maddieuwu

I think that disabling SIP can break some programs and it's hard to do for a normal user right? I'm curious how anti-malware software is doing this, because it's doing a lot of fancy stuff, maybe I should look into it by reverse engineering one of them. Thanks for the link I'll definitely check it out.

Does anyone know about something similar on macOS? Environment variables like DYLD_INSERT_LIBRARIES or functions like mach_inject, dl_open and others are automatically disabled for processes protected by hardened runtime. I'm wondering if it's possible to inject to process only by exploiting the OS.