Skip to content

Instantly share code, notes, and snippets.

@knightsc
knightsc / inject.c
Last active March 19, 2024 01:14
An example of how to inject code to call dlopen and load a dylib into a remote mach task. Tested on 10.13.6 and 10.14.3
#include <dlfcn.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <mach/mach.h>
#include <mach/error.h>
#include <errno.h>
#include <stdlib.h>
#include <sys/sysctl.h>
#include <sys/mman.h>
@knightsc
knightsc / hijack.c
Created February 26, 2019 21:20
Example of how to hijack a thread on macOS to run code in a remote process
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <unistd.h>
#include <mach/mach.h>
#include <mach/mach_vm.h>
#include <dlfcn.h>
#include <objc/runtime.h>
@knightsc
knightsc / build-xnu-6153.11.26.sh
Created February 18, 2020 15:08
A script to build XNU version 6153.11.26 (macOS Catalina 10.15).
#! /bin/bash
#
# build-xnu-6153.11.26.sh
# Scott Knight
#
# Based on the script by Brandon Azad
# https://gist.github.com/bazad/654959120a423b226dc564073b435453
#
# A script showing how to build XNU version 6153.11.26 on macOS Catalina
# 10.15 with Xcode 11.13.1.
@knightsc
knightsc / gist:758783181e41a986fceea6901b8853e3
Created August 20, 2020 13:48
AKNativeAnisetteService.m
//
// AKNativeAnisetteService.m
// akd
//
// Created by Scott Knight on 5/10/19.
// Copyright © 2019 Scott Knight. All rights reserved.
//
#import <AuthKit/AuthKit.h>
#import "AKNativeAnisetteService.h"
//
// main.m
//
// Created by Scott Knight on 12/12/19.
// Copyright © 2019 Scott Knight. All rights reserved.
//
#import <Foundation/Foundation.h>
#import <os/log.h>
@knightsc
knightsc / spxpc.m
Created February 20, 2019 19:45
Example of how the Security.framework calls into `syspolicyd` for Gatekeeper functionality
#import <Foundation/Foundation.h>
#import <Security/Security.h>
#import <xpc/xpc.h>
#include <CoreFoundation/CoreFoundation.h>
#include <stdint.h>
typedef uint64_t SecAssessmentFlags;
enum {
kSecAssessmentDefaultFlags = 0, // default behavior
#include <spawn.h>
#include <string.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <mach/mach.h>
#define MACH_ERR(str, err) do { \
if (err != KERN_SUCCESS) { \
@knightsc
knightsc / psx.c
Last active April 17, 2022 01:04
Loops through all running processes and prints out ones that have had threads injected or hijacked
#include <stdio.h>
#include <stdlib.h>
#include <libproc.h>
#include <mach/mach.h>
bool
has_modifications(struct task_extmod_info *info)
{
if ((info->extmod_statistics.thread_creation_count > 0) ||
(info->extmod_statistics.thread_set_state_count > 0)) {
@knightsc
knightsc / ApplicationWhitelist.mobileconfig
Created June 29, 2021 15:26
macOS example profile to whitelist application which in turn makes use of mcxalr.kext
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>Parental Controls: Application Access #1</string>
<key>PayloadIdentifier</key>
#include <errno.h>
#include <pthread.h>
#include <signal.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/kern_control.h>