{
  "added_at": "2026-11-09",
  "additional_evidence_urls": [
    "https://github.com/Karmaz95/Snake_Apple/blob/ef5aca06a00c4627de16ce8983b17a897a7ce138/TOOLS.md",
    "https://github.com/Karmaz95/Snake_Apple/blob/ef5aca06a00c4627de16ce8983b17a897a7ce138/Article_tags.md",
    "https://github.com/Karmaz95/Snake_Apple/blob/ef5aca06a00c4627de16ce8983b17a897a7ce138/requirements.txt",
    "https://github.com/Karmaz95/Snake_Apple/blob/ef5aca06a00c4627de16ce8983b17a897a7ce138/LICENSE",
    "https://github.com/Karmaz95/Snake_Apple/tree/ef5aca06a00c4627de16ce8983b17a897a7ce138/tests"
  ],
  "category": "learning",
  "description_en": "Code repository for Karol Mazurek’s Snake & Apple article series on macOS internals and security research. Chapters cover Mach-O, code signing, binary hardening checks, dylibs and dyld, AMFI, antivirus components, the App Sandbox and SIP, TCC and the XNU kernel, plus app bundles, and the README links each article and its follow-ups. CrimsonUroboros, the series’ LIEF-based Python analysis tool, grows with each chapter and groups its options by those topics, and smaller scripts parse trust caches, code signatures, sandbox profiles and TCC databases.",
  "description_zh": "Karol Mazurek 的 Snake & Apple 系列文章的代码仓库，内容是 macOS 内部机制与安全研究。各章涵盖 Mach-O、代码签名、二进制加固检查、dylib 与 dyld、AMFI、防病毒组件、App Sandbox 与 SIP、TCC 和 XNU 内核，另有应用包相关主题，README 链接了每篇文章及其后续文章。系列的核心工具 CrimsonUroboros 基于 LIEF 用 Python 编写，随章节逐步扩充，并按上述主题分组提供选项；另有一些小脚本用于解析信任缓存、代码签名、沙盒配置文件和 TCC 数据库。",
  "entry_url": "https://awesomerea.org/resources/snake-apple-macos-security-series/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/snake-apple-macos-security-series/",
  "evidence_url": "https://github.com/Karmaz95/Snake_Apple/blob/ef5aca06a00c4627de16ce8983b17a897a7ce138/README.md",
  "group": "learn",
  "id": "snake-apple-macos-security-series",
  "json_url": "https://awesomerea.org/resources/snake-apple-macos-security-series/record.json",
  "kind": "learning-resource",
  "markdown_url": "https://awesomerea.org/resources/snake-apple-macos-security-series/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/snake-apple-macos-security-series/index.md",
  "name": "Snake & Apple: macOS internals and security article series",
  "name_zh": "Snake & Apple：macOS 内部机制与安全系列文章",
  "record_type": "resource",
  "relationship": "learning",
  "requirements": [
    "Articles are hosted on Medium, Patreon and the AFINE blog, with one in Phrack. Asterisk-marked articles require paid Patreon access; the Apple Intelligence chapter is unfinished.",
    "The tools target macOS and Mach-O files. CrimsonUroboros needs Python and pinned dependencies including LIEF 0.15.1, pyimg4, asn1crypto, treelib, xattr and python-magic. Chapter directories retain earlier versions.",
    "Each chapter’s mac folder holds macOS source for reference and copies of presentations. The repository includes third-party PDFs and a decompiler listing of a private Apple LaunchServices function; their redistribution terms are unspecified.",
    "The repository declares GPL-3.0. Apple software, decompiled Apple code and third-party presentations retain their own rights. A test module covers CrimsonUroboros."
  ],
  "requirements_zh": [
    "文章发布于 Medium、Patreon 和 AFINE 博客，另有一篇刊于 Phrack。带星号的文章需付费 Patreon 权限；Apple Intelligence 章节尚未完成。",
    "工具针对 macOS 和 Mach-O 文件。CrimsonUroboros 需要 Python 及固定依赖，包括 LIEF 0.15.1、pyimg4、asn1crypto、treelib、xattr 和 python-magic。各章目录保留早期版本。",
    "各章的 mac 文件夹存放供参考的 macOS 源码和演讲资料副本。仓库包含第三方 PDF 和 Apple 私有 LaunchServices 函数的反编译清单；其再分发条款未写明。",
    "仓库声明采用 GPL-3.0。Apple 软件、反编译出的 Apple 代码和第三方演讲资料仍受各自权利约束。一个测试模块覆盖 CrimsonUroboros。"
  ],
  "targets": [
    "app",
    "binary"
  ],
  "url": "https://github.com/Karmaz95/Snake_Apple",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}