skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

macos-process-injection

Analyze macOS process injection vectors via DYLD, XPC, Mach IPC, and Electron runtime features.

2|Updated May 15, 2026
Search Tags:#macos#process injection#dylib hijacking#xpc exploitation#mach ports#electron security#dyld insert libraries
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill macos-process-injection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: macos-process-injection
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/macos-process-injection
Command: npx skills add https://github.com/lNwNl/Methodos --skill macos-process-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides practical guidance for injecting code into macOS processes by leveraging dynamic loader behavior, XPC/Mach IPC surfaces, and Electron/Chromium runtime options.

Core Features & Use Cases

  • DYLD-based injection: Select targets that permit DYLD environment-variable injection and apply DYLD_INSERT_LIBRARIES to preload a dylib at process startup.
  • Dylib hijacking strategies: Identify weak and @rpath-resolved libraries, and use proxy/re-export techniques to execute payloads while preserving expected interfaces.
  • XPC and Mach port manipulation: Evaluate XPC service discovery/validation weaknesses (including PID reuse) and outline Mach port manipulation patterns that enable stronger IPC-level control.
  • Electron/Chromium abuse paths: Use Electron runtime features (e.g., RunAsNode, debugging flags, NODE_OPTIONS, fuse checks) to piggyback on app permissions and developer tooling paths.
  • Decision support and validation: Includes a process injection decision tree plus detection/forensics pointers to reason about feasibility and outcomes.

Quick Start

Ask your AI to map the target app or binary to the best injection vector and give a feasibility checklist for its hardened runtime, entitlements, dylib dependencies, XPC surfaces, and Electron fuses.

Frequently Asked Questions about macos-process-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inject a dylib into a macOS process using DYLD_INSERT_LIBRARIES?▼

To use DYLD_INSERT_LIBRARIES for macOS process injection, you must first analyze the target binary's hardened runtime and entitlements to confirm environment-variable injection is not disabled, then preload your dylib at process startup.

What is dylib hijacking and how does it work on macOS?▼

Dylib hijacking on macOS exploits weak and @rpath-resolved libraries by using proxy or re-export techniques to execute malicious payloads while preserving the expected application interfaces and dependencies.

How can I exploit XPC services and Mach ports for macOS IPC injection?▼

Exploiting XPC services and Mach ports for IPC injection involves evaluating XPC service discovery and validation weaknesses, including PID reuse risk modeling, and outlining Mach port manipulation patterns to establish stronger IPC-level control.

Can I use Electron debugging flags or NODE_OPTIONS to inject code into macOS apps?▼

Yes, you can abuse Electron runtime features like RunAsNode, debugging flags, and NODE_OPTIONS to piggyback on app permissions and developer tooling paths after verifying the target application's Electron fuse checks.

What is the best way to enumerate injectable targets and plan a macOS process injection attack?▼

The best way to plan macOS process injection is to map the target application to an appropriate injection vector using a decision tree that analyzes its hardening state, dylib load behavior, XPC surfaces, and Electron runtime features.

Why does DYLD preloading fail on certain hardened macOS binaries?▼

DYLD preloading fails on hardened macOS binaries when the target application's hardened runtime configuration and library validation entitlements actively disable environment-variable insertion and restrict dynamic loader behavior.

Related Skills

Explore More Software Engineering Skills→
fattits30-devfattits30-dev
1

electron-build

Build Electron app installers for Windows, macOS, and Linux.

Community
Advanced
YukiIto1999YukiIto1999

performing-memory-forensics-with-volatility3-plugins

Automate Volatility3 memory forensics to extract malware indicators from RAM dumps.

Community
Advanced
Sunwood-ai-labsSunwood-ai-labs

playwright-interactive

Runs persistent browser and Electron debugging sessions with Playwright for UI QA.

Community
Advanced
DorianGalloDorianGallo
5

macos-process-injection

Guides macOS code injection via DYLD, XPC/Mach IPC weaknesses, and Electron runtimes for security assessment scenarios.

Community
Advanced