Skip to content

Instantly share code, notes, and snippets.

@pedramamini
pedramamini / XProtect.yara
Created October 19, 2017 20:18
Apple OSX built in file defense is powered by YARA: /System/Library/CoreServices/XProtect.bundle/Contents/Resources
import "hash"
private rule Macho
{
meta:
description = "private rule to match Mach-O binaries"
condition:
uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca
}
As of iOS 11/macOS High Sierra, and only including ones in Foundation and CoreFoundation
Strings:
_NSCFString - a CFStringRef or CFMutableStringRef. This is the most common type of string object currently.
- May have 8 bit (ASCII) or 16 bit (UTF-16) backing store
_NSCFConstantString - a compile time constant CFStringRef, like you'd get with @"foo"
- May also be generated by dynamic string creation if matches a string in a pre-baked table of common strings called the StringROM
NSBigMutableString - an NSString backed by a CFStorage (https://github.com/opensource-apple/CF/blob/master/CFStorage.h) for faster handling of very large strings
NSCheapMutableString - a very limited NSMutableString that allows for zero-copy initialization. Used in NSFileManager for temporarily wrapping stack buffers.
@codeZoner
codeZoner / com.startup.plist
Last active July 22, 2022 08:12
Launch Demon Start up with Bash Script with MySQL Example
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<!-- Launch Daemon do not always have access to all the path variables
As a results, scripts will sometimes fail if the you are using path variables inside them
To enable the script to have access to all path variables, open up a terminal and type in -->
<!-- echo $PATH -->
<!-- You can opt to filter out some of the path variables which are not required by script-->
<key>EnvironmentVariables</key>
@PrasannaKumarChalla
PrasannaKumarChalla / RSVerticallyCenteredTextFieldCell.swift
Created August 27, 2017 18:08
vertically align nstextfield text
class RSVerticallyCenteredTextFieldCell: NSTextFieldCell {
var mIsEditingOrSelecting:Bool = false
override func drawingRect(forBounds theRect: NSRect) -> NSRect {
//Get the parent's idea of where we should draw
var newRect:NSRect = super.drawingRect(forBounds: theRect)
// When the text field is being edited or selected, we have to turn off the magic because it screws up
// the configuration of the field editor. We sneak around this by intercepting selectWithFrame and editWithFrame and sneaking a
// reduced, centered rect in at the last minute.
class Tuple(tuple):
def __getattr__(self, name):
def _int(val):
try:
return int(val)
except ValueError:
return False
if not name.startswith('_') or not _int(name[1:]):
raise AttributeError("'tuple' object has no attribute '%s'" % name)
@BretFisher
BretFisher / pcat-install.sh
Last active October 22, 2025 09:55
On macOS: Install pygmentize and alias pcat for shell code syntax highlighting
# first install pygmentize to the mac OS X or macOS system with the built-in python
sudo easy_install Pygments
# then add alias to your ~/.bash_profile or ~/.bashrc or ~/.zshrc etc.
alias pcat='pygmentize -f terminal256 -O style=native -g'
@pierrejoubert73
pierrejoubert73 / markdown-details-collapsible.md
Last active November 30, 2025 16:27
How to add a collapsible section in markdown.

How to add a collapsible section in markdown

1. Example

Click me

Heading

  1. Foo
  2. Bar
    • Baz
  • Qux
@ottodevs
ottodevs / pf.conf
Created May 11, 2017 22:32 — forked from trustin/pf.conf
Trustin's /etc/pf.conf for Mac OS X
# 1. Put this file to /etc/pf.conf
# 2. Install init boot scripts using IceFloor then - http://www.hanynet.com/icefloor/
# I tried to use IceFloor to configure everything but it didn't work very well.
# 3. Once done, you can confirm the rules were loaded with 'sudo pfctl -sr'
# 4. At System Preferences -> Security -> Firewall -> Firewall Options,
# check 'Block all incoming connections' to prevent annoying per-app dialogs.
set skip on lo0
set block-policy drop
@egmontkob
egmontkob / Hyperlinks_in_Terminal_Emulators.md
Last active November 7, 2025 14:12
Hyperlinks in Terminal Emulators
@cschiewek
cschiewek / x11_docker_mac.md
Last active September 9, 2025 01:27
X11 in docker on macOS

To forward X11 from inside a docker container to a host running macOS

  1. Install XQuartz: https://www.xquartz.org/
  2. Launch XQuartz. Under the XQuartz menu, select Preferences
  3. Go to the security tab and ensure "Allow connections from network clients" is checked.
  4. Run xhost + ${hostname} to allow connections to the macOS host *
  5. Setup a HOSTNAME env var export HOSTNAME=`hostname`*
  6. Add the following to your docker-compose:
 environment: