| Day | Title | link |
|---|---|---|
| 1 | Apple Source code | https://www.youtube.com/watch?v=WxOZgr0Ld9o |
| 2 | Mach-O Binaries | https://www.youtube.com/watch?v=G_bDl5hv8kY |
| 3 | PAC (Pointer Authentication Codes) | https://www.youtube.com/watch?v=9neXmcwtCF8 |
| 4 | dyld_shared_cache | https://www.youtube.com/watch?v=I1ZkONfyHG4 |
| 5 | Userspace Memory Layout | https://www.youtube.com/watch?v=MUr7qg7iqKE |
| 6 | SIP | https://www.youtube.com/watch?v=HeOVKe0xpW0 |
| 7 | Kernel Boot Arguments | https://www.youtube.com/watch?v=gjOKlBpJWoc |
| 8 | XNU Source Code Overview | https://www.youtube.c |
arm64eabi
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // | |
| // pplrw.m | |
| // kfd | |
| // | |
| // Created by Lars Fröder on 29.12.23. | |
| // | |
| #import <Foundation/Foundation.h> | |
| #import <dlfcn.h> | |
| #import <mach-o/dyld.h> |
b0gdanw
/ Disable-Sonoma-Bloatware.sh
Last active
February 4, 2026 07:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/zsh | |
| # WARNING! The script is meant to show how and what can be disabled. Don’t use it as it is, adapt it to your needs. | |
| # Credit: Original idea and script disable.sh by pwnsdx https://gist.github.com/pwnsdx/d87b034c4c0210b988040ad2f85a68d3 | |
| # Disabling unwanted services on macOS Big Sur (11), macOS Monterey (12), macOS Ventura (13) and macOS Sonoma (14) | |
| # Disabling SIP is required ("csrutil disable" from Terminal in Recovery) | |
| # Modifications are written in /private/var/db/com.apple.xpc.launchd/ disabled.plist, disabled.501.plist | |
| # To revert, delete /private/var/db/com.apple.xpc.launchd/ disabled.plist and disabled.501.plist and reboot; sudo rm -r /private/var/db/com.apple.xpc.launchd/* | |
| # user |
ARM defines ACTLR_EL[321] as implementation defined.
Apple adds an IMPDEF ACTLR_EL12 as s3_6_c15_c14_6 and effectively implements VHE semantics. This does not seem to violate the architecture, since the register contents are IMPDEF anyway so nothing says they can't alias ACTLR_EL1 and ACTLR_EL2 together in EL2.
ACTLR_EL1 is trapped by HCR_EL2.TACR. It is also trapped by HACR_EL2<0> (which has all the controls for fine-grained Apple IMPDEF stuff).
In addition, AIDR_EL1 contains feature bits for Apple IMPDEF functionality. It is identical in EL1 and EL2 and is trapped by HCR_EL2.TID1 and HACR_EL2<4>.
steven-michaud
/ ThirdPartyKexts.md
Last active
May 7, 2026 11:52
Running Third Party Kernel Extensions on Virtualization Framework macOS Guest VMs
As of macOS 12 (Monterey), Apple's Virtualization framework has nice support for macOS guest virtual machines, but with severe limitations: For example you can't install a macOS guest on Intel Macs, install guests with newer versions of macOS than the host, copy and paste between the host and the guest, or install third party kernel extensions in the guest. As usual for Apple, the functionality they do support is nicely implemented, but they've left out so much that the result is only marginally useful -- at least compared to
zhuowei
/ reachable_services.txt
Created
February 21, 2023 06:26
Reachable Mach services from the app sandbox on iOS 16.1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| PurpleSystemAppPort | |
| PurpleSystemEventPort | |
| UIASTNotificationCenter | |
| com.apple.ABDatabaseDoctor | |
| com.apple.AppSSO.service-xpc | |
| com.apple.AuthenticationServicesCore.AuthenticationServicesAgent | |
| com.apple.CARenderServer | |
| com.apple.ClipServices.clipserviced | |
| com.apple.CoreAuthentication.daemon | |
| com.apple.DeviceAccess.xpc |
akemin-dayo
/ virtualapple-utm-link
Last active
April 24, 2024 18:34
A cleaned up version of an internal script that I've been using while working on TotalFinder to create VirtualApple virtual machine instances that are hardlinked to a UTM virtual machine instance. It's particularly useful for entering One True recoveryOS (1TR) as well as using the other features found only in VirtualApple.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env bash | |
| # virtualapple-utm-link | |
| # Karen/あけみ (akemin_dayo) | |
| # https://gist.github.com/akemin-dayo/8337d8274deddfefae5d1543420ca0b1.git | |
| # This is a cleaned up version of an internal script that I've been using while working on TotalFinder to create VirtualApple virtual machine instances that are hardlinked to a UTM virtual machine instance. | |
| # It's particularly useful for entering One True recoveryOS (1TR) as well as using the other features found only in VirtualApple. | |
| # UTM does not support entering 1TR for macOS 12 hosts (yet?), though it is now possible on macOS 13 hosts (utmapp/UTM/issues/3526). |
b0gdanw
/ Disable-Ventura-Bloatware.sh
Last active
February 18, 2026 21:17
Disable Ventura Bloatware
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/zsh | |
| # Credit: Original idea and script disable.sh by pwnsdx https://gist.github.com/pwnsdx/d87b034c4c0210b988040ad2f85a68d3 | |
| # Disabling unwanted services on macOS Big Sur (11), macOS Monterey (12) and macOS Ventura (13) | |
| # Disabling SIP is required ("csrutil disable" from Terminal in Recovery) | |
| # Modifications are written in /private/var/db/com.apple.xpc.launchd/ disabled.plist, disabled.501.plist | |
| # To revert, delete /private/var/db/com.apple.xpc.launchd/ disabled.plist and disabled.501.plist and reboot; sudo rm -r /private/var/db/com.apple.xpc.launchd/* | |
| # user |
tihmstar
/ iPhone_8_15.1_19B74_kernelpatches.txt
Last active
April 18, 2024 23:16
iPhone 8 15.1 19B74 checkm8 jb patches
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| iPhone8 15.1 19B74 | |
| iBoot: 0x1800309c0 : 000080d2 | |
| iBoot: 0x180038744 : af070094 | |
| iBoot: 0x18003a844 : 9386ff17 | |
| iBoot: 0x18001c290 : a1000058df0301eb40000054202080d2c0035fd6 | |
| iBoot: 0x18001c2a4 : 4887038001000000 | |
| iBoot: 0x1800325dc : 200080d2 | |
| iBoot: 0x18009127f : 7261316e736e3077206d6f6465 | |
| iBoot: 0x180038f04 : 1f2003d5 |
