How to use
- Copy the installation command and review the source package before installing it in your own agent environment.
- Check the source document for required tools, credentials and supported hosts.
- Describe your input and desired deliverable; review the output against the source material.
npx skills add https://github.com/zhaoxuya520/reverse-skill --skill macos-reverseBefore you start
- Installation does not include a model subscription, API allowance or permission to access your files.
- Repository stars and installation counts describe activity, not an independent quality or security test.
Original skill document
Rendered from the source repository. Headings, examples, code, tables, links, and referenced images are preserved.
macOS / Mach-O Reverse Engineering
ACTION REQUIRED（读完后立刻执行）
NOW: 读取../field-journal/precedent-reverse.mdNOW: 确认目标为 macOS/Mach-O/App bundle（iOS IPA →mobile-reverse/）NEXT: tool-index；jtool2/lldb 等ACT: 签名与装载信息 → 静态 → 动态（lldb/Frida）
适用场景
- Mach-O 可执行文件 / dylib / framework
- .app bundle、LaunchAgent/Daemon
- Objective-C / Swift 符号与 runtime
- 公证/签名、Hardened Runtime、TCC 相关行为分析
- macOS 恶意软件静态/动态分析（联合 malware-analysis）
工作流
1. 包体与签名
bash
file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target2. 静态
text
□ class-dump / swift-demangle / Hopper / Ghidra / IDA
□ 字符串与 XPC 服务名、TCC 敏感 API
□ LC_LOAD_dylib 依赖与 rpath3. 动态
text
□ lldb / Frida
□ fs_usage / log stream 观察
□ 网络：联合 protocol-reverse 或代理工具链
| 工具 | 用途 |
|---|---|
| otool / nm / codesign | 系统自带 |
| Hopper / Ghidra / IDA | 反编译 |
| class-dump / dsdump | ObjC |
| Frida / lldb | 动态 |
| jtool2 | Mach-O |
参考
references/macho-triage.md../mobile-reverse/（iOS）../ghidra-reverse/../malware-analysis/
路由上下文
上游: MASTER R31 下游: iOS → mobile-reverse；通用样本 → malware-analysis
任务完成自检
- [ ] 是否记录签名/Hardened Runtime 状态？
- [ ] 是否有地址级/符号级结论？
- [ ] Checklist？
