James Gill JJTech0130

Reverse engineer, student

JJTech0130 / library_injector.cpp

Last active August 16, 2026 21:14 — forked from saagarjha/library_injector.cpp

Load a library into newly spawned processes (using DYLD_INSERT_LIBRARIES and EndpointSecurity)

	// To compile: clang++ -arch x86_64 -arch arm64 -arch arm64e -std=c++20 library_injector.cpp -lbsm -lEndpointSecurity -o library_injector,
	// then codesign with com.apple.developer.endpoint-security.client and run the
	// program as root.

	#include <EndpointSecurity/EndpointSecurity.h>
	#include <algorithm>
	#include <array>
	#include <bsm/libbsm.h>
	#include <cstddef>
	#include <cstdint>

JJTech0130 / usbmuxd.lua

Last active May 24, 2026 12:12 — forked from axelkar/usbmuxd.lua

Usbmuxd protocol dissector for Wireshark. Passes TCP to Wireshark's built-in TCP dissector

	local proto_usbmuxd = Proto("usbmuxd", "Usbmuxd Protocol")

	proto_usbmuxd.fields.protocol = ProtoField.uint32("usbmuxd.protocol", "Message Kind", base.DEC)
	proto_usbmuxd.fields.length = ProtoField.uint32("usbmuxd.length", "Length", base.DEC)
	proto_usbmuxd.fields.magic = ProtoField.uint32("usbmuxd.magic", "Magic", base.HEX)
	proto_usbmuxd.fields.tx_seq = ProtoField.uint16("usbmuxd.tx_seq", "Transmit sequence", base.DEC)
	proto_usbmuxd.fields.rx_seq = ProtoField.uint16("usbmuxd.rx_seq", "Receive sequence", base.DEC)

	proto_usbmuxd.fields.version_major = ProtoField.uint32("usbmuxd.version_major", "Major version", base.DEC)
	proto_usbmuxd.fields.version_minor = ProtoField.uint32("usbmuxd.version_minor", "Minor version", base.DEC)

JJTech0130 / README.md

Created March 3, 2026 13:15 — forked from zhaofengli/README.md

Selectively bypass entitlement validation by debugging amfid

amfid-allow

This script hooks into macOS amfid to grant restricted entitlements to selected executables. Tested on macOS 15.4.

Only disabling Debugging Restrictions (ALLOW_TASK_FOR_PID) is required and other SIP restrictions can be left enabled: