macos-process-injection

What problem does it solve?

This Skill provides practical guidance for injecting code into macOS processes by leveraging dynamic loader behavior, XPC/Mach IPC surfaces, and Electron/Chromium runtime options.

Core Features & Use Cases

• DYLD-based injection: Select targets that permit DYLD environment-variable injection and apply DYLD_INSERT_LIBRARIES to preload a dylib at process startup.
• Dylib hijacking strategies: Identify weak and @rpath-resolved libraries, and use proxy/re-export techniques to execute payloads while preserving expected interfaces.
• XPC and Mach port manipulation: Evaluate XPC service discovery/validation weaknesses (including PID reuse) and outline Mach port manipulation patterns that enable stronger IPC-level control.
• Electron/Chromium abuse paths: Use Electron runtime features (e.g., RunAsNode, debugging flags, NODE_OPTIONS, fuse checks) to piggyback on app permissions and developer tooling paths.
• Decision support and validation: Includes a process injection decision tree plus detection/forensics pointers to reason about feasibility and outcomes.

Quick Start

Ask your AI to map the target app or binary to the best injection vector and give a feasibility checklist for its hardened runtime, entitlements, dylib dependencies, XPC surfaces, and Electron fuses.