Snake & Apple

This is the code repository for the "Snake & Apple" article series, which documents my research on macOS security. The primary tool developed during the creation of the series is called CrimsonUroboros. You can find its description, along with instructions for other tools in this repository, in Tools.md.

ARTICLES

I have been writing about Apple Security across different platforms for years, compiling them in this repository. Below is a brief explanation of the links you will find:

• I am currently writing on Patreon, where most articles are free to read—no account needed. The same goes for my pieces on the AFINE blog.
• In 2024, I wrote only on Medium. Those articles are paywalled, but thanks to Monethic's sponsorship, you can find direct links in this repository. No Medium account is required.
• If those links ever break, ping me on social media or Patreon for a fresh one. If you're feeling generous, the Patron subscription gets you PDF versions of all the Medium articles.
• I'm also working on exclusive content for Elite Patrons—my "thank-you" to the folks who support me. These are marked with a *. It's a kind of self-paced academy for vulnerability researchers. Every month, you get a new guide with technical analyses of real vulnerabilities and methods to find them, along with video demos, custom tools, and practical homework.

---

Each main article directory contains three subdirectories:

• mac - source code of macOS for references and copy of presentations.
• custom - code, for example, programs written for articles.
• python - contains the latest CrimsonUroboros and other Python scripts created during research.

---

The short introduction is written in Snake&Apple Intro
The tags for each article are in the Article_tags.md.
The table of contents showing links to all articles is below:

• ☑ App Bundle Extension

  • ☑ Cracking macOS apps
  • ☑ Cracking Electron Integrity
  • ☑ XPC Programming on macOS
  • ☑ AppleScript for Vulnerability Research *
  • ☑ LLDB for Vulnerability Research *
  • ☑ Scaling Vulnerability Discovery on macOS *
  • ☑ Applications Patch Diffing on macOS *

• ☑ I. Mach-O

  • ☑ Optimizing Mach-O Detection
  • ☑ Static Analysis on Decompiled Code *

• ☑ II. Code Signing

  • ☑ To allow or not to get-task-allow, that is the question

• ☑ III. Checksec

• ☑ IV. Dylibs

  • ☑ Breaking Hardened Runtime: The 0-Day Microsoft Delivered to macOS

• ☑ V. Dyld

  • ☑ DYLD — Do You Like Death? (I)
  • ☑ DYLD — Do You Like Death? (II)
  • ☑ DYLD — Do You Like Death? (III)
  • ☑ DYLD — Do You Like Death? (IV)
  • ☑ DYLD — Do You Like Death? (V)
  • ☑ DYLD — Do You Like Death? (VI)
  • ☑ DYLD — Do You Like Death? (VII)
  • ☑ DYLD — Do You Like Death? (VIII)
  • ☑ DYLD — Do You Like Death? (IX)
  • ☑ DYLD — Do You Like Death? (X)
  • ☑ DYLD — Do You Like Death? (XI)

• ☑ VI. AMFI

  • ☑ Unexpected but expected behavior

• ☑ VII. Antivirus

  • ☑ Apple Gatekeeper Bypass

• ☑ VIII. Sandbox

  • ☑ SBPL Compilator
  • ☑ Sandbox Detector
  • ☑ Sandbox Validator
  • ☑ App Sandbox startup
  • ☑ System Integrity Protection

• ☑ IX. TCC

  • ☑ Apple UUID Finder
  • ☑ Threat of TCC Bypasses on macOS
  • ☑ TCC Bypass in Visual Studio Code via misconfigured Node fuses
  • ☑ Reverse Engineering Apple’s TCC Daemon: When Decompiled Code Lies

• ☑ X. NU

  • ☑ Kernel Debugging Setup on MacOS
  • ☑ Fixing an Infinite Loop
  • ☑ Exceptions on macOS
  • ☑ MACF on macOS
  • ☑ Kernel Extensions on macOS
  • ☑ Mach IPC Security on macOS
    • ☑ Task Injection on macOS
  • ☑ Drivers on macOS
    • ☑ Case Study: Analyzing macOS IONVMeFamily NS_01 Driver Denial of Service Issue
    • ☑ Case Study: IOMobileFramebuffer NULL Pointer Dereference
    • ☑ A mouse move that crashed the system – Stack Buffer Overflow in Display Driver on macOS
    • ☑ Mapping IOKit Methods Exposed to User Space on macOS #PHRACK 💀
  • ☑ SLAP & FLOP: Apple Silicon’s Data Speculation Vulnerabilities
  • ☑ History of NULL Pointer Dereferences on macOS

• ☐ Apple Intelligence

  • ☑ AI-Enhanced Vulnerability Research *

PATRONS