cave_miner

CAVE MINER This tools search for code cave in binaries Elf, Mach-o, Pe, and inject code in them. Installation pip install cave-miner Usage Exemple...

goblin

libgoblin Documentation https://docs.rs/goblin/ changelog Usage Goblin requires rustc 1.85.0 Rust 2024 edition. Add to your Cargo.toml dependencies goblin = "0.10" Features awesome crate name zero-copy, cross-platform, endian-aware, ELF64/32 implementation - wow! zero-copy, cross-platform,...

retdec

Warning The RetDec project is currently in a limited maintenance mode due to a lack of resources: Pull Requests are welcomed. They are reviewed with priority, if possible without delays. Issues are reacted on with delays up to one quarter. Issues are not actively solved unless they relate to a...

rp

rp++: a fast ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries Overview rp++ or rp is a C++ ROP gadget finder for PE/ELF/Mach-O executables and x86/x64/ARM/ARM64 architectures. Finding ROP gadgets To find ROP gadget you need to specify a file with the --file / -f option and use the...

PongoOS

pongoOS A pre-boot execution environment for Apple boards built on top of checkra1n. Building on macOS Install Xcode + command-line utilities Run make all Building on Linux Install clang if in doubt, from apt.llvm.org Install ld64 and cctools' strip. On Debian/Ubuntu these can be installed from t...

machscope

machscope machscope is a terminal-native macOS explorer that turns processes, launchd jobs, Mach services, bundles, signatures, entitlements, and Mach-O linkage into one interrogable graph. It exists to answer a simple question brutally well: What is this process, service, binary, or bundle reall...

XMachOViewer

XMachOViewer Overview XMachOViewer is a Mach-O viewer for Windows, Linux, and macOS. Features Heuristic Scan : Automatically detect various characteristics and anomalies in Mach-O files. String Viewer : Display all readable strings within the Mach-O file. Hex Viewer : Inspect the raw hexadecimal...

machofile

machofile machofile is a module to parse Mach-O binary files, with a focus on malware analysis and reverse engineering. Inspired by Ero Carrera's pefile, this module aims to provide similar capabilities but for Mach-O binaries instead. Reference material and documentation used to gain the file...

CVE-2017-2370

0x00. Introduction This privilege escalation exploits a vulnerability in machvoucherextractattrrecipetrap, and the core of the exploitation method is through MACHMSGOOLPORTSDESCRIPTOR messages. Regarding machmsg ool, simply put, when sending an msg containing an ool descriptor, the kernel copies...

brokentooth

brokentooth POC for CVE-2018-4327 at least I think so since CVE-2018-4327 and CVE-2018-4330 were both discussed by @SparkZheng but it's not clear from him which one relates to which bug but since he described this one first I'm taking a guess. Tested on iPhone 6S 11.3.1 Should work until 11.4 Let...

ipsw-diffs

ipsw-diffs IPSW Diffs DIFFS Quick Nav: iOS 26.6 · iOS 27.2 beta · iOS 27.0 · iOS 27.0 beta · iOS 26.7 · iOS 26.6 beta · iOS 26.5 · iOS 26.5 beta · iOS 26.4 · iOS 26.4 beta · iOS 26.3 · iOS 26.3 beta · iOS 26.2 · iOS 26.1 beta · iOS 26.0 · iOS 26.0 beta · iOS 18.7 · iOS 18.6 · iOS 18.5 beta · iOS...

POC-CVE-2018-4327-and-CVE-2018-4330

brokentooth POC for CVE-2018-4327 atleast I think so since CVE-2018-4327 and CVE-2018-4330 were both written about by @SparkZheng but it does not say which once relates to which bug but since he described this one first then I'm taking a guess. Tested on iPhone 6S 11.3.1 Should work until 11.4...

mach_race

Mach Race OS X Local Privilege Escalation Exploit c fG! 2015, 2016, [email protected] - https://reverse.put.as A SUID, SIP, and binary entitlements universal OS X exploit CVE-2016-1757. Usage against a SUID binary: ./machraceserver /bin/ps compatmode for i in seq 0 1000000; do...

DylibHijackTest

DylibHijackTest Requirements Install Python3 requirements: pip3 install -r requirements.txt Compile dylib from source because don't trust compiled things from GitHub: gcc -dynamiclib DylibHijackTest.c -o DylibHijackTest.dylib How it Works ⚠️ This will spawn many processes on your machine, run this...

Look-at-The-XNU-Through-A-Tube-CVE-2018-4242-Write-up-Translation-

Look at The XNU Through A Tube CVE-2018-4242 Write-up Zhuo Liang of Qihoo 360 Nirvan Team Contents 1 Introduction 1 1.1 CVE-2018-4242 . . . . . . . . . . . . . . . . . . . . . . . . . 1 2 The XNU Kernel 2 2.1 System Call . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.2 MIG...

binviz

binviz Binary visualiser & triage tool: linked interactive views entropy, histograms, image/dot-plot surfaces, control-flow graphs over a single shared address-space model. pipx install binviz && binviz serve What it does Open a file and every view is looking at the same address space. Select a...

launchd-portrep

launchd-portrep launchd-portrep is an exploit for a port replacement vulnerability in launchd, the initial userspace process and service management daemon on macOS. By sending a crafted Mach message to the bootstrap port, launchd can be coerced into deallocating its send right for any Mach port t...

QuickHeal

QuickHeal CVE-2017-5005 for Quick Heal Antivirus Advisory Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the...

osx-re-101

osx & ios re 101 Work in progress as I am actively collecting these. Must read https://reverse.put.as/ https://blog.paloaltonetworks.com/tag/mac-os-x/ https://www.synack.com/blog/r-d-projects/os-x-security-research/ https://pewpewthespells.com/re.html https://github.com/bx/machO-tools...

dyen

dyen dyen loads a Mach-O dylib in memory using stock macOS Python and calls an exported entry point without dlopen on that dylib. The aim is that the image is never a standalone file on the target and is never registered with dyld. by cenobyte [email protected] 2026...