mcpField
M
macos-reverse

macos-reverse

github.com/zhaoxuya520Security43.7k1.2k installsUpdated 5w ago
Repository

About macos-reverse

A macOS and Mach-O reverse-engineering skill for security researchers examining executables, app bundles, and related components. It organizes analysis around signing and loading details, static inspection, and dynamic debugging, including Objective-C, Swift, and platform security behavior.

Key features

  1. 01Inspect signatures and loading details
  2. 02Review Mach-O dependencies and rpaths
  3. 03Examine Objective-C and Swift symbols
  4. 04Use lldb or Frida for dynamic analysis
  5. 05Assess notarization, Hardened Runtime, and TCC

Use cases

  1. 01Analyze macOS malware
  2. 02Inspect .app bundles, LaunchAgents, or dylibs
  3. 03Investigate use of TCC-sensitive APIs
  4. 04Trace process, file, and network behavior

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/zhaoxuya520/reverse-skill --skill macos-reverse

After installing, type/macos-reversein Claude Code to confirm it loaded.

Bundled filesreferences/macho-triage.md

Details

From the project README

macOS / Mach-O Reverse Engineering

ACTION REQUIRED（读完后立刻执行）

  1. NOW: 读取 ../field-journal/precedent-reverse.md
  2. NOW: 确认目标为 macOS/Mach-O/App bundle（iOS IPA → mobile-reverse/）
  3. NEXT: tool-index；jtool2/lldb 等
  4. ACT: 签名与装载信息 → 静态 → 动态（lldb/Frida）

适用场景

  • Mach-O 可执行文件 / dylib / framework
  • .app bundle、LaunchAgent/Daemon
  • Objective-C / Swift 符号与 runtime
  • 公证/签名、Hardened Runtime、TCC 相关行为分析
  • macOS 恶意软件静态/动态分析（联合 malware-analysis）

工作流

1. 包体与签名
file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target
2. 静态
□ class-dump / swift-demangle / Hopper / Ghidra / IDA
□ 字符串与 XPC 服务名、TCC 敏感 API
□ LC_LOAD_dylib 依赖与 rpath
3. 动态
□ lldb / Frida
□ fs_usage / log stream 观察
□ 网络：联合 protocol-reverse 或代理

工具链

工具用途
otool / nm / codesign系统自带
Hopper / Ghidra / IDA反编译
class-dump / dsdumpObjC
Frida / lldb动态
jtool2Mach-O

参考

  • references/macho-triage.md
  • ../mobile-reverse/（iOS） ../ghidra-reverse/ ../malware-analysis/

路由上下文

上游: MASTER R31
下游: iOS → mobile-reverse；通用样本 → malware-analysis

任务完成自检

  • 是否记录签名/Hardened Runtime 状态？
  • 是否有地址级/符号级结论？
  • Checklist？

Comments

Markdown supported