macos-process-injection

A technical playbook for injecting code into running or launching macOS processes, aimed at security researchers and red-team practitioners who need to understand the platform's injection vectors and their prerequisites. It emphasizes details that general knowledge often misses — entitlement requirements and System Integrity Protection (SIP) constraints that determine whether a given technique works. It begins with DYLD_INSERT_LIBRARIES injection, using the dynamic linker to preload a dylib, and tabulates when it is possible: normal non-hardened binaries allow it, while Hardened Runtime, SIP-protected Apple binaries, SUID/SGID binaries, and sandboxed apps strip the environment variable, unless the com.apple.security.cs.allow-dyld-environment-variables entitlement is present. It provides compile-and-inject examples and shell one-liners to enumerate injectable targets by inspecting codesign flags and entitlements. Dylib hijacking is covered in three forms — weak dylib hijacking (LC_LOAD_WEAK_DYLIB), @rpath hijacking against writable LC_RPATH directories, and dylib proxying that re-exports a legitimate library's symbols while running attacker code — with otool, nm, and dyldinfo commands for dependency enumeration. XPC exploitation covers service discovery and client-validation weaknesses, notably the PID reuse race condition against PID-based checks (contrasted with audit-token, code-signature, and entitlement validation that resist it). A Mach ports section explains task_for_pid and related APIs, their root/entitlement requirements, and post-exploitation capabilities such as memory read/write and thread injection, along with port namespace manipulation. The document also references companion material — a macos-security-bypass skill for defeating TCC, Gatekeeper, or SIP, a Linux privilege-escalation cross-reference, and a deeper DYLIB_XPC_TECHNIQUES reference with step-by-step methodology, XPC walkthroughs, and Mach port patterns. Throughout, comparison tables map each technique to its requirement and outcome, making it a reference for assessing which injection paths a hardened or unhardened macOS target actually exposes.