osx & ios re 101

正在进行中，我在积极收集这些资源。

必读

• https://reverse.put.as/
• https://blog.paloaltonetworks.com/tag/mac-os-x/
• https://www.synack.com/blog/r-d-projects/os-x-security-research/
• https://pewpewthespells.com/re.html
• https://github.com/bx/machO-tools
• https://github.com/kpwn/iOSRE

随时备查

• "OSX Mach-O 文件格式参考" https://pewpewthespells.com/re/Mach-O_File_Format.pdf
• "OSX ABI 函数调用规范" https://pewpewthespells.com/re/Mac_OS_X_ABI_Function_Calls.pdf
• Mach-O 结构定义 https://opensource.apple.com/source/xnu/xnu-2050.18.24/EXTERNAL_HEADERS/mach-o/loader.h
• "OSX BSD 系统调用" https://sigsegv.pl/osx-bsd-syscalls/
• https://opensource.apple.com/source/xnu/xnu-2050.18.24/bsd/kern/syscalls.master

基础知识

• "通用二进制：Mach-O 文件格式" https://cocoaintheshell.whine.fr/2009/07/universal-binary-mach-o-format/
• "Mach-O 文件格式基础" https://samhuri.net/posts/2010/01/basics-of-the-mach-o-file-format/
• "OS X 如何执行应用程序" http://0xfe.blogspot.de/2006/03/how-os-x-executes-applications.html
• "感染 Mach-O 目标文件格式" https://papers.put.as/papers/macosx/2005/mach-o_infection.ppt
• "深入 iHood" https://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-hotchkies.pdf
• "最小 Intel 32 位 204 字节 Mach-O "Hello World" 可执行文件剖析" http://seriot.ch/hello_macho.php
• "制作微型 Mach-O 可执行文件" http://osxbook.com/blog/2009/03/15/crafting-a-tiny-mach-o-executable/
• "解析 Mach-O 文件" http://lowlevelbits.org/parse-mach-o-files/
• "ELF 与 Mach-O 对比" http://timetobleed.com/dynamic-linking-elf-vs-mach-o/
• "ELF 与 Mach-O 对比 2" http://timetobleed.com/dynamic-symbol-table-duel-elf-vs-mach-o-round-2/
• "用于 x86 和 x86_64 Intel Mac OS X 的 NASM Hello World" https://gist.github.com/FiloSottile/7125822
• "逆向操作系统：实用指南" https://www.youtube.com/watch?v=uQWH55yIgYU

恶意软件、反调试、感染技术、混淆与加密

• "感染 Mach-O" http://nicolascormier.com/documentation/security/Infecting_Mach-O_Files.pdf
• "滥用 Mach-O 格式" http://cocoaintheshell.com/2009/10/abusing-mach-o
• "跨平台病毒轻松制作 - 案例分析" http://vxer.org/lib/vjp00.html
• "从内存中运行 macOS 可执行文件" https://blog.cylance.com/running-executables-on-macos-from-memory
• macos_execute_from_memory https://github.com/prsecurity/macos_execute_from_memory/blob/master/main.c
• "理解苹果在 Mac OS X 中的二进制保护机制" http://osxbook.com/book/bonus/chapter7/binaryprotection/
• "Mac 也会生病" http://www.irongeek.com/i.php?page=videos/derbycon6/104-macs-get-sick-too-tyler-halfpop-jacob-soo
• "iOS 恶意软件窥探" http://webdiis.unizar.es/~ricardo/files/papers/GR-WMA-16.pdf
• "制作 macOS Rootkit" https://www.zdziarski.com/blog/wp-content/uploads/2017/02/Crafting-macOS-Root-Kits.pdf
• "重新审视 Mac OS X 内核 Rootkit" http://phrack.org/issues/69/7.html#article
• "Mac OS X 恶意软件持久化方法" https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
• "开始吧：实用 OS X 恶意软件检测与分析" https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf

各类研究与教程

• "逆向和注册机分析 qwertyoruiop 的 Crackme" https://reverse.put.as/2018/10/06/reversing-and-keygenning-qwertyoruiop-crackme/
• "破解教程 #1 - "Sandwich" CrackMe" http://reverse.put.as/wp-content/uploads/2012/06/Sandwich_crackme_tut_qwertyoruiop.txt
• "使用 LDPRELOAD 破解 crackme" http://radare.today/solving-crackmes-with-ldpreload/
• "使用 Hopper 反编译器分析二进制文件" http://abad1dea.tumblr.com/post/23487860422/analyzing-binaries-with-hoppers-decompiler
• "逆向工程 Hopper Disassembler v3.9.9" https://www.youtube.com/watch?v=pCITcLqgS9Q
• "逆向 iOS 应用：破解 Lyft" https://realm.io/news/conrad-kramer-reverse-engineering-ios-apps-lyft/
• "越狱 iOS 8.1.2 并分析相关漏洞利用" http://proteaswang.blogspot.com/2017/04/jailbreak-ios-812-and-analyze-related.html
• "攻击 El Capitan 中的 XNU 内核" https://www.blackhat.com/docs/eu-15/materials/eu-15-Todesco-Attacking-The-XNU-Kernal-In-El-Capitain.pdf
• "像狙击手一样射击 OSX El Capitan 内核" https://speakerdeck.com/flankerhqd/shooting-the-osx-el-capitan-kernel-like-a-sniper
• "意大利白痴又回来了！这次他们在搞什么？" https://reverse.put.as/2016/02/29/the-italian-morons-are-back-what-are-they-up-to-this-time/
• "通过单个漏洞实现完整 OSX 权限提升的旅程 - 第 1 部分" http://keenlab.tencent.com/en/2016/07/29/The-Journey-of-a-complete-OSX-privilege-escalation-with-a-single-vulnerability-Part-1/
• "iOS 10 内核堆回顾" http://gsec.hitb.org/materials/sg2016/D2%20-%20Stefan%20Esser%20-%20iOS%2010%20Kernel%20Heap%20Revisited.pdf
• "谁还需要解密的内核呢？" http://blog.offcellresearch.com/security/apple/ios/kernel/2016/08/23/who-needs-decrypted-kernels-anyways.html
• "Mac OS X 通过 Use-After-Free 提权：CVE-2016-1828" https://bazad.github.io/2016/05/mac-os-x-use-after-free/
• "PEGASUS iOS 内核漏洞详解" http://sektioneins.de/en/blog/16-09-02-pegasus-ios-kernel-vulnerability-explained.html
• "与 iOS 安全一起幕后揭秘" https://www.blackhat.com/docs/us-16/materials/us-16-Krstic.pdf
• "Apple 沙盒：深入泥潭" https://www.youtube.com/watch?v=mG715HcDgO8
• "深入探讨 OS X 上可用的多种 IPC 形式" https://vimeo.com/127859750
• "iOS 9.3.3 越狱分析及 iOS 10 安全增强" http://powerofcommunity.net/poc2016/pangu.pdf
• "炸苹果：越狱 DIY" https://speakerdeck.com/mbazaliy/fried-apples-jailbreak-diy
• "逆向 macOS 内核扩展" (DSMOS) http://lightbulbone.com/2016/10/04/intro-to-macos-kernel-debugging.html
• "揭秘安全隔区处理器" http://mista.nu/research/sep-paper.pdf
• "利用苹果游戏引擎检测 macOS 威胁" https://objectivebythesea.com/v1/talks/OBTS_v1_Malm_Stein.pdf
• "熟悉 OpenBSM 审计" https://objective-see.com/talks/Wardle_ShmooCon2018.pdf
• "使用 OpenBSM 在 macOS 上实时审计" https://meliot.me/2017/07/02/mac-os-real-time-auditing/

内核扩展 (KEXT) 开发

• "KEXT 控制与通知" https://developer.apple.com/library/content/documentation/Darwin/Conceptual/NKEConceptual/control/control.html
• "网络内核扩展参考" https://developer.apple.com/library/content/documentation/Darwin/Conceptual/NKEConceptual/reference/reference.html#//apple_ref/doc/uid/TP40001858-CH232-BBAGGGED
• "在 Mac OS X 中使用 TrustedBSD" https://sysdev.me/trusted-bsd-in-osx/
• "使用 CMAKE 构建 Apple OSX 内核模块 – C/C" http://www.goodbits.ca/index.php/2017/09/25/building-an-apple-osx-kernel-module-with-cmake-cc/
• "使用 VirtualBox 调试 macOS 内核" https://klue.github.io/blog/2017/04/macos_kernel_debugging_vbox/
• "远程 Kext 调试" https://rednaga.io/2017/04/09/remote_kext_debugging/
• "macOS 内核调试入门" https://lightbulbone.com/posts/2016/10/intro-to-macos-kernel-debugging/
• "使用 LLDB 和 VMWare Fusion 进行内核调试" http://ddeville.me/2015/08/kernel-debugging-with-lldb-and-vmware-fusion
• "通过内核监控进程创建 (第一部分)" https://objective-see.com/blog.html#blogEntry9
• "通过内核监控进程创建 (第二部分)" https://objective-see.com/blog/blog_0x0A.html
• "通过内核监控进程创建 (第三部分)" https://objective-see.com/blog/blog_0x0B.html
• "监控 macOS，第一部分：通过 MACF 监控进程执行" https://www.fortinet.com/blog/threat-research/monitoring-macos--part-i--monitoring-process-execution-via-macf.html
• "监控 macOS，第二部分：通过 MACF 监控文件系统事件和 Dylib 加载" https://www.fortinet.com/blog/threat-research/monitor-file-system-events-and-dylib-loading-via-macf-on-macos.html
• "监控 macOS，第三部分：使用 Socket 过滤器监控网络活动" https://www.fortinet.com/blog/threat-research/monitoring-macos--part-iii--monitoring-network-activities-using-.html
• "Mac OS X 的二进制白名单/黑名单系统" https://github.com/google/santa