Skip to content

Instantly share code, notes, and snippets.

View xpcmdshell's full-sized avatar
🐢

actae0n xpcmdshell

🐢
51 followers · 119 following
View GitHub Profile
@xpcmdshell
xpcmdshell / Hooky.cpp
Created June 3, 2017 04:19
Application Verifier Basics
#include "stdafx.h"
#define WIN32_LEAN_AND_MEAN
#include <Windows.h>
#include "prio.h"
//Convenient define for the fdwReason
#define VERIFIER_LOAD 4
/*
Prototypes for additional event callbacks (dll load, unload, and heap free). If you wanted to, you could respond to these events. We will
@xpcmdshell
xpcmdshell / writeup.md
Last active March 25, 2021 23:17
Lulu Bypass [dead]

LuLu bypasses

LuLu Helper (/Applications/LuLu.app/Contents/Library/LoginItems/LuLu Helper.app/Contents/MacOS/LuLu Helper) is the user mode GUI app that communicates with the kernel extension, and provides a nice interface for the user to define and view socket filtering rulesets (block/allow). The kernel extension is responsible for performing socket creation filtering based on these user defined rulesets.

The user mode helper sends ruleset and preferences creation, deletion, and modification requests by calling methods in an exported interface (XPCDaemonProtocol) on an exported XPC object. The XPC service it connects to is com.objective-see.lulu.

The LuLu Helper ships with the get-task-allow entitlement, so any program can get its task port using task_for_pid().

[ λ ~ ] jtool --ent "/Applications/LuLu.app/Contents/Library/LoginItems/LuLu Helper.app/Contents/MacOS/LuLu Helper"