macshome

How to Defang macOS System Protections

If you want to change things on the root drive of a Mac you will need to take some steps to disable the built in security of the system. Most of these steps are the same regardless if you are on Intel or Apple Silicon. If there is a difference it is noted.

Note that all of these things put a Mac into an unsupported and less secure state.

Make sure you either perform these steps in a VM or that you reset the protections after you are done poking around

Protections and Terms

(This list is not exahustive on the details of each. Check the links at the end for more info.)

aemmitt-ns

const typeMap = {
    "c": "char",
    "i": "int",
    "s": "short",
    "l": "long",
    "q": "long long",
    "C": "unsigned char",
    "I": "unsigned int",
    "S": "unsigned short",

stek29

HowTo

• Root via rootmy.tv
• Install

Tested on webOS 4.5, should at least on webOS 3.5+

Installation/Update

curl -qs "https://gist.githubusercontent.com/stek29/761232c6f7e1ffbc36b98da2a3a0f4d9/raw/install.sh?$(date +%s)" | sh -

Siguza

#!/usr/bin/env zsh

set -e;
set +m; # Job control would've been nice, but manual round robin it is, sigh.

if [ -z "${ZSH_VERSION+x}" ]; then
    echo 'Try again with zsh.';
    exit 1;
fi;

zwaldowski

import UIKit
import ObjectiveC.runtime

// MARK: - IOKit

@objc private protocol IOHIDEvent: NSObjectProtocol {}

private struct IOHIDDigitizerEventMask: OptionSet {
    let rawValue: UInt32
    init(rawValue: UInt32) { self.rawValue = rawValue }

Proteas

void inject_trusts(int pathc, const char *paths[])
{
    printf("[+] injecting into trust cache...\n");
    
    extern uint64_t g_kern_base;
    
    static uint64_t tc = 0;
    if (tc == 0) {
        /* loaded_trust_caches
         iPhone11,2-4-6: 0xFFFFFFF008F702C8

Proteas

#! /usr/sbin/dtrace -C -s

/*
	requirement: disable SIP 
*/

#pragma D option quiet
BEGIN {
	printf("vm_kernel_slide: 0x%p\n", (`vm_kernel_slide));
	printf("vm_kernel_base: 0x%p\n", (`vm_kernel_base));

olih

Processing JSON using jq

jq is useful to slice, filter, map and transform structured json data.

Installing jq

On Mac OS

brew install jq

radj

#include <substrate.h>

#include <mach/mach.h>
#include <mach/mach_time.h>

#include <IOKit/hid/IOHIDEventTypes.h>
#include <IOKit/hidsystem/IOHIDUsageTables.h>

#include <GraphicsServices/GraphicsServices.h>

nabla-c0d3

//
//  LibC.m
//
//  Created by Alban Diquet on 5/14/14.
//  Copyright (c) 2014 Alban Diquet. All rights reserved.
//

#import <CydiaSubstrate.h>
#import "LibC.h"