Skip to content

Instantly share code, notes, and snippets.

View nanzhipro's full-sized avatar

南知 nanzhipro

View GitHub Profile

struct to get information about a file using FileAttributeKey

import Foundation

struct FileAttributesManager {
    
    // MARK: - Error Define
    
    enum FileAttributesError: Error {
@nanzhipro
nanzhipro / spotlight.factor
Created February 8, 2022 05:50 — forked from cwalston/spotlight.factor
Searching on OS X via Spotlight MetaData index, & managing indexing from Factor
! (C) 2013 Charles Alston.
USING: accessors arrays byte-arrays fry google.search io
io.encodings.utf8 io.launcher kernel locals make namespaces
sequences simple-tokenizer splitting strings unicode.categories
webbrowser wordtimer ;
IN: spotlight
! *** SEARCHING ON OS X VIA SPOTLIGHT METADATA INDEX, & MANAGING INDEXING FROM FACTOR ***
! *** MAC OS X 10.6.8 & LATER: IMPLEMENTING mdfind, mdls, mdutil, mdimport ***
! mdfind, mdls, mdutil, mdimport TAKE A QUERY ON THE STACK & RETURN A SEQUENCE OF RESULT STRINGS
@nanzhipro
nanzhipro / ScreenCapture.m
Created February 4, 2022 04:52 — forked from chinmaygarde/ScreenCapture.m
Mac OSX Screen Capture
CGImageRef imageRef = CGWindowListCreateImage(CGRectInfinite, kCGWindowListOptionAll, kCGNullWindowID, kCGWindowImageDefault);
CFMutableDataRef dataRef = CFDataCreateMutable(kCFAllocatorDefault, 0);
CGImageDestinationRef dest = CGImageDestinationCreateWithData(dataRef, kUTTypePNG, 1, NULL);
CGImageDestinationAddImage(dest, imageRef, NULL);
CGImageDestinationFinalize(dest);
CFRelease(dest);
CGImageRelease(imageRef);
@knightsc
knightsc / ApplicationWhitelist.mobileconfig
Created June 29, 2021 15:26
macOS example profile to whitelist application which in turn makes use of mcxalr.kext
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>Parental Controls: Application Access #1</string>
<key>PayloadIdentifier</key>
@kdrwygvh
kdrwygvh / SIPProtectedPaths.txt
Created January 6, 2021 14:00
SIP Protected Paths in macOS 11+
/Applications/Safari.app
/Library/Apple
/Library/Application Support/com.apple.TCC
/Library/CoreAnalytics
/Library/Filesystems/NetFSPlugins/Staged
/Library/Filesystems/NetFSPlugins/Valid
/Library/Frameworks/iTunesLibrary.framework
/Library/GPUBundles
/Library/KernelCollections
/Library/MessageTracer
# 除了注释建议浏览官方手册(https://manual.nssurge.com/)、帮助中心(https://nssurge.zendesk.com/)以及技术社区(https://community.nssurge.com)
[General]
bypass-system = true
loglevel = notify
replica = false
# TLS 引擎
tls-provider = default
# IPv6 支持(关闭)
ipv6 = false
@Akemi
Akemi / edr.swift
Last active April 4, 2025 15:37
macOS EDR Test
import Cocoa
import OpenGL.GL
import OpenGL.GL3
extension NSDeviceDescriptionKey {
static let screenNumber = NSDeviceDescriptionKey("NSScreenNumber")
}
extension NSScreen {
@Omar-Ikram
Omar-Ikram / EndpointSecurityDemo.m
Last active April 4, 2025 15:29
A demo of using Apple's EndpointSecurity framework - tested on macOS Monterey 12.2.1 (21D62)
//
// main.m
// EndpointSecurityDemo
//
// Created by Omar Ikram on 17/06/2019 - macOS Catalina 10.15 Beta 1 (19A471t)
// Updated by Omar Ikram on 15/08/2019 - macOS Catalina 10.15 Beta 5 (19A526h)
// Updated by Omar Ikram on 01/12/2019 - macOS Catalina 10.15 (19A583)
// Updated by Omar Ikram on 31/01/2021 - macOS Big Sur 11.1 (20C69)
// Updated by Omar Ikram on 07/05/2021 - macOS Big Sur 11.3.1 (20E241)
// Updated by Omar Ikram on 04/07/2021 - macOS Monterey 12 Beta 2 (21A5268h)
@douglashill
douglashill / main.m
Last active February 13, 2025 00:38
A minimal iOS app set up entirely in code using Objective-C rather than using a storyboard and UIApplicationSceneManifest in the Info.plist.
// A minimal iOS app set up entirely in code using Objective-C rather than using a storyboard and UIApplicationSceneManifest in the Info.plist.
// Last updated for iOS 18.
// Swift version: https://gist.github.com/douglashill/b8125f7e2336b6a47461df0d4898f64d
@import UIKit;
@interface SceneDelegate : UIResponder <UIWindowSceneDelegate>
@end
@implementation SceneDelegate
@richiercyrus
richiercyrus / SigCheck.py
Created February 12, 2019 14:17
Python code for checking whether there are any processes running on a macOS system that are missing the LC_CODE_SIGNATURE command. This may be indicative of a LC_LOAD_DYLIB addition attack: https://attack.mitre.org/techniques/T1161/
import os
import sys
import shlex
import argparse
import subprocess
import macholib
import json
import hashlib
#This script is designed to detect the following MITRE ATT&CK Technique: