skills.rest
chengzongcai
chengzongcaiCOMMUNITY
Explore all skills by this author →
GitHub

macos-reverse

Analyzes macOS Mach-O binaries, app bundles, and malware through static and dynamic reverse engineering.

21|8|Updated Aug 3, 2026
Search Tags:#macos#reverse engineering#objective-c#frida#codesign#malware analysis#mach-o
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill macos-reverse-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: macos-reverse
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/macos-reverse
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill macos-reverse-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Reverse engineering macOS binaries requires knowing the right sequence of signature checks, static analysis, and dynamic tracing tools. This Skill provides a structured workflow for analyzing Mach-O executables, .app bundles, and Apple platform malware without guessing commands. ## Core Features & Use Cases - Signature and Entitlement Triage: Inspect code signing, Hardened Runtime status, entitlements, and dylib dependencies using codesign, spctl, and otool. - Static and Dynamic Analysis: Recover Objective-C/Swift symbols with class-dump and disassemblers, then trace behavior with lldb, Frida, and fs_usage. - Use Case: Given a suspicious LaunchAgent binary on macOS, follow the workflow to verify its signature, dump its Objective-C classes, identify TCC-sensitive API usage, and observe its runtime network and file activity. ## Quick Start Analyze this macOS binary for its code signature, entitlements, Objective-C classes, and runtime behavior using the macOS reverse engineering workflow.

Frequently Asked Questions about macos-reverse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer a Mach-O binary on macOS?▼

Start with signature triage using codesign -dv and otool -L to check signing status and library dependencies. Then perform static analysis with class-dump, Hopper, or Ghidra, followed by dynamic tracing with lldb or Frida.

What tools are used for macOS malware analysis?▼

The workflow uses built-in tools like otool, nm, and codesign for triage, class-dump and dsdump for Objective-C recovery, Hopper, Ghidra, or IDA for decompilation, and lldb or Frida for dynamic analysis.

How do I check entitlements and Hardened Runtime on a macOS app?▼

Run codesign -d --entitlements on the target to list entitlements such as com.apple.security.* keys, and use spctl -a -vv to verify Gatekeeper assessment. The codesign verbose output also reveals Hardened Runtime flags.

Does this workflow cover iOS IPA files?▼

No, iOS IPA analysis is routed to the separate mobile-reverse skill. This workflow targets macOS Mach-O executables, dylibs, frameworks, .app bundles, and LaunchAgents or LaunchDaemons.

When should I use dynamic analysis instead of static analysis on macOS?▼

Use dynamic analysis with lldb, Frida, or fs_usage when static results are inconclusive, such as with packed or obfuscated binaries. Dynamic tracing reveals runtime network activity, file access, and XPC service interactions.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.7k

malware-analysis-methodology

Analyze suspicious PE, ELF, and Mach-O binaries through static, dynamic, and IOC extraction workflows.

Official
Advanced
xalgordxalgord
954

performing-static-malware-analysis-with-pe-studio

Analyzes Windows PE malware samples statically using PEStudio, pefile, and FLOSS to extract indicators.

Community
Advanced
YukiIto1999YukiIto1999

reverse-engineering-malware-with-ghidra

Reverse-engineer Windows malware binaries with Ghidra to map C2 protocols and evasion techniques.

Community
Advanced
woxiangyangzhimaowoxiangyangzhimao
3

app-reverse

Identify and decode encrypted parameters from Android and iOS applications.

Community
Advanced