Learning resource
osx & ios re 101
A single-README reading list for macOS (OS X) and iOS reverse engineering, kept by Michal Malik from 2015 to 2019 and labelled a work in progress. Its 98 entries in nine sections run from must-read blogs and Mach-O, ABI and system-call references through Mach-O basics, malware, anti-debugging and obfuscation write-ups, kernel, sandbox and jailbreak research, kernel-extension development and kernel debugging, and forensics and monitoring material, to crackmes and six books. Entries are bare links or titles, mostly with no annotation.
- Targets
- App · Binary
- Category
- Learning resources
- Relationship
- Learning resource
- Sources reviewed
Requirements & limits
- The reviewed commit, from 2019-12-19 and the latest, closes a history of 69 commits that began on 2015-07-13. Most linked material targets OS X 10.x and iOS 8–10 era internals, such as El Capitan kernels and iOS 9 and 10 jailbreak analyses, and the list predates current macOS and iOS releases and Apple silicon Macs. A December 2019 commit replaced some broken and outdated links.
- No target files are supplied or needed by the list itself; the linked tutorials and crackmes bring their own samples, and the books are listed by title only. Following the material assumes a Mac or iOS device and the tools each article uses, such as LLDB, Hopper, and VMware Fusion or VirtualBox for kernel debugging.
- The list mixes analysis tutorials with malware infection, rootkit, privilege-escalation and jailbreak write-ups. The repository contains only README.md and no license file, so the list states no reuse terms, and linked works keep their own rights.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · michalmalik/osx-re-101 · Revision 486f33a
- https://github.com/michalmalik/osx-re-101/tree/486f33adf35848735327d9a83a05f9abd0f18af7
- https://github.com/michalmalik/osx-re-101/commits/486f33adf35848735327d9a83a05f9abd0f18af7
More in References and learning
- AndroidReverse101 · Learning resource
- Ghidra Snippets · Learning resource
- Frida Boot: a beginner binary instrumentation workshop · Learning resource
- Embedded Hacking (mytechnotalent) · Learning resource
- Reverse-Engineering a Bluetooth-Enabled Radar Detector · Learning resource
- Link Pi ENCx encoders (unofficial documentation) · Learning resource