Andrii A andriitishchenko

Gatekeeper

$ /usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" /private/var/db/gkopaque.bundle/Contents/Info.plist

XProtect

$ defaults read /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist CFBundleShortVersionString

To make old Xcode to works on Macos 13.2 (22D49):

edit Xcode12 or Xcode13 CFBundleVersion to "21534" (approve Terminal permissions)

/usr/libexec/PlistBuddy -c "Set CFBundleVersion 21534" /Applications/Xcode.app/Contents/Info.plist

~ % /usr/libexec/PlistBuddy -c "Print CFBundleVersion" /Applications/Xcode12.5.app/Contents/Info.plist

18212

Mac OS X executable (Malware) Analysis

(12345)₁₀ = (3039)₁₆

from LibreSSL 2.9.1 the default message digest for openssl enc was changed from "md5" to "sha256"

For compatibility with macOS13+ and older, you must explicitly specify the parameter: -md sha256 or -md md5

echo 'this is a test' | openssl enc -aes-256-cbc -a -A -md sha256 -pass file:<(echo 'mySecurePass')

Assume webserver at localhost:8080

Will not works for Self-signed certificate


	/**
	https://yara.readthedocs.io/en/stable/commandline.html

	$ clang terget.c

	$ brew install yara

	$ yara /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.yara terget.out
	XProtect_MACOS_644e18d terget.out

	allowed_symbols = "abcdefghijklmnopqrstuvwxyz0123456789"

	min_length = 3
	max_length = 5

	with open("generated_passwords.txt", "w") as f:
	for length in range(min_length, max_length + 1):
	for password in generate_combinations(allowed_symbols, length):
	f.write(password + "\n")

	#!/bin/sh

	# Script for wrapping ghidra to MacOs bundle app.

	# curl https://gist.githubusercontent.com/andriitishchenko/afe03e833a30c5a0012036261cb6a952/raw/a28dcc2d474a9976cb07f706bc75a85a3594ff49/install.sh \| sh

	# NOT TESTED WITH M1+
	# ghidra 10.x requaries JDK 17+ (64-bit)
	# https://www.oracle.com/java/technologies/downloads/#jdk19-mac
	# Not works for macos13+


	# Macos Proxy Helper (networksetup wraper)
	# add this line to $HOME/.zshrc
	#
	# source "$HOME/.proxy_helper"
	#

	# usage :
	# proxy < \| up \| down > [-all \|\| -http\|-https\|-socks\|-ftp\|-stream ]
	# proxy set <destination> <port> [-http\|-https\|-socks\|-ftp\|-stream \|\| -all]'