gorelics

#research #dev #reverse #hunt #macOS

[gorelics @gorelics]

My collection of *OS vulnerability research write-ups, from twitter and personal blogs, thx a lot for this researches!

👉 https://t.co/fZvuXyLi06

[0xor0ne @0xor0ne]

Reverse engineering of the Valve Anti-Cheat (VAC)

https://t.co/91BDzimWW6

#infosec #reverseengineering

[Alex Plaskett @alexjplaskett]

CVE-2025-31200 - Triaging an ITW CoreAudio bug by @noahhw4646

https://t.co/5vH502BD0f

[noah @noahhw4646]

My writeup on CVE-2025-31200. This ones an interesting one https://t.co/z2AmzC8A4W. thanks to @bellis1000 for the shoutout.

[Nicolas Krassas @Dinosn]

CRADLE: Open-Source CTI Platform for Collaborative Threat Analysis https://t.co/MASzy4YzCC

[Depressed NSBeep(); 🇺🇦 @Krivoblotsky]

Today is the day. We are releasing the first Beta version of Eney - the first computerbeing. Our goal is to bring the Software 3.0 epoch closer, HCI is changing with the help of AI, and we are very excited to share our early work.
Join the waitlist: https://t.co/vmrWmk2Zke

[Watch This Space @wtsdev]

https://t.co/bMcswOV66f

It's a write-up a year in the... waiting. Enjoy everyone!

[J @Morpheus______]

"DisARMing" code - an exploration into systems programming, #debugging & #reverseEngineering on #Linux/#Android/#Darwin and #Aarch64! 510+ pages #book in COLOR(!)

https://t.co/IJdPuGsVAa for details, because there's more to detail than the margins of a Twitter message can hold.

[L0Psec @L0Psec]

New RE Video:
https://t.co/ssDOIFKPNy
Spent some time reversing a recent sample that uses a bit of obfuscation (made easier with a Binary Ninja script), sets up persistence, and uses curl APIs. This one is a little longer than usual but fun since I go through most of the sample.

[TrendAI Zero Day Initiative @thezdi]

An analysis of CVE-2024-44236 - an RCE in macOS due to the lack of proper validation of “lutAToBType” and “lutBToAType” tag types. Read the details, see the source code review, and get detection guidance at https://t.co/w9r8RPClRD

[L0Psec @L0Psec]

New RE video:
https://t.co/mOZu9oNQf1
Packed malware on Windows is common but not as common on macOS. In this video I go through two examples: one written in Rust with a simple embedded binary and another that de-obfuscates a mach-O and executes it. Also binja scripts :)

[Marcelo Rivero @MarceloRivero]

New #Odyssey macOS Stealer variant (#AMOS fork):

🪝 LaunchDaemon persistence → com .love.russia.plist
🏷️ Campaign tag: “strelka”
📥 Downloads .init stub from /otherassets/botnet
💳 New wallets: TonKeeper, Binance, Trezor, Dogecoin

https://t.co/pxjGiRV1bI

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft uncovered a vulnerability, tracked as CVE-2025-31191, in macOS that could allow specially crafted codes to escape the App Sandbox without user interaction and run unrestricted on systems. https://t.co/Twf9ezDSKk

[Mickey Jin @patch1t]

Exploit to escape the app sandbox:
1. Drop the exploit.aar from a sandboxed app
2. open exploit.aar (quarantined)
3. open https://t.co/DVBnEdFvSe from $TMPDIR
4. open ~/Downloads/poc.app (not quarantined)
(Step 3 is killed on the latest macOS, but should work on Sonoma)

[Snoolie (@snoolie.gay on bsky) @0xilis]

https://t.co/sTMPPqezFJ I'm excited to announce a writeup for CVE-2024-27876, a fun libAppleArchive bug I discovered back in April last year! I've also supplied an exploit maker for making a malformed aar to write to an arbitrary file.

[CryptoInsane @CryptoInsane]

Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger 🕵️‍♂️📱📡🇷🇺

https://t.co/v9VPYXEdLA

[Karol Mazurek @karmaz95]

Georgia Tech and Ruhr University Bochum researchers have uncovered new side-channel attacks on #Apple Silicon. My latest blog post briefly introduces these #vulnerabilities along with links to the full #research papers. Check it out to learn more:

https://t.co/AgHkBA5xr7

[gorelics @gorelics]

Pattern matching

[gorelics @gorelics]

If I'll find from 400$ to 2,000,000$ - it's last my game

[gorelics @gorelics]

I think it's just big data analytics

[L0Psec @L0Psec]

New RE video:
https://t.co/KrBo6AbWbC

Reversing a DPRK attributed app and focusing specifically on how the prompt to capture the user password works.
Allows me to talk about some of my favorite things: ObjC, Swift, and arm64 :)