fG!

MachOView. MachOView fork

Gdbinit. Gdbinit for OS X, iOS and others - x86, x86_64 and ARM

lldbinit. A gdbinit clone for LLDB

firmware_vault. A repo for all Apple EFI firmware files

readmem. A small OS X/iOS userland util to dump processes memory

onyx-the-black-cat. Kernel extension to disable anti-debug tricks and other useful XNU "features"

HexRaysDeob. Hex-Rays OLLVM Deobfuscator and MicroCode Explorer

rootfool. A small tool to dynamically disable and enable SIP in El Capitan

EFISwissKnife. An IDA plugin to improve (U)EFI reversing

hydra. A kernel extension and userland daemon to patch applications

otool-ng. Some improvements to Apple's otool.

efi_dxe_emulator. EFI DXE Emulator and Interactive Debugger

gopher. A OS X crypto ransomware PoC

mach_race. Exploit code for CVE-2016-1757

pydbg64. PyDBG64 - OS X PyDbg with 64 bits support

mpress_dumper. MPRESS dumper for OS X

osx_boubou. A PoC Mach-O infector via library injection

ExtractMachO. IDA plugin to extract Mach-O binaries located in the disassembly or data

gdb-ng. Apple's gdb fork with some fixes and enhancements

gimmedebugah. A small utility to inject a Info.plist into binaries.

Gatekeerper. A kernel extension to mitigate Gatekeeper bypasses

can_I_suid. A TrustedBSD module to control execution of binaries with suid bit set

crackme_nr1. fG!'s crackme #1 source code

kextstat_aslr. Implementation of kexstat via /dev/kmem with kernel ASLR support

unicorn_string_deobfuscator. A Unicorn based emulator to deobfuscate Equation Group string XOR obfuscation

bruteforcesysent. Small util to discover OS X sysent via bruteforce

tcplognke. Apple's tcplognke code sample

MicrocodeExplorer. Hex-Rays MicrocodeExplorer

TELoader. A TE executable format loader for IDA

mario. The kernel component of rootpipe fix for Mavericks

rex_versus_the_romans. Anti Hacking Team TrustedBSD module

adium-ng-preview. Repo to dump some preview info and builds for adium-ng

readkmem. small utility to dump kernel memory

readphysmem. A small utility to read and write to Macs physical memory using default AppleHWAccess.kext.

llvmpatches. Misc llvm patches

sx4. A quick'n'dirty static deobfuscator for TNT team x86_64 crack library

armorysandbox. A USB armory based USB sandbox

hello_santa_bye_santa. Bypass Google's Santa

fixobjc. IDA IDC script to improve Objective-C disassembly output

ExtractMacho2. IDA plugin to extract Mach-O binaries located in the disassembly or data

checkidt. Small util to dump the IDT table of a running OS X system with kmem enabled

MachOPlugin. IDA plugin to Display Mach-O headers

clownpertino. A simple macOS debugger detection trick

icetheguardianv2. A TrustedBSD module PoC to monitor writes to Daemons and Agents folders

age. A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

diagnostic_service. OS X rootkit loader version #1

syscall-benchmark. macOS syscall performance benchmark

kgmacros. Fixed kgmacros to work with VMware kernel gdb stub

carbon_copy_cloner_keychaingen. A keygen for Carbon Copy Cloner private keychain

av-monster. PoC kext to disable OS X anti-virus software

luigi. The userland component of rootpipe fix for Mavericks

Crisis-Analysis-Tools. Scripts and other material related to OS.X/Crisis malware analysis

calcspace. Small util to calculate available free space in mach-o binaries for code injection

idc-scripts. Random collection of IDA's IDC scripts

GiveMeHex. A quick IDA hack to get addresses with 0x prefix

Disable-m3u. iTunes plugin to disable creation of m3u playlists

rexthewonderdog. A lazy PoC for implementing backdoors in OS X TrustedBSD Mac framework.

how_crap_is_ida. An IDA plugin to compare IDA detected functions output versus LC_FUNCTION_STARTS information

twitterwipe. A Go utillty to delete your Twitter history

santa. A binary whitelisting/blacklisting system for Mac OS X