Macos Reverse

zhaoxuya520/reverse-skill/skills/macos-reverse

by zhaoxuya520cab634bd855fNo license40K starsListed Oct 9, 2026Updated Oct 9, 2026Repository updated 2 weeks ago

Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

Instructions onlySecurity
AI-generated overview

Guides authorized macOS and Mach-O reverse engineering, covering code signing, Objective-C/Swift recovery and malware triage.

What it does
This skill provides a workflow for reverse engineering macOS binaries and app bundles, including Mach-O executables, dylibs and frameworks. It walks through package and code-signing inspection, static analysis of symbols, strings and load commands, and dynamic analysis with lldb or Frida. It also points to a bundled Mach-O triage reference and related skills for iOS and malware analysis.
When to use it
Use it for authorized analysis of macOS or Mach-O targets such as app bundles, LaunchAgents or daemons. It fits tasks involving code signing, Hardened Runtime, Objective-C or Swift symbol recovery, and macOS malware triage.
Requirements
Requires macOS analysis tooling such as otool, nm, codesign, class-dump or dsdump, Hopper, Ghidra or IDA, Frida and lldb, plus the bundled reference file. No scripts are shipped; it is instructions only.

macOS / Mach-O Reverse Engineering

ACTION REQUIRED（读完后立刻执行）

  1. NOW: 读取 ../field-journal/precedent-reverse.md
  2. NOW: 确认目标为 macOS/Mach-O/App bundle（iOS IPA → mobile-reverse/）
  3. NEXT: tool-index；jtool2/lldb 等
  4. ACT: 签名与装载信息 → 静态 → 动态（lldb/Frida）

适用场景

  • Mach-O 可执行文件 / dylib / framework
  • .app bundle、LaunchAgent/Daemon
  • Objective-C / Swift 符号与 runtime
  • 公证/签名、Hardened Runtime、TCC 相关行为分析
  • macOS 恶意软件静态/动态分析（联合 malware-analysis）

工作流

1. 包体与签名

bash
file targetcodesign -dv --verbose=4 targetspctl -a -vv target 2>&1otool -L target

2. 静态

text
□ class-dump / swift-demangle / Hopper / Ghidra / IDA□ 字符串与 XPC 服务名、TCC 敏感 API□ LC_LOAD_dylib 依赖与 rpath

3. 动态

text
□ lldb / Frida□ fs_usage / log stream 观察□ 网络：联合 protocol-reverse 或代理

工具链

工具用途
otool / nm / codesign系统自带
Hopper / Ghidra / IDA反编译
class-dump / dsdumpObjC
Frida / lldb动态
jtool2Mach-O

参考

  • references/macho-triage.md
  • ../mobile-reverse/（iOS） ../ghidra-reverse/ ../malware-analysis/

路由上下文

上游: MASTER R31
下游: iOS → mobile-reverse；通用样本 → malware-analysis

任务完成自检

  • 是否记录签名/Hardened Runtime 状态？
  • 是否有地址级/符号级结论？
  • Checklist？

Source and attribution

Source:zhaoxuya520/reverse-skillinskills/macos-reverseat commitcab634b

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from zhaoxuya520/reverse-skill

Mobile Reverse

zhaoxuya520

Guides authorized Android and iOS app reverse engineering and security testing, from static analysis to runtime instrumentation.

Security40Kupdated 2 weeks ago

Dsl Vm Reverse

zhaoxuya520

Guides reverse engineering of JavaScript-based custom DSL/VM interpreters, opcode dispatchers and risk-control engines.

Security40Kupdated 2 weeks ago

Windows Ad

zhaoxuya520

Guides authorized Active Directory and Windows identity attack research, from enumeration to Kerberos, AD CS and relay paths.

Security40Kupdated 2 weeks ago

Thick Client

zhaoxuya520

Guides authorized security testing of desktop thick clients across local storage, IPC, traffic, and update channels.

Security40Kupdated 2 weeks ago

Threat Intelligence

zhaoxuya520

Guides authorized OSINT and cyber threat intelligence work, enriching IOCs and campaigns from public sources with corroboration and evidence handoff.

Security40Kupdated 2 weeks ago

Threat Hunting

zhaoxuya520

Guides blue-team threat hunting and detection engineering with hypotheses, SIEM queries, Sigma/YARA rules and validation.

Security40Kupdated 2 weeks ago

More in Security

Kyc Rules

anthropics

Featured

Applies a firm's KYC/AML rules grid to a parsed onboarding record, scoring risk and routing outcomes.

Security39Kupdated 2 weeks ago

Compliance Tracking

anthropics

Featured

Tracks compliance requirements, audit readiness, and evidence for frameworks such as SOC 2, ISO 27001, GDPR, HIPAA, and PCI DSS.

Security27Kupdated today

Dpop Adoption

google

Featured

Guides implementation of OAuth 2.0 DPoP (RFC 9449) sender-constrained refresh tokens for Google's OAuth platform.

Security21Kupdated today

Secops Triage

google

Featured

Guides SOC analysts through triaging Google SecOps security alerts, from investigation to closure or escalation.

Security21Kupdated today

Secops Investigate

google

Featured

Guides SOC analysts through deep security incident and entity investigations in Google SecOps using UDM queries and timelines.

Security21Kupdated today

Secops Hunt

google

Featured

Guides proactive threat hunting in Google SecOps using UDM queries, IoC lookback, prevalence and outlier analysis.

Security21Kupdated today
Macos Reverse · skills/macos-reverse Agent Skill | SourceWeft