osx & ios re 101

현재 적극적으로 수집 중이므로 진행 중인 작업입니다.

필독

• https://reverse.put.as/
• https://blog.paloaltonetworks.com/tag/mac-os-x/
• https://www.synack.com/blog/r-d-projects/os-x-security-research/
• https://pewpewthespells.com/re.html
• https://github.com/bx/machO-tools
• https://github.com/kpwn/iOSRE

참고 자료

• "OSX Mach-O File Format Reference" https://pewpewthespells.com/re/Mach-O_File_Format.pdf
• "OSX ABI" https://pewpewthespells.com/re/Mac_OS_X_ABI_Function_Calls.pdf
• Mach-O 구조 https://opensource.apple.com/source/xnu/xnu-2050.18.24/EXTERNAL_HEADERS/mach-o/loader.h
• "OSX BSD 시스템 호출" https://sigsegv.pl/osx-bsd-syscalls/
• https://opensource.apple.com/source/xnu/xnu-2050.18.24/bsd/kern/syscalls.master

기초

• "Universal Binary: Mach-O 파일 형식" https://cocoaintheshell.whine.fr/2009/07/universal-binary-mach-o-format/
• "Mach-O 파일 형식 기초" https://samhuri.net/posts/2010/01/basics-of-the-mach-o-file-format/
• "OS X가 애플리케이션을 실행하는 방법" http://0xfe.blogspot.de/2006/03/how-os-x-executes-applications.html
• "Mach-O 오브젝트 형식 감염" https://papers.put.as/papers/macosx/2005/mach-o_infection.ppt
• "Under the iHood" https://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-hotchkies.pdf
• "최소 Intel 32비트, 204바이트, Mach-O "Hello World" 실행 파일 해부" http://seriot.ch/hello_macho.php
• "작은 Mach-O 실행 파일 만들기" http://osxbook.com/blog/2009/03/15/crafting-a-tiny-mach-o-executable/
• "Mach-O 파일 파싱" http://lowlevelbits.org/parse-mach-o-files/
• "ELF vs. Mach-O" http://timetobleed.com/dynamic-linking-elf-vs-mach-o/
• "ELF vs. Mach-O 2" http://timetobleed.com/dynamic-symbol-table-duel-elf-vs-mach-o-round-2/
• "x86 및 x86_64 Intel Mac OS X용 NASM Hello World" https://gist.github.com/FiloSottile/7125822
• "OS 리버스 엔지니어링: 실용 가이드" https://www.youtube.com/watch?v=uQWH55yIgYU

악성코드, 안티-디버깅, 감염 기술, 난독화 및 암호화

• "Mach-O 감염" http://nicolascormier.com/documentation/security/Infecting_Mach-O_Files.pdf
• "Mach-O 형식 남용" http://cocoaintheshell.com/2009/10/abusing-mach-o
• "멀티플랫폼 바이러스 쉽게 만들기 - 사례 연구" http://vxer.org/lib/vjp00.html
• "macOS에서 메모리로 실행 파일 실행" https://blog.cylance.com/running-executables-on-macos-from-memory
• macos_execute_from_memory https://github.com/prsecurity/macos_execute_from_memory/blob/master/main.c
• "Mac OS X에서 Apple 바이너리 보호 이해" http://osxbook.com/book/bonus/chapter7/binaryprotection/
• "Mac도 아플 수 있습니다" http://www.irongeek.com/i.php?page=videos/derbycon6/104-macs-get-sick-too-tyler-halfpop-jacob-soo
• "iOS 악성코드 내부 엿보기" http://webdiis.unizar.es/~ricardo/files/papers/GR-WMA-16.pdf
• "macOS 루트킷 제작" https://www.zdziarski.com/blog/wp-content/uploads/2017/02/Crafting-macOS-Root-Kits.pdf
• "Mac OS X 커널 루트킷 재고찰" http://phrack.org/issues/69/7.html#article
• "Mac OS X에서 악성코드 지속성 방법" https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
• "실전: OS X 악성코드 탐지 및 분석" https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf

다양한 연구 및 튜토리얼

• "qwertyoruiop의 크랙미 리버싱 및 키젠 만들기" https://reverse.put.as/2018/10/06/reversing-and-keygenning-qwertyoruiop-crackme/
• "크래킹 튜토리얼 #1 - "Sandwich" CrackMe" http://reverse.put.as/wp-content/uploads/2012/06/Sandwich_crackme_tut_qwertyoruiop.txt
• "LDPRELOAD를 사용한 크랙미 해결" http://radare.today/solving-crackmes-with-ldpreload/
• "Hopper 디컴파일러로 바이너리 분석" http://abad1dea.tumblr.com/post/23487860422/analyzing-binaries-with-hoppers-decompiler
• "Hopper Disassembler v3.9.9 리버스 엔지니어링" https://www.youtube.com/watch?v=pCITcLqgS9Q
• "iOS 앱 리버스 엔지니어링: Lyft 해킹" https://realm.io/news/conrad-kramer-reverse-engineering-ios-apps-lyft/
• "iOS 8.1.2 탈옥 및 관련 익스플로잇 분석" http://proteaswang.blogspot.com/2017/04/jailbreak-ios-812-and-analyze-related.html
• "El Capitan에서 XNU 커널 공격" https://www.blackhat.com/docs/eu-15/materials/eu-15-Todesco-Attacking-The-XNU-Kernal-In-El-Capitain.pdf
• "저격수처럼 OSX El Capitan 커널 사격하기" https://speakerdeck.com/flankerhqd/shooting-the-osx-el-capitan-kernel-like-a-snipper
• "이탈리아 멍청이들이 돌아왔다! 이번엔 뭘 꾸미고 있을까?" https://reverse.put.as/2016/02/29/the-italian-morons-are-back-what-are-they-up-to-this-time/
• "단일 취약점으로 완전한 OSX 권한 상승 여정 - 1부" http://keenlab.tencent.com/en/2016/07/29/The-Journey-of-a-complete-OSX-privilege-escalation-with-a-single-vulnerability-Part-1/
• "iOS 10 커널 힙 재검토" http://gsec.hitb.org/materials/sg2016/D2%20-%20Stefan%20Esser%20-%20iOS%2010%20Kernel%20Heap%20Revisited.pdf

커널 익스텐션 (KEXT) 개발

• "KEXT 컨트롤 및 알림" https://developer.apple.com/library/content/documentation/Darwin/Conceptual/NKEConceptual/control/control.html
• "네트워크 커널 익스텐션 참조" https://developer.apple.com/library/content/documentation/Darwin/Conceptual/NKEConceptual/reference/reference.html#//apple_ref/doc/uid/TP40001858-CH232-BBAGGGED
• "Mac OS X에서 TrustedBSD 사용하기" https://sysdev.me/trusted-bsd-in-osx/
• "CMAKE를 사용한 Apple OSX 커널 모듈 빌드 – C/C++" http://www.goodbits.ca/index.php/2017/09/25/building-an-apple-osx-kernel-module-with-cmake-cc/
• "VirtualBox를 사용한 macOS 커널 디버깅" https://klue.github.io/blog/2017/04/macos_kernel_debugging_vbox/
• "원격 KEXT 디버깅" https://rednaga.io/2017/04/09/remote_kext_debugging/
• "macOS 커널 디버깅 입문" https://lightbulbone.com/posts/2016/10/intro-to-macos-kernel-debugging/
• "LLDB 및 VMWare Fusion을 사용한 커널 디버깅" http://ddeville.me/2015/08/kernel-debugging-with-lldb-and-vmware-fusion
• "커널을 통한 프로세스 생성 모니터링 (1부)" https://objective-see.com/blog.html#blogEntry9
• "커널을 통한 프로세스 생성 모니터링 (2부)" https://objective-see.com/blog/blog_0x0A.html
• "커널을 통한 프로세스 생성 모니터링 (3부)" https://objective-see.com/blog/blog_0x0B.html
• "macOS 모니터링, 1부: MACF를 통한 프로세스 실행 모니터링" https://www.fortinet.com/blog/threat-research/monitoring-macos--part-i--monitoring-process-execution-via-macf.html
• "macOS 모니터링, 2부: MACF를 통한 파일 시스템 이벤트 및 Dylib 로딩 모니터링" https://www.fortinet.com/blog/threat-research/monitor-file-system-events-and-dylib-loading-via-macf-on-macos.html

기타

• "Python이 사과를 물다 - OSX 커널 버그 퍼징 및 익스플로잇" https://speakerdeck.com/flankerhqd/the-python-bites-your-apple-fuzzing-and-exploiting-osx-kernel-bugs
• "Mac OS X용 아티팩트 및 팁" http://sud0man.blogspot.fr/2015/05/artefacts-for-mac-os-x.html?m=1
• "Mac OS X 및 iOS용 법의학 아티팩트 위치 모음" https://github.com/pstirparo/mac4n6
• "새로운 macOS Sierra (10.12) 법의학 아티팩트 – 통합 로깅 소개" https://www.mac4n6.com/blog/2016/11/13/new-macos-sierra-1012-forensic-artifacts-introducing-unified-logging
• "OS X 전용 셸 명령 및 도구 선별 목록" https://github.com/herrbischoff/awesome-osx-command-line
• "OS X 보안 및 프라이버시 가이드" https://github.com/drduh/OS-X-Security-and-Privacy-Guide
• "launchd 튜토리얼" http://launchd.info/
• https://objective-see.com/index.html
• "OS X malloc 인트로스펙션 도구" https://github.com/blankwall/MacHeap
• "MacOS 강화 가이드" http://newosxbook.com/files/moxii3/AppendixA.pdf by Jonathan Levin
• "Checkout4Mac" http://sud0man.blogspot.sk/2016/10/new-version-of-checkout4mac-02.html
• "OSX 커널 퍼저" https://github.com/SilverMoonSecurity/PassiveFuzzFrameworkOSX
• "탈옥 없는 iOS 계측" https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2016/october/ios-instrumentation-without-jailbreak/
• "오픈소스 방식의 MacOS 모니터링" https://blogs.dropbox.com/tech/2018/04/4696/
• "Mac OS X El Capitan (10.11) 및 task_for_pid()"

크랙미 및 챌린지

• https://reverse.put.as/crackmes/
• http://beginners.re/Reverse_Engineering_for_Beginners-en.pdf의 "연습 문제" 섹션

서적

• "The Mac Hacker's Handbook" by Charlie Miller, Dino Dai Zovi
• "Mac OS X and iOS Internals: To the Apple's Core" by Jonathan Levin
• "Mac OS X Internals: A Systems Approach" by Amit Singh
• "iOS App Reverse Engineering" https://github.com/iosre/iOSAppReverseEngineering
• "iOS Hacker's Handbook" by Charlie Miller, Dion Blazakis, Dino Dai Zovi, Stefan Esser, Vincenzo Iozzo, Ralf-Philip Weinmann
• "Hacking and Securing iOS Applications" by Jonathan Zdziarski