Post

Replies

Boosts

Views

Activity

Reply to [.ips] How do you determine now the binary images that are user code?
Thanks for the info. I don't remember where I saw this but indeed, there seems to be some checks with paths such as /System/, /Library/Apple/, /usr/bin, and bundle identifiers such as com.apple.* , Motion,… The issue with the com.apple.* pattern is that when Xcode crashes (yes, it happens), you end up with something incorrect where the Xcode binary and its linked embedded frameworks are not considered user code but its embedded Swift Libraries are…
Nov ’21
Reply to AppleArchive : Obj-C API? C sample code? Documentation?
OK. I will try to figure out how to use the C API. Display problem with the documentation -> FB9956926. If you use Google Chrome, it's a bit better.
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Mar ’22
Reply to How are we supposed to get the pid from a NEFilterFlow?
I would just use the - (pid_t)pid private API if I had to get this value insecurely.
Topic: App & System Services SubTopic: Core OS Tags:
Replies
Boosts
Views
Activity
Nov ’21
Reply to [.ips] How do you determine now the binary images that are user code?
Thanks for the info. I don't remember where I saw this but indeed, there seems to be some checks with paths such as /System/, /Library/Apple/, /usr/bin, and bundle identifiers such as com.apple.* , Motion,… The issue with the com.apple.* pattern is that when Xcode crashes (yes, it happens), you end up with something incorrect where the Xcode binary and its linked embedded frameworks are not considered user code but its embedded Swift Libraries are…
Replies
Boosts
Views
Activity
Nov ’21