# Snake & Apple: macOS internals and security article series

> Code repository for Karol Mazurek’s Snake & Apple article series on macOS internals and security research. Chapters cover Mach-O, code signing, binary hardening checks, dylibs and dyld, AMFI, antivirus components, the App Sandbox and SIP, TCC and the XNU kernel, plus app bundles, and the README links each article and its follow-ups. CrimsonUroboros, the series’ LIEF-based Python analysis tool, grows with each chapter and groups its options by those topics, and smaller scripts parse trust caches, code signatures, sandbox profiles and TCC databases.

- Type: Learning resource
- Targets: App · Binary
- Category: Learning resources
- Relationship: Learning resource
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-09
- Original resource: <https://github.com/Karmaz95/Snake_Apple>
- Primary source: <https://github.com/Karmaz95/Snake_Apple/blob/ef5aca06a00c4627de16ce8983b17a897a7ce138/README.md>
- Catalog page: <https://awesomerea.org/resources/snake-apple-macos-security-series/>
- Record JSON: <https://awesomerea.org/resources/snake-apple-macos-security-series/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/snake-apple-macos-security-series/index.md)

## Requirements & limits

- Articles are hosted on Medium, Patreon and the AFINE blog, with one in Phrack. Asterisk-marked articles require paid Patreon access; the Apple Intelligence chapter is unfinished.
- The tools target macOS and Mach-O files. CrimsonUroboros needs Python and pinned dependencies including LIEF 0.15.1, pyimg4, asn1crypto, treelib, xattr and python-magic. Chapter directories retain earlier versions.
- Each chapter’s mac folder holds macOS source for reference and copies of presentations. The repository includes third-party PDFs and a decompiler listing of a private Apple LaunchServices function; their redistribution terms are unspecified.
- The repository declares GPL-3.0. Apple software, decompiled Apple code and third-party presentations retain their own rights. A test module covers CrimsonUroboros.

## Primary sources

1. <https://github.com/Karmaz95/Snake_Apple/blob/ef5aca06a00c4627de16ce8983b17a897a7ce138/README.md>
2. <https://github.com/Karmaz95/Snake_Apple/blob/ef5aca06a00c4627de16ce8983b17a897a7ce138/TOOLS.md>
3. <https://github.com/Karmaz95/Snake_Apple/blob/ef5aca06a00c4627de16ce8983b17a897a7ce138/Article_tags.md>
4. <https://github.com/Karmaz95/Snake_Apple/blob/ef5aca06a00c4627de16ce8983b17a897a7ce138/requirements.txt>
5. <https://github.com/Karmaz95/Snake_Apple/blob/ef5aca06a00c4627de16ce8983b17a897a7ce138/LICENSE>
6. <https://github.com/Karmaz95/Snake_Apple/tree/ef5aca06a00c4627de16ce8983b17a897a7ce138/tests>

## More in References and learning

- [Compiler Explorer](https://awesomerea.org/resources/compiler-explorer/index.md) · Learning resource
- [DecBench](https://awesomerea.org/resources/decbench/index.md) · Research
- [Little Big Adventure engine architecture](https://awesomerea.org/resources/lba-engine-architecture/index.md) · Learning resource
- [IDA Pro guide](https://awesomerea.org/resources/ida-pro-guide/index.md) · Learning resource
- [PAN GlobalProtect protocol documentation](https://awesomerea.org/resources/pan-globalprotect-protocol-doc/index.md) · Documentation
- [MiiTube](https://awesomerea.org/resources/miitube-format/index.md) · Documentation

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.