unrooted

Install:

brew install cirruslabs/cli/tart

Verify:

tart --version

Apple Silicon Forensics — Cheatsheet

Companion to Terra Incognita — Apple Silicon Forensics · v1.0 · Konrad (@unrooted) Klawikowski · 02/06/2026

Mental model

The wall is also a witness. The same lockdown that denies you the old acquisition options — Target Disk Mode, block-level imaging, chip-off, memory dumps, SEP introspection — is the architecture that signs, caches, logs, and SIP-protects more persistent evidence than Intel ever did.

injection - inject into runtime after the boot Windows -> WinPE env. Linux -> initramfs env.

{
"injection": [
    {
        "image": "/linux.iso",
        "archive": "/archives/compressedDepressed.[zip/tar.[gz/bz2/xz/lzma]]"

Bedrock cheat-sheet

command	what it does
`brl list`	list currently integrated strata
`brl fetch`	acquite new strata and list fetchable
`brl fetch -L`	list supported stata
`brl fetch -X`	list experimental strata
`brl fetch -LX`	list both supported and experimental strata
`brl enable [strata]`	enable stratum

Manage services in systemd, openRC and runit

systemd

list all services: systemctl list-unit-files
list running services status: systemctl list-units
list failed services: systemctl --failed
list available services: systemctl --all
start a service: systemctl start [SERVICE_NAME]
stop a service: systemctl stop [SERVICE_NAME]

	#Requires -Version 5.1
	$ErrorActionPreference = 'Stop'

	# wslc.exe PoC: arbitrary host file read/write via a bind-mounted container.
	#
	# wslc.exe (WSL Containers, public preview 2026-06+) runs Linux (OCI) containers.
	# A bind mount (-v <host>:<container>) hands the container direct
	# read/write access to any host path over virtiofs. From the Windows host, the
	# only visible telemetry is wslc.exe itself and that VM's Hyper-V worker - not the
	# Linux process tree, and not the files it touches inside the mount.

	#Requires -Version 5.1
	$ErrorActionPreference = 'Stop'

	# wsb.exe LOLBAS PoC: truly-headless command execution via Windows Sandbox CLI.
	#
	# Demonstrates that wsb.exe (Windows 11 24H2+) can run arbitrary commands
	# inside a Defender-free sandbox with NO interactive window, NO .wsb file
	# on disk, and the abuse signal SPLIT across two separate wsb.exe invocations
	# so that naive "single-call detection" rules miss the pattern.
	#

	# If you come from bash you might have to change your $PATH.
	export PATH=$HOME/bin:/usr/local/bin:$HOME.local/bin:$PATH

	# Path to your oh-my-zsh installation.
	export ZSH="/home/viper/.oh-my-zsh"

	# export Nix
	. /home/viper/.nix-profile/etc/profile.d/nix.sh
	export NIX_PATH=$HOME/.nix-defexpr/channels${NIX_PATH:+:}$NIX_PATH

	! special
	*.foreground: #d2d0ce
	*.background: #11100f
	*.cursorColor: #d2d0ce

	! black
	*.color0: #282a2e
	*.color8: #373b41

	! red