macOS & iOS software developer and reverse engineer, threat hunter. https://nitter.cf/t.co/WU6otwgsuh @noar@infosec.exchange
Fra
Joined August 2010
- Tweets1.7K
- Following787
- Followers1K
- Likes646
Happy Halloween (again) 🎃 BlackOutRadio is back online. Crunchy unstable electro and live underground bass music, all night and the ones after. Radio button, top right, on melomac.com
Happy Halloween 🎃 A UPX sample cut short of its last page, marker “ASS7” in place of “UPX!”, code XORed with 0x01: fashion 1.7.0 pads it, finds the pack header anyway, recovers the key and writes the unpacked Mach-O. Hash, thin, unsign, unpack, verify: melomac.com/fashion
fashion hashes files fast: SHA-2, ssdeep, TLSH, symhash, XAR TOC and CDHash macOS uses to identify code. v1.5.0 has many cleanup since v1: parsers hardened against crafted Mach-O, CDHash mirrors Security.framework, ADHOC included, tested against codesign melomac.com/fashion/
fashion 1.5: a Swift CLI that hashes macOS file trees — SHA-2, MD5, ssdeep, TLSH, symhash, XAR and the cdhash of Mach-O binaries, signed or not.
New: unsigned code gets the exact cdhash syspolicyd computes, decompiled out of Security.framework.
melomac.com/fashion
noar retweeted
The official IDA MCP Server is here. It's free, open source, and works with any LLM.
Your agent writes IDAPython, uses ~20% fewer tokens, and can share an IDB with you in real time.
𝚞𝚟𝚡 𝚒𝚍𝚊-𝚑𝚌𝚕𝚒 𝚖𝚌𝚙 𝚒𝚗𝚜𝚝𝚊𝚕𝚕
hex-rays.com/blog/hex-rays-i…
(copy-paste: uvx ida-hcli mcp install)
noar retweeted
This is false, any process running as root cannot read/lock this database. Thank you for your attention to this matter!
macOS 27 "Golden Gate" shipped today and un-fixed a bug I reported last year.
3 releases to seal XProtect's XPdb behavioral database; one build to reopen it. An inverted sandbox rule leaves it readable + lockable again. flock it → XProtect goes blind.
melomac.com/posts/xprotect-b…
macOS 27 "Golden Gate" shipped today and un-fixed a bug I reported last year.
3 releases to seal XProtect's XPdb behavioral database; one build to reopen it. An inverted sandbox rule leaves it readable + lockable again. flock it → XProtect goes blind.
melomac.com/posts/xprotect-b…
After an invitation to investigate the problem further, I decided to withdraw the post and summarize the updates here: melomac.com/posts/xprotect-b…
noar retweeted
How long before XCSSET 'evolves' and starts infecting JSON-based Xcode projects? 🤔 @noarfromspace
I don't think I ever swear on social media, but this one is worth it: holy shit! A JSON-based project format for Xcode! 🤯
ALT Xcode now supports a JSON-based project format (.xcproj) that’s more readable, merge-friendly, and easier for coding agents to edit. Enable it in the file inspector. Projects using .xcproj also open in earlier versions of Xcode 27.
fashion 1.2.0 is out 🎉
macOS 27 adds a third slice to every system binary, arm64e.x1. fashion now names slices exactly as codesign does, so nothing hides behind a plain arm64.
Hash, match and triage Mach-O: SHA-2, ssdeep, TLSH, CDHash, symhash.
codeberg.org/melomac/fashion…
New in fashion version 1.1.0: CodeDirectory detached ADHOC signature of unsigned Mach-O, syspolicyd style, a refactored Mach-O parser and an "adversarial code review" to prevent OOB and crashes. Swift, native, very fast: codeberg.org/melomac/fashion
fashion CLI v1.0.3 just got a new flag to compute the hash of a Mach-O file according to the Mach-O structure size, for when malware evade hash-based detection by appending garbage to the file — right after the structure data. codeberg.org/melomac/fashion
noar retweeted
Fun fact. Apple did this to me in 2019 over a messages 0-click bug. So I did some magic and got myself added to their daily bug bounty standup call, which was just a FaceTime group call. I submitted another vuln with a screenshot of their call and got a threatening letter.
Melomac's Homebrew tap is live on Codeberg — brew install a signed, notarized fashion binary 🍻
fashion is a Swift CLI for cryptographic and fuzzy hashing on macOS: CryptoKit, ssdeep, TLSH, CDHash, no dependency. melomac.com/posts/introducin…
Happy to share the release of fashion tool, to compute files—and match files according to—cryptographic digests. The project is written in Swift and supports many algorithms including CryptoKit Hash, SSDeep (C bridging), TLSH (C wrapper), SymHash, CDHash melomac.com/posts/introducin…
Obligé d’aller voir @AkimOmiri en zone neutre tellement il balance 🤘 Merci pour ce super spectacle, très personnel, tjr là où on t’attend pas mais ça parle : bravo 🙏😂
