Skill · Security
Macos reverse
Authorized macOS and Mach-O reverse engineering: codesign inspection, Objective-C/Swift recovery, endpoint-security surfaces, and Apple-platform malware analysis.
How to use it
- Start your plan and connect your AI once
- Add the skill to your AI, one time only: press Copy skill and paste it into your AI's instructions: a project in ChatGPT, Claude or Grok, a Gem in Gemini, an agent in Microsoft 365 Copilot, or a rule in Cursor. It stays there for every new chat. In Kimi, paste it at the start of a new chat.
- Ask for the task in your own words, or say it directly:
Use the Macos reverse skill to help me with this.SKILL.md2 files in this skill
macOS / Mach-O Reverse Engineering
When to Use
- Analyzing macOS binaries or suspected malware samples.
- Inspecting entitlements, signatures, and ObjC/Swift structures.
适用场景
- Mach-O 可执行文件 / dylib / framework
- .app bundle、LaunchAgent/Daemon
- Objective-C / Swift 符号与 runtime
- 公证/签名、Hardened Runtime、TCC 相关行为分析
- macOS 恶意软件静态/动态分析（联合 malware-analysis）
工作流
1. 包体与签名
file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target2. 静态
□ class-dump / swift-demangle / Hopper / Ghidra / IDA
□ 字符串与 XPC 服务名、TCC 敏感 API
□ LC_LOAD_dylib 依赖与 rpath3. 动态
□ lldb / Frida
□ fs_usage / log stream 观察
□ 网络：联合 protocol-reverse 或代理工具链
| 工具 | 用途 |
|---|---|
| otool / nm / codesign | 系统自带 |
| Hopper / Ghidra / IDA | 反编译 |
| class-dump / dsdump | ObjC |
| Frida / lldb | 动态 |
| jtool2 | Mach-O |
参考
references/macho-triage.md../mobile-reverse/（iOS）../ghidra-reverse/../malware-analysis/
路由上下文
上游: MASTER R31 下游: iOS → mobile-reverse；通用样本 → malware-analysis
任务完成自检
- [ ] 是否记录签名/Hardened Runtime 状态？
- [ ] 是否有地址级/符号级结论？
- [ ] Checklist？
Limitations
- Apple Silicon and hardened runtime add unpacking complexity.
- Some analysis requires disabling SIP in a dedicated lab VM.
Adapted from zhaoxuya520/reverse-skill (MIT).