@noarfromspace

macOS & iOS software developer and reverse engineer, threat hunter. https://xitter.cf/t.co/WU6otwgsuh @noar@infosec.exchange

 Fra
melomac.com
Joined August 2010
  • Tweets1.7K
  • Following788
  • Followers1K
143Media
fashion hashes files fast: SHA-2, ssdeep, TLSH, symhash, XAR TOC and CDHash macOS uses to identify code. v1.5.0 has many cleanup since v1: parsers hardened against crafted Mach-O, CDHash mirrors Security.framework, ADHOC included, tested against codesign melomac.com/fashion/
1
4
175
fashion 1.5: a Swift CLI that hashes macOS file trees — SHA-2, MD5, ssdeep, TLSH, symhash, XAR and the cdhash of Mach-O binaries, signed or not. New: unsigned code gets the exact cdhash syspolicyd computes, decompiled out of Security.framework. melomac.com/fashion
1
81
The official IDA MCP Server is here. It's free, open source, and works with any LLM. Your agent writes IDAPython, uses ~20% fewer tokens, and can share an IDB with you in real time. 𝚞𝚟𝚡 𝚒𝚍𝚊-𝚑𝚌𝚕𝚒 𝚖𝚌𝚙 𝚒𝚗𝚜𝚝𝚊𝚕𝚕 hex-rays.com/blog/hex-rays-i… (copy-paste: uvx ida-hcli mcp install)
33
220
16
1,415
144,286
This is false, any process running as root cannot read/lock this database. Thank you for your attention to this matter!
noar@noarfromspaceSep 14
macOS 27 "Golden Gate" shipped today and un-fixed a bug I reported last year. 3 releases to seal XProtect's XPdb behavioral database; one build to reopen it. An inverted sandbox rule leaves it readable + lockable again. flock it → XProtect goes blind. melomac.com/posts/xprotect-b…
2
2
4
747
macOS 27 "Golden Gate" shipped today and un-fixed a bug I reported last year. 3 releases to seal XProtect's XPdb behavioral database; one build to reopen it. An inverted sandbox rule leaves it readable + lockable again. flock it → XProtect goes blind. melomac.com/posts/xprotect-b…
1
4
1
21
2,467
After an invitation to investigate the problem further, I decided to withdraw the post and summarize the updates here: melomac.com/posts/xprotect-b…

XProtect behavioral flop

We discuss a bug in XProtect behavior events abused in the wild in the current XCSSET malware campaign, then we explain why XProtect behavioral telemetry is fundamentally flawed.

melomac.com
1
48
How long before XCSSET 'evolves' and starts infecting JSON-based Xcode projects? 🤔 @noarfromspace
Paul Hudson
@twostrawsSep 16
I don't think I ever swear on social media, but this one is worth it: holy shit! A JSON-based project format for Xcode! 🤯
Xcode now supports a JSON-based project format (.xcproj) that’s more readable, merge-friendly, and easier for coding agents to edit. Enable it in the file inspector. Projects using .xcproj also open in earlier versions of Xcode 27.

ALT Xcode now supports a JSON-based project format (.xcproj) that’s more readable, merge-friendly, and easier for coding agents to edit. Enable it in the file inspector. Projects using .xcproj also open in earlier versions of Xcode 27.

1
3
15
3,057
fashion 1.2.0 is out 🎉 macOS 27 adds a third slice to every system binary, arm64e.x1. fashion now names slices exactly as codesign does, so nothing hides behind a plain arm64. Hash, match and triage Mach-O: SHA-2, ssdeep, TLSH, CDHash, symhash. codeberg.org/melomac/fashion…

fashion

Compute and match file cryptographic or fuzzy hash digests, for threat hunting and binary triage on macOS

codeberg.org
5
14
714
New in fashion version 1.1.0: CodeDirectory detached ADHOC signature of unsigned Mach-O, syspolicyd style, a refactored Mach-O parser and an "adversarial code review" to prevent OOB and crashes. Swift, native, very fast: codeberg.org/melomac/fashion

fashion

Compute and match file cryptographic or fuzzy hash digests, for threat hunting and binary triage on macOS

codeberg.org
4
222
fashion CLI v1.0.3 just got a new flag to compute the hash of a Mach-O file according to the Mach-O structure size, for when malware evade hash-based detection by appending garbage to the file — right after the structure data. codeberg.org/melomac/fashion
2
1
394
I like to think I'm the reason why they use WebEx now.
5
3
1,578
78,101
Fun fact. Apple did this to me in 2019 over a messages 0-click bug. So I did some magic and got myself added to their daily bug bounty standup call, which was just a FaceTime group call. I submitted another vuln with a screenshot of their call and got a threatening letter.
Mysk 🇨🇦🇩🇪
@mysk_coMay 28
We will no longer submit bugs we discover in Apple systems through Apple Bounty Program.
71
547
39
15,783
1,240,783
Melomac's Homebrew tap is live on Codeberg — brew install a signed, notarized fashion binary 🍻 fashion is a Swift CLI for cryptographic and fuzzy hashing on macOS: CryptoKit, ssdeep, TLSH, CDHash, no dependency. melomac.com/posts/introducin…

Introducing fashion command-line tool

Compute and match file cryptographic or fuzzy hash digests, for threat hunting and binary triage on macOS.

melomac.com
1
4
224
Happy to share the release of fashion tool, to compute files—and match files according to—cryptographic digests. The project is written in Swift and supports many algorithms including CryptoKit Hash, SSDeep (C bridging), TLSH (C wrapper), SymHash, CDHash melomac.com/posts/introducin…

Introducing fashion command-line tool

Compute and match file cryptographic or fuzzy hash digests, for threat hunting and binary triage on macOS.

melomac.com
6
442
Does anyone else just drink hot water, or is that weird?
8
1
1
11
4,319
Obligé d’aller voir @AkimOmiri en zone neutre tellement il balance 🤘 Merci pour ce super spectacle, très personnel, tjr là où on t’attend pas mais ça parle : bravo 🙏😂
201
This video sums up what a man should be 💯
11
387
9
1,773
69,683
Still searching for a full time job. Please spread the word
9
33
2
82
26,450
Well, I’m officially homeless. If anyone can help out with a job I’d be forever in your debt
178
198
27
1,836
261,323
Spent months helping App Stores take down fake apps. Now LinkedIn thinks I’m perfect for a “Store Assistant” job 👨‍💼 Guess it’s time to scan barcodes instead of scam apps. CFBR folks, hook me up with a role at your nearest Zepto/Blinkit dark store.
8
1
19
1,331
Load more