Skip to content

Instantly share code, notes, and snippets.

@macshome
macshome / defang.md
Last active April 24, 2024 18:31
How to defang system protections on macOS

How to Defang macOS System Protections

If you want to change things on the root drive of a Mac you will need to take some steps to disable the built in security of the system. Most of these steps are the same regardless if you are on Intel or Apple Silicon. If there is a difference it is noted.

Note that all of these things put a Mac into an unsupported and less secure state.

Make sure you either perform these steps in a VM or that you reset the protections after you are done poking around

Protections and Terms

(This list is not exahustive on the details of each. Check the links at the end for more info.)

@xperylab
xperylab / decrypt_ufed_keychain.py
Created December 30, 2020 11:27
UFED KeychainDump Decrypter
################################################################################################
# #
# UFED keychain decrypter #
# #
# Copyright Matthieu Regnery 2020 #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation, either version 3 of the License, or #
# (at your option) any later version. #
@saelo
saelo / 3_years_of_attacking_javascript_engines.txt
Created October 27, 2019 16:04
3 Years of Attacking JavaScript Engines
|=-----------------------------------------------------------------------=|
|=-------------=[ 3 Years of Attacking JavaScript Engines ]=-------------=|
|=-----------------------------------------------------------------------=|
|=------------------------------=[ saelo ]=------------------------------=|
|=-----------------------------------------------------------------------=|
The following are some brief notes about the changes that have taken place
since the release of the "Attacking JavaScript Engines" paper [1]. In
general, no big conceptional changes have happened since. Mitigations have
been added to break some of the presented techniques and, as expected, a
@lategoodbye
lategoodbye / mainline_guide.md
Last active January 4, 2024 21:35
Raspberry Pi: How to cross-compile and use Mainline Kernel

Raspberry Pi: How to cross-compile and use Mainline Kernel

Notes on how to set up a new Ubuntu LTS x64 environment, how to build a recent Mainline Kernel and place it on a Raspberry Pi OS SD card.

Procedure

  1. Install tools needed:
$ apt install git make gcc g++ device-tree-compiler bc bison flex libssl-dev libncurses-dev python3-ply python3-git libgmp3-dev libmpc-dev
import json
import sqlite3
import zlib
# ~/Library/Safari/CloudTabs.db
# Ref: https://www.reddit.com/r/mac/comments/89qx5n/iphone_safari_tabs_into_text_list_via_icloud/
db = sqlite3.connect('CloudTabs.db')
tabs = []
@itszn
itszn / exploit.js
Created July 11, 2018 16:27
Exploit for JavascriptCore CVE-2018-4192
// Load Int library, thanks saelo!
load('util.js');
load('int64.js');
// Helpers to convert from float to in a few random places
var conva = new ArrayBuffer(8);
var convf = new Float64Array(conva);
var convi = new Uint32Array(conva);
var convi8 = new Uint8Array(conva);
@cheesecakeufo
cheesecakeufo / xpc_idapro.py
Last active April 20, 2023 13:59
xpc functions fix - IDA
# Created to make RE-ing XPC a bit easier (in a shitty way)
# yes, somethings are hard-coded but I've done it because I don't want to spend more time on this
# created by Abraham Masri @cheesecakeufo
import re
import idaapi
import idautils
paths = ["/usr/include/xpc/xpc.h",
"/usr/include/xpc/activity.h",
@mems
mems / icloudtabs2md.js
Last active February 26, 2023 21:38
Generate a markdown links list from iCloud tabs
#!/usr/bin/env node
/*
Generate a markdown links list from iCloud tabs, on macOS
Usage:
./icloudtabs2md.js > icloudtabs.md
./icloudtabs2md.js | pbcopy
Require:
@Siguza
Siguza / dsc_syms.c
Last active February 20, 2022 02:19
dyld_shared_cache symbols to r2 flags
// Moved here: https://github.com/Siguza/misc/blob/master/dsc_syms.c
@alexander-hanel
alexander-hanel / yolo.py
Last active January 17, 2020 03:40
old and new names in idc.py (in progress)
import re
import sys
import os
def load_apis():
new_old_apis = [
# start of changes for idc.py
("hasValue", "has_value"),
("byteValue", "byte_value"),
("isLoaded", "is_loaded"),