macOS / Mach-O reversing

When it applies

The target is a Mach-O binary, dylib, framework, or .app bundle on macOS (or a sample you can read offline), and it is in scope (tradecraft-scope-roe, scope.txt). iOS IPAs are a different surface — treat them with the iOS assessment flow (mobile-ios-assessment). Typical jobs: understand a thick client, audit a persistence item (LaunchAgent/Daemon), or analyze Apple-platform malware.

Why it works

Mach-O carries its trust model in-band: the code signature, entitlements, and load commands say what the binary may do before you read a single instruction. Objective-C keeps class and selector names in __objc_* sections and Swift symbols demangle to full signatures, so static recovery is cheap — and Apple's own tools (codesign, otool, lldb, log) cover most of the workflow.