ɘɿuɔɐɿɈ tracure1337

Reverse Engineering on macOS

Some notes, tools, and techniques for reverse engineering macOS binaries.

Some notes and tools for reverse engineering / deobfuscating / unminifying obfuscated web app code.

ℹ️ This was duplicated to this blog for readability and reference

The most difficult challenge with RMM detection is contextual awareness around usage to determine if it is valid or malicious.

	// 3D Dom viewer, copy-paste this into your console to visualise the DOM as a stack of solid blocks.
	// You can also minify and save it as a bookmarklet (https://www.freecodecamp.org/news/what-are-bookmarklets/)
	(() => {
	const SHOW_SIDES = false; // color sides of DOM nodes?
	const COLOR_SURFACE = true; // color tops of DOM nodes?
	const COLOR_RANDOM = false; // randomise color?
	const COLOR_HUE = 190; // hue in HSL (https://hslpicker.com)
	const MAX_ROTATION = 180; // set to 360 to rotate all the way round
	const THICKNESS = 20; // thickness of layers
	const DISTANCE = 10000; // ¯\\_(ツ)_/¯

	Latency Comparison Numbers (~2012)
	----------------------------------
	L1 cache reference 0.5 ns
	Branch mispredict 5 ns
	L2 cache reference 7 ns 14x L1 cache
	Mutex lock/unlock 25 ns
	Main memory reference 100 ns 20x L2 cache, 200x L1 cache
	Compress 1K bytes with Zippy 3,000 ns 3 us
	Send 1K bytes over 1 Gbps network 10,000 ns 10 us
	Read 4K randomly from SSD* 150,000 ns 150 us ~1GB/sec SSD

	/**
	* RuntimeGlobalsChecker
	*
	* You can use this utility to quickly check what variables have been added (or
	* leaked) to the global window object at runtime (by JavaScript code).
	* By running this code, the globals checker itself is attached as a singleton
	* to the window object as "__runtimeGlobalsChecker__".
	* You can check the runtime globals programmatically at any time by invoking
	* "window.__runtimeGlobalsChecker__.getRuntimeGlobals()".
	*

	#!/usr/bin/env python3

	"""
	Python script to enumerate valid Microsoft 365 domains, retrieve tenant name, and check for an MDI instance.
	Based on: https://github.com/thalpius/Microsoft-Defender-for-Identity-Check-Instance.
	Usage: ./check_mdi.py -d <domain>
	"""

	import argparse
	import dns.resolver

	# syntax=docker/dockerfile:1
	# Keep this syntax directive! It's used to enable Docker BuildKit

	# Based on https://github.com/python-poetry/poetry/discussions/1879?sort=top#discussioncomment-216865
	# but I try to keep it updated (see history)

	################################
	# PYTHON-BASE
	# Sets up all our shared environment variables
	################################