pudquick

import objc
packagekit_bundle = objc.loadBundle('PackageKit', module_globals=globals(), bundle_path='/System/Library/PrivateFrameworks/PackageKit.framework', scan_classes=False)
PKReceipt = objc.lookUpClass('PKReceipt')

receipts = PKReceipt.receiptsOnVolumeAtPath_('/')

first_receipt = receipts[0]

# Things you can look up:
# installPrefixPath

pudquick

# Using: https://developer.apple.com/library/mac/documentation/Cocoa/Reference/ObjCRuntimeRef
# Thank you to this for inspiration: https://github.com/MacLeek/trackmac/blob/master/trackmac/cocoa.py

import objc
from ctypes import CDLL, c_void_p, byref, c_char_p
from ctypes.util import find_library
from Foundation import NSMutableArray

Security = CDLL(find_library("Security"))
AuthorizationRightGet = Security.AuthorizationRightGet

pudquick

import objc
from Foundation import NSBundle

IOKit = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')

functions = [("IOServiceGetMatchingService", b"II@"),
             ("IOServiceMatching", b"@*"),
             ("IORegistryEntryCreateCFProperties", b"IIo^@@I"),
             ("IOPSCopyPowerSourcesByType", b"@I"),
             ("IOPSCopyPowerSourcesInfo", b"@"),

pudquick

from subprocess import Popen, PIPE, STDOUT, check_output
from mimetools import Message
from StringIO import StringIO
from urlparse import urlparse, parse_qs
from urllib import quote, basejoin, urlencode

DEV_SITE  = 'https://developer.apple.com'
AUTH_SITE = 'https://idmsa.apple.com'
AUTH_PATH = '/IDMSWebAuth/authenticate'
APPIDKEY_PATH = "/services-account/download?path=%s"

pudquick

#!/usr/bin/python
approved_UUIDs     = ['your-beacon-UUID-here'] # see line 64
path_to_lock_sound = '/Users/frogor/Desktop/car_lock.m4a'
path_to_warn_sound = '/Users/frogor/Desktop/viper_warning.m4a'

import time
import objc
from objc import NO
from Foundation import NSBundle, NSClassFromString, NSObject, NSRunLoop, NSDate, NSUUID, NSMakeRange, NSURL
from AVFoundation import AVAudioPlayer

rkitover

diff -ruN Python-3.6.3.orig/setup.py Python-3.6.3.new/setup.py
--- Python-3.6.3.orig/setup.py	2017-10-02 22:52:02.000000000 -0700
+++ Python-3.6.3.new/setup.py	2017-11-16 13:35:45.000000000 -0800
@@ -811,10 +811,15 @@
         exts.append( Extension('_socket', ['socketmodule.c'],
                                depends = ['socketmodule.h']) )
         # Detect SSL support for the socket module (via _ssl)
+        openssl_root = os.getenv('OPENSSL_ROOT')
+
         search_for_ssl_incs_in = [

bruienne

sudo /usr/libexec/PlistBuddy -x -c 'Print :ShadowHashData' /var/db/dslocal/nodes/Default/users/root.plist | awk '/\t[^\<]/{print $1}' | base64 -D | plutil -convert xml1 -o - -- - | python -c 'import plistlib; import sys; plist = plistlib.readPlistFromString(sys.stdin.read()); print plist["SALTED-SHA512-PBKDF2"]["iterations"]'

ygini

Reversing 10.13 RootGate, hands notes

Inital discovery process

Original state of the root.plist

Dict {
    smb_sid = Array {
        S-1-5-18

zrzka

#!python3

from ctypes import c_int, c_void_p, POINTER, byref, c_ulong
from objc_util import (
    load_framework, c, ns, ObjCInstance, nsdata_to_bytes, NSString, NSData, NSNumber,
    ObjCClass, NSArray, NSDictionary
)
from enum import Enum, IntFlag
from typing import Union
import datetime

pudquick

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDisplayName</key>
			<string>Privacy Preferences Policy Control</string>
			<key>PayloadIdentifier</key>