kim4apple

#!/usr/bin/env python3
'''amfid_patch.py - Pedro José Pereira Vieito © 2016
    This script can patch macOS 10.12.2 amfid daemon on memory 
    to allow arbitrary entitlements in Developer ID signed binaries.
    
    Killing amfid will make the patch disapear:
    $ sudo kill -9 `pgrep amfid`
    
    You must run the script as a root (sudo) and with SIP disabled.
    

kim4apple

Title : Revisiting Mac OS X Kernel Rootkits
Author : fG!
Date : April 18, 2014

|=----------------------------------------------------------------------------=|
|=----------------=[ Revisiting Mac OS X Kernel Rootkits ]=-------------------=|
|=----------------------------------------------------------------------------=|
|=------------------------=[ fG! <[email protected]> ]=---------------------------=|
|=----------------------------------------------------------------------------=|

kim4apple

//
//  main.m
//  EndpointSecurityDemo
//
//  Created by Omar Ikram on 17/06/2019 - Catalina 10.15 Beta 1 (19A471t)
//  Updated by Omar Ikram on 15/08/2019 - Catalina 10.15 Beta 5 (19A526h)
//  Updated by Omar Ikram on 01/12/2019 - Catalina 10.15 (19A583)
//

#import <Foundation/Foundation.h>

kim4apple

//
//  Created by Dariusz Rybicki on 17/04/16.
//  Copyright © 2016 Darrarski. All rights reserved.
//

#import <Foundation/Foundation.h>

/**
 Returns number of seconds since system became idle
 

kim4apple

# basic pfctl control
# ==
# Related: http://www.OpenBSD.org
# Last update: Tue Dec 28, 2004
# ==
# Note:
# this document is only provided as a basic overview
# for some common pfctl commands and is by no means
# a replacement for the pfctl and pf manual pages.

kim4apple

# Even though device management is disabled in Server.app, 
# the processes still run.  Which the only issue with this is 
# it causes extremely slow shutdown times.  So here we disable this shit

sudo launchctl stop com.apple.DeviceManagement.postgres; 
sudo launchctl remove com.apple.DeviceManagement.postgres;
sudo launchctl unload -w /Applications/Server.app/Contents/ServerRoot/System/Library/LaunchDaemons/com.apple.DeviceManagement.postgres.plist

# Same goes for calendar server
sudo launchctl stop org.calendarserver.agent; 

kim4apple

Automatically check for updates:

Enable: sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool TRUE
Disable: sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool FALSE

Download newly available updates in the background:

Enable: sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool TRUE
Disable: sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool FALSE

kim4apple

#import <libproc.h>
#import <sys/proc_info.h>


@interface ProcessUtil : NSObject
  
+ (NSArray <NSNumber *> *)loadProcessIds;
+ (NSString *)pathWithPid:(int)pid;
@end
  

kim4apple

- (NSString *)_commandFromPid:(int)pid {
    int mib[3], argmax, nargs, c = 0;
    size_t size;
    char *procargs, *sp, *np, *cp;
    
    mib[0] = CTL_KERN;
    mib[1] = KERN_ARGMAX;
    
    size = sizeof(argmax);

kim4apple

- (NSString *)_commandFromPid:(int)pid {
    int mib[3], argmax, nargs, c = 0;
    size_t size;
    char *procargs, *sp, *np, *cp;
    
    mib[0] = CTL_KERN;
    mib[1] = KERN_ARGMAX;
    
    size = sizeof(argmax);