cpus.me

macOS Forensic Artifact Browser

Sat, 08 Aug 2026 00:30:00 +0200

A searchable index of 313 macOS forensic artifacts collectable from a live system, covering macOS 13 Ventura through macOS 26. Each entry records where the artifact lives, how to collect it, what privilege the collection requires, and what investigative question it answers.

Root alone is not sufficient on macOS 13 and later. TCC applies regardless of uid, so a root process without Full Disk Access gets EPERM on Mail, Messages, Safari data, the user’s Desktop, Documents and Downloads, and on TCC.db itself. Every entry declares its access tier, so you can filter for exactly what a given privilege level can reach.

Richard W. Hamming: "Learning to Learn" lectures

Mon, 11 May 2026 00:00:00 +0000

If I’d be to go back in time, maybe 10 years or even longer, looking to meet someone that would give me great career and life advice, I wish they would just say:

here’s a link to what you need: https://youtube.com/playlist?list=PL2FF649D0C4407B30&si=Ds00rOA8WHSyI3ZD

Those are Richard W. Hamming’s lectures on “Learning to Learn”. Each of them contains valuable advice. (Thanks @securitylectures for sharing that content).

Complementary to this is Hamming’s book - The Art of Doing Science and Engineering. In fact, the book is based on these lectures. This book is one of my favourite.

XProtect and XProtect BehaviorService: previous research

Thu, 16 Apr 2026 00:00:00 +0000

Recently started looking into macOS’ XProtect and its satellites. There are a few interesting presentations and articles from previous research done in the last years. I mainly want to capture some of the ones that I already went through and found valuable before I publish some of my own findings, learnings and failures.

The following two presentations are particularly interesting on what XProtect is and XProtect Remediator:

I heard about XProtect before, maybe around end of 2024 or so, but never had the interest to research it. But with some of the latest updates related to clipboard pasting and ClickFix campaigns, my interest grew so I started looking into how this works. My own research, so far, for this XProtect feature hasn’t uncovered anything new than what is detailed in this high quality research done by Patrick Wardle.

Latest goodies January #1

Mon, 26 Jan 2026 22:13:38 +0100

A bit of time has passed since my last post. Many interesting things have happened in the tech world. Gathered some of the most interesting resources that I read or watched in the last 2 months, although the list is not comprehensive and I might have not captured all of them.

Reading

Videos

Chatting with Robert Xiao from PPP | 023 CTF Radiooo

I haven’t played CTFs seriously for the last 4 years or so (although still very interested in them, but no much free time anymore), but seeing the title of the video it was a no brainer that I want to watch it! Robert Xiao is a well-known and very successful CTF player.

A quick first look at macOS PowerLogs

Sun, 09 Nov 2025 13:58:41 +0100

Intro

Hi there!

As I mentioned in my previous post - Latest goodies October #1 - there were a few interesting presentations at OBTS v8.0 which motivated me to learn more about macOS and *OS platforms. One of the most interesting ones was Sarah Edwards’s - The Power of Powerlogs. All presentations, slides and videos are on OBTS - Talks page. I was aware of macOS’ powerlogs (most probably from Sarah’s blog), however I never spent time investigating them in detail and learning about their structure. This time it seems like a good opportunity to do so.

Latest goodies October #1

Sun, 26 Oct 2025 22:35:17 +0100

Interesting readings

I’m Building a Browser for Reverse Engineers

Nice article about browser hacking for reverse engineering and different approaches to reverse engineering JavaScript code. Worth reading! There are some other interesting articles on the same blog on related topics. See: https://nullpt.rs

Some useful tools mentioned in the blogpost:

The well known JavaScript deobfuscator powering deobfuscate.io: https://github.com/ben-sb/javascript-deobfuscator
electron-browser-shell

First time I saw the article it was on HN. There are a couple of interesting comments throughout the comments section. One of them mentions an instrumented version of V8 JavaScript Engine, which I found intriguing and worth exploring further: https://github.com/wspr-ncsu/visiblev8

Latest goodies September #2

Fri, 26 Sep 2025 09:44:50 +0200

A few things worth mentioning from the past weeks.

Interesting readings

detections.ai

Not really a reading reference but an interesting resource for detection and response practitioners. At a glance, it is

Community Inspired. AI Enhanced. Better Detections.

It is possible to filter detections by rule language, category, platform and more. I find platform labels and MITRE ATT&CK labels very useful for quickly extracting detection rules for specific platforms and techniques that align with your threat model and might enhance your detection capabilities.

Latest goodies September #1

Fri, 19 Sep 2025 23:08:27 +0200

A few things worth mentioning from the past weeks.

Interesting readings

Interesting podcasts

Why ML Needs a New Programming Language

cpus.me

macOS Forensic Artifact Browser

Richard W. Hamming: "Learning to Learn" lectures

XProtect and XProtect BehaviorService: previous research

Latest goodies January #1

Reading

Videos

Chatting with Robert Xiao from PPP | 023 CTF Radiooo

A quick first look at macOS PowerLogs

Intro

Latest goodies October #1

Interesting readings

I’m Building a Browser for Reverse Engineers

Latest goodies September #2

Interesting readings

Latest goodies September #1

Interesting readings

Interesting podcasts

Interesting videos