machscope

MachScope A native macOS binary analysis tool providing Mach-O parsing, ARM64 disassembly, and process debugging. Built entirely in Swift with zero external dependencies. Features...

PongoOS

pongoOS A pre-boot execution environment for Apple boards built on top of checkra1n. Building on macOS Install Xcode + command-line utilities Run make all Building on Linux Install clang if in doubt, from apt.llvm.org Install ld64 and cctools' strip. On Debian/Ubuntu these can be installed from t...

goblin

libgoblin Documentation https://docs.rs/goblin/ changelog Usage Goblin requires rustc 1.85.0 Rust 2024 edition. Add to your Cargo.toml root@kitploit: dependencies goblin = "0.10" Features awesome crate name zero-copy, cross-platform, endian-aware, ELF64/32 implementation - wow! zero-copy,...

XMachOViewer

XMachOViewer Overview XMachOViewer is a Mach-O viewer for Windows, Linux, and macOS. Features Heuristic Scan : Automatically detect various characteristics and anomalies in Mach-O files. String Viewer : Display all readable strings within the Mach-O file. Hex Viewer : Inspect the raw hexadecimal...

cave_miner

CAVE MINER This tools search for code cave in binaries Elf, Mach-o, Pe, and inject code in them. Installation root@kitploit: pip install cave-miner Usage Exemple...

retdec

Warning The RetDec project is currently in a limited maintenance mode due to a lack of resources: Pull Requests are welcomed. They are reviewed with priority, if possible without delays. Issues are reacted on with delays up to one quarter. Issues are not actively solved unless they relate to a...

osx-re-101

osx & ios re 101 Work in progress as I am actively collecting these. Must read https://reverse.put.as/ https://blog.paloaltonetworks.com/tag/mac-os-x/ https://www.synack.com/blog/r-d-projects/os-x-security-research/ https://pewpewthespells.com/re.html https://github.com/bx/machO-tools...

ipsw

ipsw iOS/macOS Research Swiss Army Knife ipsw is a command-line toolkit for Apple firmware research and reverse engineering. Download and unpack IPSWs and OTAs, inspect Mach-O binaries and dyld shared caches, analyze kernelcaches, and work with connected iOS devices. Agent skill · Install · CLI...

machofile

machofile machofile is a module to parse Mach-O binary files, with a focus on malware analysis and reverse engineering. Inspired by Ero Carrera's pefile, this module aims to provide similar capabilities but for Mach-O binaries instead. Reference material and documentation used to gain the file...

ios-malicious-bithunter

iOS Malicious Bit Hunter Resumen iOS Malicious Bit Hunter es un motor de detección de complementos maliciosos para aplicaciones iOS. Puede analizar el encabezado del archivo macho de la biblioteca dinámica dylib inyectada basándose en el tiempo de ejecución, y puede realizar análisis de...

QuickHeal

QuickHeal CVE-2017-5005 for Quick Heal Antivirus Advisory Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the...

rp

rp++: a fast ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries Overview rp++ or rp is a C++ ROP gadget finder for PE/ELF/Mach-O executables and x86/x64/ARM/ARM64 architectures. Finding ROP gadgets To find ROP gadget you need to specify a file with the --file / -f option and use the...

rp

rp++: un buscador rápido de gadgets ROP para binarios PE/ELF/Mach-O x86/x64/ARM/ARM64 Descripción general rp++ o rp es un buscador de gadgets ROP en C++ para ejecutables PE/ELF/Mach-O y arquitecturas x86/x64/ARM/ARM64. Encontrar gadgets ROP Para encontrar un gadget ROP debes especificar un archiv...

class-dump

class-dump class-dump is a command-line utility for examining the Objective-C segment of Mach-O files. It generates declarations for the classes, categories and protocols. This is the same information provided by using 'otool -ov', but presented as normal Objective-C declarations. The latest...

DylibHijackTest

DylibHijackTest Requirements Install Python3 requirements: pip3 install -r requirements.txt Compile dylib from source because don't trust compiled things from GitHub: gcc -dynamiclib DylibHijackTest.c -o DylibHijackTest.dylib How it Works ⚠️ This will spawn many processes on your machine, run this...

binviz

binviz Binary visualiser & triage tool: linked interactive views entropy, histograms, image/dot-plot surfaces, control-flow graphs over a single shared address-space model. root@kitploit: pipx install binviz && binviz serve What it does Open a file and every view is looking at the same address...

dyen

dyen dyen loads a Mach-O dylib in memory using stock macOS Python and calls an exported entry point without dlopen on that dylib. The aim is that the image is never a standalone file on the target and is never registered with dyld. by cenobyte [email protected] 2026...

Linux Distros Unpatched Vulnerability : CVE-2026-81881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable becau...

Linux Distros Unpatched Vulnerability : CVE-2026-81884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LCDATAINCODE parser was vulnerable because the...

SUSE CVE-2026-81884

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LCDATAINCODE parser was vulnerable because the Mach-O LCDATAINCODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered...