Skip to content

Instantly share code, notes, and snippets.

@knightsc
knightsc / inject.c
Last active Sep 9, 2021
An example of how to inject code to call dlopen and load a dylib into a remote mach task. Tested on 10.13.6 and 10.14.3
View inject.c
#include <dlfcn.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <mach/mach.h>
#include <mach/error.h>
#include <errno.h>
#include <stdlib.h>
#include <sys/sysctl.h>
#include <sys/mman.h>
@knightsc
knightsc / hijack.c
Created Feb 26, 2019
Example of how to hijack a thread on macOS to run code in a remote process
View hijack.c
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <unistd.h>
#include <mach/mach.h>
#include <mach/mach_vm.h>
#include <dlfcn.h>
#include <objc/runtime.h>
View kexts.graphml
<?xml version="1.0" encoding="UTF-8"?>
<graphml xmlns="http://graphml.graphdrawing.org/xmlns">
<graph id="G" edgedefault="undirected">
<node id="Kernel"/>
<node id="AppleEmbeddedOSSupportHost"/>
<node id="AppleSMCLMU"/>
<node id="AppleIntelLpssSpiController"/>
<node id="IOSkywalkFamily"/>
<node id="BridgeAudioCommunication"/>
<node id="ntfs"/>
View gist:758783181e41a986fceea6901b8853e3
//
// AKNativeAnisetteService.m
// akd
//
// Created by Scott Knight on 5/10/19.
// Copyright © 2019 Scott Knight. All rights reserved.
//
#import <AuthKit/AuthKit.h>
#import "AKNativeAnisetteService.h"
@knightsc
knightsc / execve.log
Created Jun 29, 2021
dtrace log of execve call with all MACF kexts running
View execve.log
This file has been truncated, but you can view the full file.
CPU FUNCTION
3 -> execve ffffff802b71b320 ffffff802f6e39b8 ffffff802f6e39f8
3 -> __mac_execve ffffff802b71b320 ffffff80b1a7be68 ffffff802f6e39f8
3 -> kauth_cred_proc_ref ffffff802b71b320 ffffff80b1a7be68 ffffff802f6e39f8
3 <- kauth_cred_proc_ref 4f ffffff802ee1bc70 0
3 -> __MALLOC 690 50 4
3 -> kalloc_canblock ffffff80b1a7bd90 1 ffffff801f07d598
3 -> gzalloc_alloc ffffff801f0a5b20 1 0
3 <- gzalloc_alloc 5c 0 0
@knightsc
knightsc / ApplicationWhitelist.mobileconfig
Created Jun 29, 2021
macOS example profile to whitelist application which in turn makes use of mcxalr.kext
View ApplicationWhitelist.mobileconfig
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>Parental Controls: Application Access #1</string>
<key>PayloadIdentifier</key>
@knightsc
knightsc / debug.h
Last active Jun 24, 2021
macOS Debug boot-args
View debug.h
/* Debug boot-args */
#define DB_HALT 0x1
//#define DB_PRT 0x2 -- obsolete
#define DB_NMI 0x4
#define DB_KPRT 0x8
#define DB_KDB 0x10
#define DB_ARP 0x40
#define DB_KDP_BP_DIS 0x80
//#define DB_LOG_PI_SCRN 0x100 -- obsolete
#define DB_KDP_GETC_ENA 0x200
@knightsc
knightsc / build-xnu-6153.11.26.sh
Created Feb 18, 2020
A script to build XNU version 6153.11.26 (macOS Catalina 10.15).
View build-xnu-6153.11.26.sh
#! /bin/bash
#
# build-xnu-6153.11.26.sh
# Scott Knight
#
# Based on the script by Brandon Azad
# https://gist.github.com/bazad/654959120a423b226dc564073b435453
#
# A script showing how to build XNU version 6153.11.26 on macOS Catalina
# 10.15 with Xcode 11.13.1.
@knightsc
knightsc / build-xnu-4903.270.47.sh
Created Apr 11, 2020
A script to build XNU version 4903.241.1 (macOS Mojave 10.14.3).
View build-xnu-4903.270.47.sh
#! /bin/bash
#
# build-xnu-4903.270.47.sh
# Scott Knight
#
# Based on the script by Brandon Azad
# https://gist.github.com/bazad/654959120a423b226dc564073b435453
#
# A script showing how to build XNU version 4903.270.47 on macOS Mojave
# 10.14.6 with Xcode 10.3
@knightsc
knightsc / DataTypes.h
Created Feb 18, 2020
dtrace-338.0.1 missing DataTypes.h file from llvmCore-3425.0.36
View DataTypes.h
/* include/llvm/Support/DataTypes.h. Generated from DataTypes.h.in by configure. */
/*===-- include/Support/DataTypes.h - Define fixed size types -----*- C -*-===*\
|* *|
|* The LLVM Compiler Infrastructure *|
|* *|
|* This file is distributed under the University of Illinois Open Source *|
|* License. See LICENSE.TXT for details. *|
|* *|
|*===----------------------------------------------------------------------===*|
|* *|