Research Update Enhanced src/macos-hardening/macos-security-...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL:
• Blog Title: Research Update Enhanced src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.md
• Suggested Section: Research

🎯 Content Summary

Research Update for src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.md

This PR contains automated research updates including:

• Latest security vulnerabilities and attack vectors
• Updated techniques and tools
• Enhanced explanations and examples
• Additional references and resources

Generated by: HackTricks Research Agent
Timestamp: 2026-03-25 13:30:20 UTC

Tool usage

• apply_patch: 1
• brave_search: 7
• exe...

🔧 Technical Details

Research update for HackTricks content

🤖 Agent Actions

I’m reading the current page and adjacent macOS material first so I can place new content without duplicating existing HackTricks coverage. After that I’ll switch to web research on recent memory dumping tradecraft and tooling.
The target page is very thin and still centered on archived osxpmem. I’m checking nearby pages now, especially task-port and in-memory inspection content, so the update stays focused on acquisition and artifact extraction instead of re-explaining generic process injection.
I have the local boundaries now. Next I’m validating what is still true on recent macOS versions: which dump paths remain practical on Apple Silicon, what taskgated and hardened runtime still block, and which modern tools are actually maintained instead of archived one-offs.
The current web picture is converging on two meaningful additions: modern per-process dumping with lldb/region scoping, and updated privilege constraints around task_for_pid/get-task-allow on current macOS. I’m pulling primary docs and a couple of high-signal writeups to keep the update factual.
The edit scope is clear now. I’m adding modern live-process acquisition paths and current attach constraints, while keeping the page narrow: artifact files, legacy full-RAM imaging, and process-focused dumping on recent macOS.
I’m updating the page now. The changes will replace the stale “try it yourself on arm64” framing with tested limitations, add lldb/Frida workflows that are still useful on Sonoma/Sequoia-era systems, and close with a small references section.
Updated macos-memory-dumping.md to reflect current macOS tradecraft instead of staying centered on archived osxpmem.

The main changes were:

• Reframed osxpmem as a legacy Intel/kext-based workflow and clarified why it is usually impractical on modern Apple Silicon macOS.
• Added a new lldb section covering live process core dumps, including process save-core, --style full, and targeted region dumping.
• Added current attach constraints around taskgated, hardened runtime, get-task-allow, and debugger entitlements.
• Added a selective dumping section using Frida-readable ranges, plus a brief note on readmem as an older userland reference.
• Added quick triage notes for vm.swapusage / sleepimage and a HackTricks internal ref to the task-port page.
• Added a small ## References section at the end.

I verified the markdown diff and the new internal reference path. I did not run a full site build.

Blog posts used in research:

• https://www.appspector.com/blog/core-dump
• https://afine.com/to-allow-or-not-to-get-task-allow-that-is-the-question

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post:

Content Categories: Based on the analysis, this content was categorized under "Research".

Repository Maintenance:

• MD Files Formatting: 963 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0