AwesomeREA.org

Learning resource

osx & ios re 101

A single-README reading list for macOS (OS X) and iOS reverse engineering, kept by Michal Malik from 2015 to 2019 and labelled a work in progress. Its 98 entries in nine sections run from must-read blogs and Mach-O, ABI and system-call references through Mach-O basics, malware, anti-debugging and obfuscation write-ups, kernel, sandbox and jailbreak research, kernel-extension development and kernel debugging, and forensics and monitoring material, to crackmes and six books. Entries are bare links or titles, mostly with no annotation.

Requirements & limits

  • The reviewed commit, from 2019-12-19 and the latest, closes a history of 69 commits that began on 2015-07-13. Most linked material targets OS X 10.x and iOS 8–10 era internals, such as El Capitan kernels and iOS 9 and 10 jailbreak analyses, and the list predates current macOS and iOS releases and Apple silicon Macs. A December 2019 commit replaced some broken and outdated links, but this collection did not check whether the remaining links still resolve.
  • No target files are supplied or needed by the list itself; the linked tutorials and crackmes bring their own samples, and the books are listed by title only. Following the material assumes a Mac or iOS device and the tools each article uses, such as LLDB, Hopper, and VMware Fusion or VirtualBox for kernel debugging.
  • The list mixes analysis tutorials with malware infection, rootkit, privilege-escalation and jailbreak write-ups; this entry presents it as background reading for analysis only. The repository contains only README.md and no license file, so the list states no reuse terms, and linked works keep their own rights. This collection reviewed the README and commit history without reading the linked works, and the list makes no mention of AI or REA.

About this entry

Type
Learning resource
Category
Learning resources
Relationship
Learning resource
Targets
App · Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · michalmalik/osx-re-101 · Revision 486f33a
  2. https://github.com/michalmalik/osx-re-101/tree/486f33adf35848735327d9a83a05f9abd0f18af7
  3. https://github.com/michalmalik/osx-re-101/commits/486f33adf35848735327d9a83a05f9abd0f18af7

More in References and learning

All 50 entries in References and learning