[0m[38;5;12m (https://github.com/ydkhatri/MacForensics)[39m

[38;2;255;187;0m[4mReverse engineering[0m
[38;5;14m[1m[4mNew OS X Book[0m[38;2;255;187;0m[4m (http://www.newosxbook.com/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mFrequently updated book on OSX internals[39m
[38;5;14m[1m[4mCollection of OSX reverse engineering resources[0m[38;2;255;187;0m[4m (https://github.com/michalmalik/osx-re-101)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mAnother Awesome-style list dedicated to OSX reverse engineering resources[39m
[38;5;14m[1m[4mThe iPhone Wiki[0m[38;2;255;187;0m[4m (https://www.theiphonewiki.com/wiki/Main_Page)[0m
[38;5;14m[1m[4mReverse engineering OSX[0m[38;2;255;187;0m[4m (https://reverse.put.as/)[0m
[38;5;14m[1m[4mOSX crackmes[0m[38;2;255;187;0m[4m (https://reverse.put.as/crackmes/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mA collection of puzzles to test your reverse engineering skills[39m
[38;5;14m[1m[4mIntroduction to Reverse Engineering Cocoa Applications[0m[38;2;255;187;0m[4m (https://www.fireeye.com/blog/threat-research/2017/03/introduction_to_reve.html)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mWalkthrough for Coca applications[39m
[38;5;14m[1m[4miOS Kernel source[0m[38;2;255;187;0m[4m (https://github.com/apple/darwin-xnu)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mSource code for iOS kernel[39m
[38;5;14m[1m[4mReverse Engineering Challenges[0m[38;2;255;187;0m[4m (https://challenges.re/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mVery good list of various crackme challenges that is categorized by level and OS[39m
[38;5;14m[1m[4mAwesome Reversing[0m[38;2;255;187;0m[4m (https://github.com/tylerha97/awesome-reversing)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mAwesome list dedicated to reversing[39m

[38;2;255;187;0m[4mPresentations and Papers[0m
[38;5;14m[1m[4mArea41 2018: Daniel Roethlisberger: Monitoring MacOS For Malware And Intrusions[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=OSSkBgn_xJs&feature=youtu.be)[0m
[38;5;14m[1m[4mWindshift APT[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=Mza6qv4mY9I&feature=youtu.be&t=6h12m24s)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDeep-dive write-up by Objective See[0m[38;5;12m (https://objective-see.com/blog/blog_0x38.html)[39m
[38;5;14m[1m[4mAutomated Binary Analysis on iOS – A Case Study on Cryptographic Misuse in iOS Applications[0m[38;2;255;187;0m[4m (https://pure.tugraz.at/ws/portalfiles/portal/17749575)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mExamining iOS applications for poorly guarded secrets[39m
[38;5;14m[1m[4mWriting Bad @$$ Malware for OSX[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=fv4l9yAL2sU)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSlides[0m[38;5;12m (https://www.slideshare.net/Synack/writing-bad-malware-for-os-x) and [39m[38;5;14m[1manother related video[0m[38;5;12m (https://www.youtube.com/watch?v=oT8BKt_0cJw).[39m
[38;5;14m[1m[4mMethods of Malware Persistence on OSX[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=rhhvZnA4VNY)[0m
[38;5;14m[1m[4mAdvanced Mac OSX Rootkits[0m[38;2;255;187;0m[4m (https://www.blackhat.com/presentations/bh-usa-09/DAIZOVI/BHUSA09-Daizovi-AdvOSXRootkits-SLIDES.pdf)[0m
[38;5;14m[1m[4mThe Python Bytes Your Apple[0m[38;2;255;187;0m[4m (https://speakerdeck.com/flankerhqd/the-python-bites-your-apple-fuzzing-and-exploiting-osx-kernel-bugs)  [0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mFuzzing and exploiting OSX kernel bugs[39m
[38;5;14m[1m[4mBreaking iOS Code Signing[0m[38;2;255;187;0m[4m (https://papers.put.as/papers/ios/2011/syscan11_breaking_ios_code_signing.pdf)[0m
[38;5;14m[1m[4mThe Apple Sandbox - 5 years later[0m[38;2;255;187;0m[4m (http://newosxbook.com/files/HITSB.pdf)[0m
[38;5;14m[1m[4mPractical iOS App Hacking[0m[38;2;255;187;0m[4m (https://papers.put.as/papers/ios/2012/Mathieu-RENARD-GreHACK-Practical-iOS-App-Hacking.pdf)[0m
[38;5;14m[1m[4mBehavioral Detection and Prevention of Malware on OS X[0m[38;2;255;187;0m[4m (https://www.virusbulletin.com/blog/2016/september/paper-behavioural-detection-and-prevention-malware-os-x/)[0m
[38;5;14m[1m[4mSecurity on OSX and iOS[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=fdxxPRbXPsI)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSlides[0m[38;5;12m (https://www.slideshare.net/nosillacast/security-on-the-mac)[39m

[38;5;14m[1m[4mThunderstrike[0m[38;2;255;187;0m[4m (https://trmm.net/Thunderstrike_31c3)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVideo[0m[38;5;12m (https://www.youtube.com/watch?v=5BrdX7VdOr0), hacking Mac's extensible firmware interface (EFI)[39m
[38;5;14m[1m[4mDirect Memory Attack the Kernel[0m[38;2;255;187;0m[4m (https://github.com/ufrisk/presentations/blob/master/DEFCON-24-Ulf-Frisk-Direct-Memory-Attack-the-Kernel-Final.pdf)[0m
[38;5;14m[1m[4mDon't trust your eye, Apple graphics is compromised[0m[38;2;255;187;0m[4m (https://speakerdeck.com/marcograss/dont-trust-your-eye-apple-graphics-is-compromised)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12msecurity flaws in IOKit's graphics acceleration that lead to exploitation from the browser[39m
[38;5;14m[1m[4mFuzzing and Exploiting OSX Vulnerabilities for Fun and Profit Complementary Active & Passive Fuzzing[0m[38;2;255;187;0m[4m (https://www.slideshare.net/PacSecJP/moony-li-pacsec18?qid=15552f01-6655-4555-9894-597d62fd803c)[0m
[38;5;14m[1m[4mStrolling into Ring-0 via I/O Kit Drivers[0m[38;2;255;187;0m[4m (https://speakerdeck.com/patrickwardle/o-kit-drivers)[0m
[38;5;14m[1m[4mJuice Jacking[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=TKAgemHyq8w)[0m
[38;5;14m[1m[4mAttacking OSX for fun and profit tool set limiations frustration and table flipping Dan Tentler[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=9T_2KYox9Us)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFollow-up from target[0m[38;5;12m (https://www.youtube.com/watch?v=bjYhmX_OUQQ)[39m
[38;5;14m[1m[4mBuilding an EmPyre with Python[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=79qzgVTP3Yc)[0m
[38;5;14m[1m[4mPoisonTap[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=Aatp5gCskvk)[0m
[38;5;14m[1m[4mStoring our Digital Lives - Mac Filesystems from MFS to APFS[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=uMfmgcnrn24)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mslides[0m[38;5;12m (http://macadmins.psu.edu/files/2017/07/psumac2017-174-Storing-our-digital-lives-Mac-filesystems-from-MFS-to-APFS.key-254bf2y.pdf)[39m
[38;5;14m[1m[4mCollection of mac4en6 papers/presentations[0m[38;2;255;187;0m[4m (https://drive.google.com/drive/folders/0B37-sa0Wh9_TdjVSbzRvMEVGQ2c)[0m
[38;5;14m[1m[4mThe Underground Economy of Apple ID[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=4acVKs9WPts)[0m
[38;5;14m[1m[4miOS of Sauron: How iOS Tracks Everything You Do[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=D6cSiHpvboI)[0m
[38;5;14m[1m[4mmacOS/iOS Kernel Debugging and Heap Feng Shui[0m[38;2;255;187;0m[4m (https://github.com/zhengmin1989/MyArticles/blob/master/PPT/DEFCON-25-Min-Spark-Zheng-macOS-iOS-Kernel-Debugging.pdf)[0m
[38;5;14m[1m[4mBilly Ellis iOS/OSX hacking YouTube channel[0m[38;2;255;187;0m[4m (https://www.youtube.com/channel/UCk2sx_3FUkKvDGlIhdUQa8A)[0m
[38;5;14m[1m[4mA Technical Autopsy of the Apple - FBI Debate using iPhone forensics | SANS DFIR Webcast[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=_q_2mN8U91o)[0m
[38;5;14m[1m[4mJailbreaking Apple Watch at DEFCON-25[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=eJpbi-Qz6Jc)[0m
[38;5;14m[1m[4mSandScout: Automatic Detection of Flaws in iOS Sandbox Profiles[0m[38;2;255;187;0m[4m (http://www.icri-sc.org/fileadmin/user_upload/Group_TRUST/PubsPDF/sandscout-final-ccs-2016.pdf)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mAn exploration of the sandbox protections policies[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPresentation[0m[38;5;12m (https://www.youtube.com/watch?v=TnwXEDCIowQ)[39m


[38;2;255;187;0m[4mVirus and exploit writeups[0m
[38;5;14m[1m[4mDetailed Analysis of macOS/iOS Vulnerability CVE-2019-6231[0m[38;2;255;187;0m[4m (https://www.fortinet.com/blog/threat-research/detailed-analysis-of-macos-ios-vulnerability-cve-2019-6231.html)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mExploration of QuartzCore/CoreAnimation flaw leading to a malicious application being able to read restricted memory.[39m
[38;5;14m[1m[4mkernelcache laundering[0m[38;2;255;187;0m[4m (https://github.com/Synacktiv-contrib/kernelcache-laundering)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mLoad iOS12 kernelcaches and PAC code in IDA[39m
[38;5;14m[1m[4mblanket[0m[38;2;255;187;0m[4m (https://github.com/bazad/blanket)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mProof of concept for CVE-2018-4280: Mach port replacement vulnerability in launchd on iOS 11.2.6[39m
[38;5;14m[1m[4mProof of Concept for Remote Code Execution in WebContent[0m[38;2;255;187;0m[4m (https://github.com/externalist/exploit_playground/blob/master/CVE-2018-4233/pwn_i8.js)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMachO tricks[0m[38;5;12m (https://iokit.racing/machotricks.pdf) - Appears to be slides from a presentation that ends with the CVE listed above[39m
[38;5;14m[1m[4mThere's Life in the Old Dog Yet: Tearing New Holes into Intel/iPhone Cellular Modems[0m[38;2;255;187;0m[4m (https://comsecuris.com/blog/posts/theres_life_in_the_old_dog_yet_tearing_new_holes_into_inteliphone_cellular_modems/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mHow the public warning system can be used as an attack vector [39m
[38;5;14m[1m[4mI can be Apple, and so can you[0m[38;2;255;187;0m[4m (https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mAn exploration of a code signing vulnerability in macOS that has persisted for 11 years[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCreating signed and customized backdoored macos apps[0m[38;5;12m (https://medium.com/@adam.toscher/creating-signed-and-customized-backdoored-macos-applications-by-abusing-apple-developer-tools-b4cbf1a98187)[39m
[38;5;14m[1m[4mLeveraging emond on macOS for persistence[0m[38;2;255;187;0m[4m (https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124)[0m
[38;5;14m[1m[4mAPFS credential leak vulnerability[0m[38;2;255;187;0m[4m (https://www.mac4n6.com/blog/2018/3/21/uh-oh-unified-logs-in-high-sierra-1013-show-plaintext-password-for-apfs-encrypted-external-volumes-via-disk-utilityapp)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mA flaw in Unified Logs leaks the password for encrypted APFS volumes[39m

[38;5;14m[1m[4mA fun XNU infoleak[0m[38;2;255;187;0m[4m (https://bazad.github.io/2018/03/a-fun-xnu-infoleak/)[0m
[38;2;255;187;0m[4mMeltdown[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mCPU flaw allowing kernel memory to be accessed by hijacking speculative[39m
[38;5;12m  execution[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mProof of concept[0m[38;5;12m (https://github.com/gkaindl/meltdown-poc)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mApple's statement[0m[38;5;12m (https://support.apple.com/en-us/HT208394)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMeasuring OSX meltdown patches performance[0m[38;5;12m (https://reverse.put.as/2018/01/07/measuring-osx-meltdown-patches-performance/)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1miPhone performance after Spectre patch[0m[38;5;12m (https://www.gsmarena.com/spectre_and_meltdown_testing_performance_impact_on_iphone_8_plus-news-29132.php)[39m
[38;5;14m[1m[4mFlashback[0m[38;2;255;187;0m[4m (https://www.cnet.com/news/more-than-600000-macs-infected-with-flashback-botnet/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDetailed analysis[0m[38;5;12m (https://www.intego.com/mac-security-blog/more-about-the-flashback-trojan-horse/)[39m
[38;5;14m[1m[4mFlashback pt 2[0m[38;2;255;187;0m[4m (https://www.intego.com/mac-security-blog/flashback-botnet-is-adrift/)[0m
[38;5;14m[1m[4miWorm[0m[38;2;255;187;0m[4m (https://www.thesafemac.com/iworm-method-of-infection-found/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDetailed analysis[0m[38;5;12m (https://www.intego.com/mac-security-blog/iworm-botnet-uses-reddit-as-command-and-control-center/)[39m
[38;5;14m[1m[4mThunderbolt[0m[38;2;255;187;0m[4m (https://www.theregister.co.uk/2015/01/08/thunderstrike_shocks_os_x_with_first_firmware_bootkit/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mFirmware bootkit[39m
[38;5;14m[1m[4mMalware in firmware: how to exploit a false sense of security[0m[38;2;255;187;0m[4m (https://www.welivesecurity.com/2017/10/19/malware-firmware-exploit-sense-security/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mA post on the resurgence of bootkits and how to defend against them[39m
[38;5;14m[1m[4mProton RAT[0m[38;2;255;187;0m[4m (https://www.cybereason.com/blog/labs-proton-b-what-this-mac-malware-actually-does)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mExploration of a Remote Access Toolkit[39m

[38;5;14m[1m[4mMokes[0m[38;2;255;187;0m[4m (https://thehackernews.com/2016/09/cross-platform-malware.html)[0m
[38;5;14m[1m[4mMacKeeper[0m[38;2;255;187;0m[4m (https://www.cultofmac.com/170522/is-mackeeper-really-a-scam/)[0m
[38;5;14m[1m[4mOpinionSpy[0m[38;2;255;187;0m[4m (https://www.thesafemac.com/opinionspy-is-back/)[0m
[38;5;14m[1m[4mElanor[0m[38;2;255;187;0m[4m (https://blog.malwarebytes.com/cybercrime/2016/07/new-mac-backdoor-malware-eleanor/)[0m
[38;5;14m[1m[4mMac Defender[0m[38;2;255;187;0m[4m (https://macsecurity.net/view/79-remove-mac-defender-virus-from-mac-os-x)[0m
[38;5;14m[1m[4mWire Lurker[0m[38;2;255;187;0m[4m (https://www.paloaltonetworks.com/resources/research/unit42-wirelurker-a-new-era-in-ios-and-os-x-malware.html)[0m
[38;5;14m[1m[4mKeRanger[0m[38;2;255;187;0m[4m (https://techcrunch.com/2016/03/07/apple-has-shut-down-the-first-fully-functional-mac-os-x-ransomware/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mFirst OSX ransomware[39m
[38;5;14m[1m[4mProof-of-concept USB attack[0m[38;2;255;187;0m[4m (https://www.ehackingnews.com/2016/09/a-usb-device-can-steal-credentials-from.html)[0m
[38;5;14m[1m[4mDark Jedi[0m[38;2;255;187;0m[4m (https://reverse.put.as/2015/05/29/the-empire-strikes-back-apple-how-your-mac-firmware-security-is-completely-broken/)[0m
[38;2;255;187;0m[4mEFI attack that exploits a vulnerability in suspend-resume cycle [0m[38;5;14m[1m[4mSentinel One write-up[0m[38;2;255;187;0m[4m (https://www.sentinelone.com/blog/reverse-engineering-mac-os-x/)[0m
[38;5;14m[1m[4mXAgent Mac Malware Used In APT-28[0m[38;2;255;187;0m[4m (https://labs.bitdefender.com/2017/02/new-xagent-mac-malware-linked-with-the-apt28/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSamples[0m[38;5;12m (http://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html)[39m
[38;5;14m[1m[4mJuice Jacking[0m[38;2;255;187;0m[4m (https://www.howtogeek.com/166497/htg-explains-what-is-juice-jacking-and-how-worried-should-you-be/)[0m
[38;5;14m[1m[4mLocal Privilege Escalation for macOS 10.12.2 and XNU port Feng Shui[0m[38;2;255;187;0m[4m (https://github.com/zhengmin1989/macOS-10.12.2-Exp-via-mach_voucher)[0m

[38;5;14m[1m[4mIan Beer, Google Project Zero: "A deep-dive into the many flavors of IPC available on OS X."[0m[38;2;255;187;0m[4m (https://www.youtube.com/watch?v=D1jNCy7-g9k)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mDeep dive into the interprocess communication and its design flaws[39m

[38;5;14m[1m[4mPEGASUS iOS Kernel Vulnerability Explained[0m[38;2;255;187;0m[4m (https://sektioneins.de/en/blog/16-09-02-pegasus-ios-kernel-vulnerability-explained.html)[0m
[38;5;14m[1m[4mAnalysis of iOS.GuiInject Adware Library[0m[38;2;255;187;0m[4m (https://www.sentinelone.com/blog/analysis-ios-guiinject-adware-library/)[0m
[38;5;14m[1m[4mBroadpwn[0m[38;2;255;187;0m[4m (https://blog.exodusintel.com/2017/07/26/broadpwn/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mGaining access through the wireless subsystem[39m

[38;5;14m[1m[4mReverse Engineering and Abusing Apple Call Relay Protocol[0m[38;2;255;187;0m[4m (https://www.martinvigo.com/diy-spy-program-abusing-apple-call-relay-protocol/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mDetails the discovery of a vulnerability in Apple's Call handoff between mobile and desktop through analyzing network traffic.[39m

[38;2;255;187;0m[4mExploiting the Wifi Stack on Apple Devices[0m
[38;5;12mGoogle's Project Zero series of articles that detail vulnerabilities in the wireless stack used by Apple Devices[39m
[38;5;12m [39m[38;5;12m [39m[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOver The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 1)[0m[38;5;12m (https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html)[39m
[38;5;12m [39m[38;5;12m [39m[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOver The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2)[0m[38;5;12m (https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_11.html)[39m
[38;5;12m [39m[38;5;12m [39m[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOver The Air - Vol. 2, Pt. 1: Exploiting The Wi-Fi Stack on Apple Devices[0m[38;5;12m (https://googleprojectzero.blogspot.com/2017/09/over-air-vol-2-pt-1-exploiting-wi-fi.html)[39m
[38;5;12m [39m[38;5;12m [39m[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOver The Air - Vol. 2, Pt. 2: Exploiting The Wi-Fi Stack on Apple Devices[0m[38;5;12m (https://googleprojectzero.blogspot.com/2017/10/over-air-vol-2-pt-2-exploiting-wi-fi.html)[39m
[38;5;12m [39m[38;5;12m [39m[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOver The Air - Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices[0m[38;5;12m (https://googleprojectzero.blogspot.com/2017/10/over-air-vol-2-pt-3-exploiting-wi-fi.html)[39m

[38;5;14m[1m[4mChaiOS bug[0m[38;2;255;187;0m[4m (https://www.grahamcluley.com/chaios-bug-crash-ios-macos-messages/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mA message that crashes iMessage[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mLooks[39m[38;5;12m [39m[38;5;12msimilar[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;14m[1mprevious[0m[38;5;12m [39m[38;5;12m(https://arstechnica.com/gadgets/2013/08/rendering-bug-crashes-os-x-and-ios-apps-with-string-of-arabic-characters/)[39m[38;5;12m [39m[38;5;14m[1mbugs[0m[38;5;12m [39m[38;5;12m(https://www.intego.com/mac-security-blog/crash-text-message-iphone/)[39m[38;5;12m [39m[38;5;12mrendering[39m[38;5;12m [39m[38;5;12mArabic[39m[38;5;12m [39m
[38;5;12mcharacters[39m

[38;2;255;187;0m[4mUseful tools and guides[0m
[38;5;14m[1m[4mMac@IBM[0m[38;2;255;187;0m[4m (https://github.com/IBM/mac-ibm-enrollment-app)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mMac enrollment helper provided by IBM[39m
[38;5;14m[1m[4mmOSL[0m[38;2;255;187;0m[4m (https://github.com/0xmachos/mOSL)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mAudit and fix macOS High Sierra (10.13.x) security settings[39m
[38;5;14m[1m[4mDarling[0m[38;2;255;187;0m[4m (https://github.com/darlinghq/darling)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mDarwin/macOS emulation layer for Linux[39m
[38;5;14m[1m[4mKemon[0m[38;2;255;187;0m[4m (https://github.com/didi/kemon)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mOpen source kernel monitoring[39m
[38;5;14m[1m[4mjelbrektime[0m[38;2;255;187;0m[4m (https://github.com/kai5263499/jelbrekTime)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mDeveloper jailbreak for Apple Watch[39m
[38;5;14m[1m[4mBooting Secure[0m[38;2;255;187;0m[4m (http://michaellynn.github.io/2018/07/27/booting-secure/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mDeep dive into Secure Boot on 2018 MacBook Pro[39m
[38;5;14m[1m[4mTutorial - emulate an iOS kernel in QEMU up to launchd and userspace[0m[38;2;255;187;0m[4m (https://worthdoingbadly.com/xnuqemu2/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mTutorial on getting an iOS kernel to run in QEMU[39m
[38;5;14m[1m[4mxnumon[0m[38;2;255;187;0m[4m (https://www.roe.ch/xnumon)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mMonitor macOS for malicious activity[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1msource[0m[38;5;12m (https://github.com/droe/xnumon)[39m
[38;5;14m[1m[4mDetectX[0m[38;2;255;187;0m[4m (https://sqwarq.com/detectx/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mAudits system artifacts to help you identify unknown and novel threats[39m
[38;5;14m[1m[4mAre you really signed?[0m[38;2;255;187;0m[4m (https://github.com/Sentinel-One/macos-are-you-really-signed)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mUtility to test for code-sign bypass vulnerability[39m
[38;5;14m[1m[4mosx security growler[0m[38;2;255;187;0m[4m (https://github.com/pirate/security-growler)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mMac menubar item that lets you know about security events on your system[39m
[38;5;14m[1m[4mmac-a-mal[0m[38;2;255;187;0m[4m (https://github.com/phdphuc/mac-a-mal)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mAutomated malware analysis on macOS[39m
[38;5;14m[1m[4mjrswizzle[0m[38;2;255;187;0m[4m (https://github.com/rentzsch/jrswizzle)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mmethod interface exchange[39m
[38;5;14m[1m[4mMacDBG[0m[38;2;255;187;0m[4m (https://github.com/blankwall/MacDBG)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mC and Python debugging framework for OSX[39m
[38;5;14m[1m[4mbitcode_retriever[0m[38;2;255;187;0m[4m (https://github.com/AlexDenisov/bitcode_retriever)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mstore and retrieve bitcode from Mach-O binary[39m
[38;5;14m[1m[4mmachotools[0m[38;2;255;187;0m[4m (https://github.com/enthought/machotools)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mretrieve and change information about mach-o files[39m
[38;5;14m[1m[4monyx-the-black-cat[0m[38;2;255;187;0m[4m (https://github.com/acidanthera/onyx-the-black-cat) ([0m[38;5;14m[1m[4moutdated original[0m[38;2;255;187;0m[4m (https://github.com/gdbinit/onyx-the-black-cat))[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mkernel module for OSX to defeat anti-debugging protection[39m
[38;5;14m[1m[4mcreate-dmg[0m[38;2;255;187;0m[4m (https://github.com/andreyvit/create-dmg)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mCLI utility for creating and modifying DMG files[39m
[38;5;14m[1m[4mdmg2iso[0m[38;2;255;187;0m[4m (https://sourceforge.net/projects/dmg2iso/?source=typ_redirect)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mconvert dmg to iso[39m
[38;5;14m[1m[4mInfosec Homebrew[0m[38;2;255;187;0m[4m (https://github.com/kai5263499/homebrew-infosec)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mHomebrew tap for security-related utilities[39m
[38;5;14m[1m[4mAwesome OSX Command Line[0m[38;2;255;187;0m[4m (https://github.com/herrbischoff/awesome-macos-command-line)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mCollection of really useful shell commands[39m
[38;5;14m[1m[4mKeychain dump[0m[38;2;255;187;0m[4m (https://github.com/juuso/keychaindump)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mDump keychain credentials[39m
[38;5;14m[1m[4mKnockKnock[0m[38;2;255;187;0m[4m (https://objective-see.com/products/knockknock.html)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mListing startup items. Also includes VirusTotal information[39m
[38;5;14m[1m[4mLingon-X[0m[38;2;255;187;0m[4m (https://www.peterborgapps.com/lingon/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mGUI for launchd[39m
[38;5;14m[1m[4mHopper[0m[38;2;255;187;0m[4m (https://www.hopperapp.com/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mExcellent OSX debugger (requires license)[39m
[38;5;14m[1m[4mSymhash[0m[38;2;255;187;0m[4m (https://github.com/threatstream/symhash)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mPython utility for generating imphash fingerprints for OSX binaries[39m
[38;5;14m[1m[4mKisMac2[0m[38;2;255;187;0m[4m (https://github.com/IGRSoft/KisMac2)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mWireless scanning and packet capturing[39m
[38;5;14m[1m[4mPassive fuzz framework[0m[38;2;255;187;0m[4m (https://github.com/SilverMoonSecurity/PassiveFuzzFrameworkOSX)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mFramework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode[39m
[38;5;14m[1m[4mPlatypus[0m[38;2;255;187;0m[4m (https://sveinbjorn.org/platypus)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mGUI for generating .app bundles[39m
[38;5;14m[1m[4mcreateOSXinstallPkg[0m[38;2;255;187;0m[4m (https://github.com/munki/createOSXinstallPkg)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mCLI for generating .pkg installers[39m
[38;5;14m[1m[4mPoisonTap[0m[38;2;255;187;0m[4m (https://github.com/samyk/poisontap)[0m
[38;5;14m[1m[4mChipsec[0m[38;2;255;187;0m[4m (https://github.com/chipsec/chipsec)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mSystem firmware checker by Intel[39m
[38;5;14m[1m[4mRevisiting Mac OS X Kernel Rootkits by Phrack Magazine[0m[38;2;255;187;0m[4m (http://phrack.org/issues/69/7.html)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mA collection of OSX rootkit ideas[39m
[38;5;14m[1m[4miPhone Data Protection in Depth[0m[38;2;255;187;0m[4m (http://conference.hackinthebox.org/hitbsecconf2011ams/materials/D2T2%20-%20Jean-Baptiste%20Be%CC%81drune%20&%20Jean%20Sigwald%20-%20iPhone%20Data%20Protection%20in%20Depth.pdf)[0m
[38;5;14m[1m[4mCycript[0m[38;2;255;187;0m[4m (http://www.cycript.org/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mRemote control library for fuzz testing iOS apps[39m
[38;5;14m[1m[4mChaoticMarch[0m[38;2;255;187;0m[4m (https://github.com/synack/chaoticmarch)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mBlackbox fuzz testing for iOS apps (requires jailbreak)[39m
[38;5;14m[1m[4miOS backup decrypt script[0m[38;2;255;187;0m[4m (https://stackoverflow.com/questions/1498342/how-to-decrypt-an-encrypted-apple-itunes-iphone-backup)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mContains a script for decrypting an encrypted iOS backup archive[39m
[38;5;14m[1m[4mRemote Packet Capture for iOS Devices[0m[38;2;255;187;0m[4m (https://useyourloaf.com/blog/remote-packet-capture-for-ios-devices/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mUse a remote virtual interface to capture packets from a tethered iOS device[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPython utility[0m[38;5;12m (https://thrysoee.dk/iospcap/)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAnother python utility[0m[38;5;12m (https://github.com/gh2o/rvi_capture)[39m
[38;5;14m[1m[4mPareto Security[0m[38;2;255;187;0m[4m (https://paretosecurity.app/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mA MenuBar app to automatically audit your Mac for basic security hygiene.[39m
[38;5;14m[1m[4mMana Security[0m[38;2;255;187;0m[4m (https://manasecurity.com/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mVulnerability Management app for individuals. It helps to keep macOS and installed applications updated.[39m
[38;5;14m[1m[4mcnspec[0m[38;2;255;187;0m[4m (https://cnspec.io/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mOpen source vulnerability and misconfiguration scanning for macOS hosts + much more.[39m
[38;5;14m[1m[4mIntro To IOS Malware Detection[0m[38;2;255;187;0m[4m (https://8ksec.io/mobile-malware-analysis-part-4-intro-to-ios-malware-detection/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12miOS malware, its types, methods of gathering forensics information[39m
[38;5;14m[1m[4mIpsw Walkthrough[0m[38;2;255;187;0m[4m (https://8ksec.io/ipsw-walkthrough-part-1-the-swiss-army-knife-for-ios-macos-security-research/)[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mPart one that covers basic uses[39m

[38;2;255;187;0m[4mRemote Access Toolkits[0m
[38;5;14m[1m[4mEmpyre[0m[38;2;255;187;0m[4m (https://github.com/EmpireProject/EmPyre)[0m
[38;5;14m[1m[4mBella[0m[38;2;255;187;0m[4m (https://github.com/kai5263499/Bella)[0m
[38;5;14m[1m[4mStitch[0m[38;2;255;187;0m[4m (https://nathanlopez.github.io/Stitch/)[0m
[38;5;14m[1m[4mPupy[0m[38;2;255;187;0m[4m (https://github.com/n1nj4sec/pupy)[0m
[38;5;14m[1m[4mEggShell surveillance tool[0m[38;2;255;187;0m[4m (https://github.com/neoneggplant/EggShell) - Works on OSX and jailbroken iOS[0m
[38;5;14m[1m[4mEvilOSX[0m[38;2;255;187;0m[4m (https://github.com/Marten4n6/EvilOSX) - Pure python post-exploitation toolkit[0m

[38;2;255;187;0m[4mWorth following on Twitter[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m@patrickwardle[0m[38;5;12m (https://twitter.com/patrickwardle)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m@objective_see[0m[38;5;12m (https://twitter.com/objective_see)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m@0xAmit[0m[38;5;12m (https://twitter.com/0xAmit)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m@osxreverser[0m[38;5;12m (https://twitter.com/osxreverser)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m@liucoj[0m[38;5;12m (https://twitter.com/liucoj)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m@osxdaily[0m[38;5;12m (https://twitter.com/osxdaily)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m@iamevltwin[0m[38;5;12m (https://twitter.com/iamevltwin)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m@claud_xiao[0m[38;5;12m (https://twitter.com/claud_xiao)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m@JPoForenso[0m[38;5;12m (https://twitter.com/JPoForenso)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m@patrickolsen[0m[38;5;12m (https://twitter.com/patrickolsen)[39m

[38;2;255;187;0m[4mOther OSX Awesome lists[0m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mashishb/osx-and-ios-security-awesome[0m[38;5;12m (https://github.com/ashishb/osx-and-ios-security-awesome)[39m
