SkillsAdd

zhaoxuya520/reverse-skill

macos-reverse

Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

Trending #7345 First seen Jul 18, 2026

Installation

$ npx skills add zhaoxuya520/reverse-skill --skill macos-reverse
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

frontend-design Same topic
anthropics/skills

Guidance for distinctive, intentional visual design when building new UI or reshaping an existi…

866.4K installs
agent-browser Same topic
vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…

810.4K installs
vercel-react-best-practices Same topic
vercel-labs/agent-skills 697.8K installs
web-design-guidelines Same topic
vercel-labs/agent-skills

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "chec…

617.3K installs
microsoft-foundry Same topic
microsoft/azure-skills

Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and …

576.5K installs
azure-diagnostics Same topic
microsoft/azure-skills

Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe …

568.9K installs

Also in this package

Other skills from zhaoxuya520/reverse-skill · top by installs.

npx skills add zhaoxuya520/reverse-skill
reverse-engineering 1.1K apk-reverse 14 ida-reverse 13 pentest-tools 12 radare2 12 binary-diff 13 diagram-generator 14 firmware-pentest 12 edr-bypass-re 13 patch-diff-exploit 14

Browse all from zhaoxuya520/reverse-skill

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 35.1K
License LICENSE
Default branch main
Open issues 2
Status Active

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 1,823 B
  • docs SUMMARY.md 189 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 638 installs

SKILL.md

macOS / Mach-O Reverse Engineering

ACTION REQUIRED（读完后立刻执行）

  1. NOW: 读取 ../field-journal/precedent-reverse.md
  2. NOW: 确认目标为 macOS/Mach-O/App bundle（iOS IPA → mobile-reverse/）
  3. NEXT: tool-index；jtool2/lldb 等
  4. ACT: 签名与装载信息 → 静态 → 动态（lldb/Frida）

适用场景

  • Mach-O 可执行文件 / dylib / framework
  • .app bundle、LaunchAgent/Daemon
  • Objective-C / Swift 符号与 runtime
  • 公证/签名、Hardened Runtime、TCC 相关行为分析
  • macOS 恶意软件静态/动态分析（联合 malware-analysis）

工作流

1. 包体与签名

file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target

2. 静态

□ class-dump / swift-demangle / Hopper / Ghidra / IDA
□ 字符串与 XPC 服务名、TCC 敏感 API
□ LC_LOAD_dylib 依赖与 rpath

3. 动态

□ lldb / Frida
□ fs_usage / log stream 观察
□ 网络：联合 protocol-reverse 或代理

工具链

工具 用途
otool / nm / codesign 系统自带
Hopper / Ghidra / IDA 反编译
class-dump / dsdump ObjC
Frida / lldb 动态
jtool2 Mach-O

参考

  • references/macho-triage.md
  • ../mobile-reverse/（iOS） ../ghidra-reverse/ ../malware-analysis/

路由上下文

上游: MASTER R31 下游: iOS → mobile-reverse；通用样本 → malware-analysis

任务完成自检

  • 是否记录签名/Hardened Runtime 状态？
  • 是否有地址级/符号级结论？
  • Checklist？