Learning resource

Snake & Apple: macOS internals and security article series

Code repository for Karol Mazurek’s Snake & Apple article series on macOS internals and security research. Chapters cover Mach-O, code signing, binary hardening checks, dylibs and dyld, AMFI, antivirus components, the App Sandbox and SIP, TCC and the XNU kernel, plus app bundles, and the README links each article and its follow-ups. CrimsonUroboros, the series’ LIEF-based Python analysis tool, grows with each chapter and groups its options by those topics, and smaller scripts parse trust caches, code signatures, sandbox profiles and TCC databases.

Targets: App · Binary
Category: Learning resources
Relationship: Learning resource
Sources reviewed: 2026-10-27

Stars: 302
Last commit: 2026-10-04
Language: Python
License (GitHub): GPL-3.0

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

Articles are hosted on Medium, Patreon and the AFINE blog, with one in Phrack. Asterisk-marked articles require paid Patreon access; the Apple Intelligence chapter is unfinished.
The tools target macOS and Mach-O files. CrimsonUroboros needs Python and pinned dependencies including LIEF 0.15.1, pyimg4, asn1crypto, treelib, xattr and python-magic. Chapter directories retain earlier versions.
Each chapter’s mac folder holds macOS source for reference and copies of presentations. The repository includes third-party PDFs and a decompiler listing of a private Apple LaunchServices function; their redistribution terms are unspecified.
The repository declares GPL-3.0. Apple software, decompiled Apple code and third-party presentations retain their own rights. A test module covers CrimsonUroboros.

Cite

BibTeX

@misc{snake-apple-macos-security-series,
  title = {{Snake \& Apple: macOS internals and security article series}},
  howpublished = {\url{https://github.com/Karmaz95/Snake_Apple}},
  url = {https://github.com/Karmaz95/Snake_Apple},
  urldate = {2026-10-27},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/snake-apple-macos-security-series/}}
}

Plain text

Snake & Apple: macOS internals and security article series. https://github.com/Karmaz95/Snake_Apple (accessed 2026-10-27). Awesome REA entry: https://awesomerea.org/resources/snake-apple-macos-security-series/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · Karmaz95/Snake_Apple · Revision ef5aca0
TOOLS.md GitHub · Karmaz95/Snake_Apple · Revision ef5aca0
Article_tags.md GitHub · Karmaz95/Snake_Apple · Revision ef5aca0
requirements.txt GitHub · Karmaz95/Snake_Apple · Revision ef5aca0
LICENSE GitHub · Karmaz95/Snake_Apple · Revision ef5aca0
tests GitHub · Karmaz95/Snake_Apple · Revision ef5aca0