Complete AI TrainingYourJobSkills for your job
Subscriber log in

Skills / uncategorized

macos-reverse

Authorized macOS and Mach-O reverse engineering: codesign inspection, Objective-C/Swift recovery, endpoint-security surfaces, and Apple-platform malware analysis.

Get itLog in to downloadUse live via MCP →

macOS / Mach-O Reverse Engineering

When to Use

  • Analyzing macOS binaries or suspected malware samples.
  • Inspecting entitlements, signatures, and ObjC/Swift structures.

适用场景

  • Mach-O 可执行文件 / dylib / framework
  • .app bundle、LaunchAgent/Daemon
  • Objective-C / Swift 符号与 runtime
  • 公证/签名、Hardened Runtime、TCC 相关行为分析
  • macOS 恶意软件静态/动态分析（联合 malware-analysis）

工作流

1. 包体与签名

file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target

2. 静态

□ class-dump / swift-demangle / Hopper / Ghidra / IDA
□ 字符串与 XPC 服务名、TCC 敏感 API
□ LC_LOAD_dylib 依赖与 rpath

3. 动态

□ lldb / Frida
□ fs_usage / log stream 观察
□ 网络：联合 protocol-reverse 或代理

工具链

工具用途
otool / nm / codesign系统自带
Hopper / Ghidra / IDA反编译
class-dump / dsdumpObjC
Frida / lldb动态
jtool2Mach-O

参考

  • references/macho-triage.md
  • ../mobile-reverse/（iOS） ../ghidra-reverse/ ../malware-analysis/

路由上下文

上游: MASTER R31 下游: iOS → mobile-reverse；通用样本 → malware-analysis

任务完成自检

  • [ ] 是否记录签名/Hardened Runtime 状态？
  • [ ] 是否有地址级/符号级结论？
  • [ ] Checklist？

Limitations

  • Apple Silicon and hardened runtime add unpacking complexity.
  • Some analysis requires disabling SIP in a dedicated lab VM.
Adapted from zhaoxuya520/reverse-skill (MI

Subscribers only

The full skill, its 2 bundled files and every download is included with every paid Complete AI plan.

See plans on Complete AIAlready a subscriber? Log in

Details

Sourcezhaoxuya520/reverse-skill
LicenseMIT
Risk labelsafe ("critical" means the skill may run commands or touch files — read before use)
FilesSKILL.md, references/macho-triage.md
Added2026-08-25

Related skills

accesslint-diff

Diff a live page's accessibility violations against a baseline — by default compares uncommitted changes (stash-based), or pass --branch [<name>] to diff against a branch. Reports only new violations introduced, violations fixed, and pre-existing count. Use `scan` for a full audit with no diffing.

uncategorizeddesign

accesslint-scan

Audit a live page for accessibility issues, locate each WCAG violation precisely, and return a selector-grounded fix worklist without editing.

uncategorizeddesign

accint-commitments

Triage acc's open promises and close them with honest real-world verdicts via acc_act(runtime="outcome").

uncategorized

accint-frames

Drain acc's deliberation queue — open/waiting brain_frames checkpointed by headless runs — via acc_act(runtime="continue").

uncategorized

accint-solve

Route a goal through acc's scored-memory loop via acc_act(runtime="solve"); deliberate any returned brain_frame and submit via continue.

uncategorized

ad-creative

Create, iterate, and scale paid ad creative for Google Ads, Meta, LinkedIn, TikTok, and similar platforms. Use when generating headlines, descriptions, primary text, or large sets of ad variations for testing and performance optimization.

uncategorizedmarketingcreatives