macOS for Hackers

About this course

This intermediate course explains how macOS works from a security point of view. You set up a test Mac or VM you own, then study the Darwin core, the hybrid XNU kernel and the Mach-O binary format with file and otool. You work in the Unix layer with zsh, APFS, permissions, ACLs and the quarantine attribute. The core of the course is the Apple security stack: SIP, Gatekeeper and notarization, TCC privacy controls and code signing with codesign and spctl. You learn how launchd agents and daemons provide persistence and where responders look first, how the Keychain and FileVault protect secrets, and what app bundles and entitlements reveal. Networking tools, dtrace and lldb are introduced for your own software, and a hardening lesson plus a capstone report prepare you for the final exam and the Tabellab certificate.