Re:Hiding malware in Windows: The basics of code injection
by blincoln on Friday September 21, 2018 @01:00PM
(#18041054)
> Xcode works just fine on non-root accounts
Are you sure that attaching to a process (for debugging/memory-modification) in general does on modern versions of Mac OS?
"In order to guarantee support for debugging on the Mac, you need to log in on the Developer Tools Access dialog box using the administrator or root user password" [1]
"DTrace requires admin privileges" [2]
[1] http://docwiki.embarcadero.com/RADStudio/Tokyo/en/Acquiring_...
[2] http://dtrace.org/blogs/brendan/2011/10/10/top-10-dtrace-scr...
Re:Hiding malware in Windows: The basics of code injection
by saagarjha on Friday September 21, 2018 @01:31PM
(#18041266)
That's consistent with I'm saying. You do not need to be root to attach to a process on macOS; you merely need to be part of the _developer group. I believe admins are added to this group by default, but you can do it manually if you wish. If you don't, you'll need to type the password of an admin user before you can debug anything.
Re:Hiding malware in Windows: The basics of code injection
by blincoln on Friday September 21, 2018 @03:12PM
(#18041937)
Unfortunately, I don't have access to a machine to test with - my statement was based on a lengthy discussion from a few months ago at a previous job - but I'll assume you're correct, and amend my original statement to "Mac OS is the only mainstream OS I know of that disallows debugging by non-privileged user accounts entirely." Thanks :).
This isn't true; Xcode works just fine on non-root accounts. You will need to get permission to debug anything from an admin user, or add yourself to the developers group. And if you want to debug a system binary you'll need to disable SIP.