macos-reverse – Security skill for AI agents

Authorized macOS and Mach-O reverse engineering: codesign inspection, Objective-C/Swift recovery, endpoint-security surfaces, and Apple-platform malware analysis.

SecuritySKILL.mdClaude Code · Codex · Hermes · DeepSeek

Install the macos-reverse skill with one command

Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.

Claude Code

mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/macos-reverse-78137.tgz | tar xz -C ~/.claude/skills

Call it in Claude Code: /macos-reverse – then describe the task you want done.

Codex

mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/macos-reverse-78137.tgz | tar xz -C ~/.codex/skills

Call it in Codex: $macos-reverse – then describe the task you want done.

Hermes Agent

mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/macos-reverse-78137.tgz | tar xz -C ~/.hermes/skills

Call it in Hermes Agent: /macos-reverse – then describe the task you want done.

DeepSeek

mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/macos-reverse-78137.tgz | tar xz -C ~/.deepcode/skills

Call it in DeepSeek: /macos-reverse – then describe the task you want done.

SKILL.md content

macOS / Mach-O Reverse Engineering

When to Use

Analyzing macOS binaries or suspected malware samples.
Inspecting entitlements, signatures, and ObjC/Swift structures.

适用场景

Mach-O 可执行文件 / dylib / framework
.app bundle、LaunchAgent/Daemon
Objective-C / Swift 符号与 runtime
公证/签名、Hardened Runtime、TCC 相关行为分析
macOS 恶意软件静态/动态分析（联合 malware-analysis）

工作流

1. 包体与签名

file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target

2. 静态

□ class-dump / swift-demangle / Hopper / Ghidra / IDA
□ 字符串与 XPC 服务名、TCC 敏感 API
□ LC_LOAD_dylib 依赖与 rpath

3. 动态

□ lldb / Frida
□ fs_usage / log stream 观察
□ 网络：联合 protocol-reverse 或代理

工具链

| 工具 | 用途 |

|------|------|

| otool / nm / codesign | 系统自带 |

| Hopper / Ghidra / IDA | 反编译 |

| class-dump / dsdump | ObjC |

| Frida / lldb | 动态 |

| jtool2 | Mach-O |

参考

references/macho-triage.md
../mobile-reverse/（iOS） ../ghidra-reverse/ ../malware-analysis/

路由上下文

上游: MASTER R31

下游: iOS → mobile-reverse；通用样本 → malware-analysis

任务完成自检

[ ] 是否记录签名/Hardened Runtime 状态？
[ ] 是否有地址级/符号级结论？
[ ] Checklist？

Limitations

Apple Silicon and hardened runtime add unpacking complexity.
Do not disable SIP or other protections on the user’s working Mac as a routine debugging step. If dynamic analysis requires a different security posture, use a separately approved disposable lab and record its limitations; start with static signature, dependency and entitlement inspection.

> Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT).

Related skills

malware-analysis – Analyze suspected malware through static, dynamic, and behavioral techniques: IOC…
malware-analyst – Expert malware analyst specializing in defensive malware research, threat intelligence…
marketplace-rbac-audit – Audit multi-role marketplace authorization across roles, resource ownership, tenant…
markstream-migration – Audit and migrate an existing Markdown renderer to Markstream while preserving custom…
meme-coin-audit – Meme coin and token security audit
memory-forensics – Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory…
metasploit-framework – ⚠️ AUTHORIZED USE ONLY > This skill is for educational purposes or authorized security…
mid-engagement-ir-detection – Methodology for detecting client SOC patches, attacker activity, and security-state…

← Browse all skills