macos-reverse
Helps your agent analyze programs on macOS to find flaws. It's useful for investigating security and analyzing malicious software on Apple platforms.
What it does
This tool helps investigate program files made for Mac computers (macOS). It allows understanding how these programs work internally, especially those dealing with security or built with languages like Objective-C and Swift.
When to use it
- ✓When you need to analyze a suspicious program on a Mac.
- ✓To understand how a program interacts with macOS's security system.
- ✓When trying to recover information from programs made in Objective-C or Swift.
Example of what to ask your AI
“Analyze this Mac program file for me and tell me if it seems safe.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
It uses specific tools to examine the program's structure, its security signatures, and how it behaves when running. This helps uncover its inner workings.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add zhaoxuya520/reverse-skill --skill macos-reverseOr download just the file:
curl -L https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/main/skills/macos-reverse/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
macOS / Mach-O Reverse Engineering
ACTION REQUIRED（读完后立刻执行）
NOW: 读取../field-journal/precedent-reverse.mdNOW: 确认目标为 macOS/Mach-O/App bundle（iOS IPA →mobile-reverse/）NEXT: tool-index；jtool2/lldb 等ACT: 签名与装载信息 → 静态 → 动态（lldb/Frida）
适用场景
- Mach-O 可执行文件 / dylib / framework
- .app bundle、LaunchAgent/Daemon
- Objective-C / Swift 符号与 runtime
- 公证/签名、Hardened Runtime、TCC 相关行为分析
- macOS 恶意软件静态/动态分析（联合 malware-analysis）
工作流
1. 包体与签名
file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target
2. 静态
□ class-dump / swift-demangle / Hopper / Ghidra / IDA
□ 字符串与 XPC 服务名、TCC 敏感 API
□ LC_LOAD_dylib 依赖与 rpath
3. 动态
□ lldb / Frida
□ fs_usage / log stream 观察
□ 网络：联合 protocol-reverse 或代理
工具链
| 工具 | 用途 |
|---|---|
| otool / nm / codesign | 系统自带 |
| Hopper / Ghidra / IDA | 反编译 |
| class-dump / dsdump | ObjC |
| Frida / lldb | 动态 |
| jtool2 | Mach-O |
参考
references/macho-triage.md../mobile-reverse/（iOS）../ghidra-reverse/../malware-analysis/
路由上下文
上游: MASTER R31
下游: iOS → mobile-reverse；通用样本 → malware-analysis
任务完成自检
- 是否记录签名/Hardened Runtime 状态？
- 是否有地址级/符号级结论？
- Checklist？
FAQ
What is a Mach-O file?
It's the standard file format for executables (programs) and libraries on macOS and iOS.
What is 'reverse engineering'?
It's the process of taking apart or analyzing a system or software to understand how it works, usually without having the original source code.
What are Objective-C and Swift?
They are programming languages used to create applications in the Apple ecosystem (macOS, iOS).
Details
Original description by the author
Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.
Popularity
- GitHub stars
- 42k
- Ranking position
- #4773
- License
- MIT
- Updated
- 9/22/2026
Comments
- …
More skills from this repository
competition-ad-certificate-abuse
Helps your agent analyze attacks on digital certificate systems. It investigates how certificates can be misused to gain access.
zhaoxuya520/reverse-skill
competition-agent-cloud
Helps your agent analyze security challenges in AI and cloud systems. It investigates how prompts, tools, and the cloud can be exploited.
zhaoxuya520/reverse-skill
competition-android-hooking
Helps your agent investigate Android applications. It analyzes how apps work internally and how they might be modified or exploited.
zhaoxuya520/reverse-skill
competition-browser-persistence
Helps your agent analyze how websites store information in your browser. It investigates cookies and other data to understand how sessions work.
zhaoxuya520/reverse-skill
Similar skills
benchmark-optimization-loop
Has your agent improve something's speed in a measured way. It tests multiple versions and chooses the fastest one that still works correctly.
affaan-m/ECC
change-impact
Helps your agent analyze the impact of code changes before making them. It compares the planned vs. actual results afterward, covering paths, data, tests, and documentation. Useful for risky or system-wide changes.
affaan-m/ECC
click-path-audit
Lets your agent trace all user buttons and interactions to find bugs. It finds issues where functions seem to work alone but fail together. Useful when bugs persist even after debugging.
affaan-m/ECC