Blue Fox

CHAPTER 12Reversing arm64 macOS Malware

Until recently, any Mac had an Intel‐based processor at its core. Now, all new Macs instead contain “Apple Silicon.” Starting with the M1, these system on chips (SoC) use the Arm instruction set. To maintain native compatibility with these new Apple systems, malware authors have begun distributing their malicious creations compiled as Arm 64‐bit binaries.

For Mac malware analysts, the presence of such Arm 64‐bit binaries may present some challenges. Most notably, these binaries disassemble not into the traditionally more familiar Intel‐based instructions but rather into the A64 instruction set.

At this point in the book, you're already armed with a foundational understanding of this instruction set. In this chapter, we'll build upon this knowledge and provide the information you'll need to be well on the road to becoming a proficient analyst of arm64 malware, targeting macOS.

This chapter starts with a few introductory topics such as methods of identifying native arm64 macOS binaries. This knowledge will aid us when hunting for arm64 macOS malware and was in fact used to uncover the very first malware natively compatible with Apple Silicon. The remainder of this chapter focuses on tools and techniques to analyze such malware, specifically focusing on the anti‐analysis logic that aims to thwart overall analysis efforts.

 Apple refers ...