CVE-2026-28995: My First CVE (This Is Not a Write-Up)
I got my first CVE. This is not a write-up, just some thoughts on what it took to get there.
Reverse Society
At Reverse Society, we are deeply focused on offensive security research and advanced reverse engineering, specifically across Apple platforms (iOS and macOS).
Live Last read · last published · next check
Latest posts
You Have a Kernel Read/Write. Not Enough! How to Extract Offsets from XNU Kernelcaches
How to systematically extract struct field offsets from Apple's stripped XNU kernelcache using static analysis alone.
Understanding and Experimenting with Apple's PAC on iOS
A hands-on exploration of Pointer Authentication Codes (PAC) on iOS. We'll understand how PAC works at a deep level, explore how PAC signing can be triggered programmatically.
Predator iOS Malware: Building a Surveillance Framework - Part 1
How does Predator spyware transform from running code into active surveillance? This technical deep-dive reverse-engineers the internal factory architecture that dynamically creates camera monitoring, VoIP interception, and keylogging modules through Unix socket commands revealing the infrastructure between exploitation and surveillance
Bypassing iOS Frida Detection with LLDB and Frida
A complete walkthrough of the 8ksec "FridaInTheMiddle" challenge: bypassing Frida detection, hooking Swift functions, and intercepting arguments on a jailbroken iPhone.
Attacking macOS XPC Helpers: Protocol Reverse Engineering
How to attack a macOS XPC Helper using a simple Objective-C script
Exploring macOS Sandbox Profiles: Pre-Defined Rules
How to find pre defined macros in macOS system sandbox profiles?
How to reverse engineer a malicious macOS pkg installer?
How to extract the content of a malicious macOS pkg installer and reverse engineer it?
ptrace internals: How it prevents debugger attachment
Deep dive into ptrace internals, from syscall to kernel implementation, understanding how it prevents debugger attachment and how to bypass it.
Anti-debugging technique using dlsym and fork
How to write an anti-debugging mechanism using fork and how to detect it!
Reverse Engineering Basics: Crack a License with LLDB
This tutorial is designed for developers and security enthusiasts who want to approach LLDB, through a practical exercise.
Four Hours Later: How Removing Copy Constructors Could Have Saved My Day
A single missing ampersand ('&') led me through a challenging four-hour debugging journey. This experience was a profound reminder of the critical importance of understanding C++'s copy semantics and object lifecycle management.
From Binary to Source: Exploring Darwin's Open Source Code
Suppose you want to reverse-engineer some of Darwin's binary source code. I want to show you the technique I used to find the binary source code quickly.
launchd essentials: Integrating XPC services in macOS application (part 2)
In the previous post, we discussed building a basic macOS agent with launchd. But we are still far from how a software engineer could interact with and do with a real-world application. In this post, we will try to contextualize the usage of agents in a GUI macOS application.
How to set a fixed window size for a macOS application with SwiftUI?
Understand how to constrain window sizes in macOS applications using SwiftUI.
launchd essentials: Building your first macOS agent step by step (part 1)
Launchd is responsible for starting, stopping, and managing background processes in macOS. In this blog post, we will build a macOS agent with launchd trying to understand the fundamentals.
Complete Guide to Notarizing macOS Apps with `notarytool`
In this comprehensive guide, we delve into the process of notarizing macOS applications using Apple's notarytool. We will demystify the concept of notarization, and explore the critical commands necessary to navigate this essential step in preparing your applications for distribution.
Testing C++ callback based APIs
Discover how to test callback-based APIs in C++ as a JavaScript developer. Learn to set up GoogleTest, use std::promise for async callbacks, and write robust test cases, bridging your JavaScript expertise to C++ testing scenarios.
From JavaScript to C++: Understanding the Power and Limitations of constness
As a JavaScript developer, you are probably familiar with the const keyword used to declare variables whose value cannot be changed. However, diving into C++ programming, you may notice some differences in how const works compared to JavaScript. In this post, we'll explore the nuances of const in C++ and how it differs from const in JavaScript.
Demystifying Code Signing in macOS: A Step-by-Step Tutorial for CLI Applications with CMake
Discover the process of code signing macOS CLI applications using CMake in this step-by-step tutorial. Learn the importance of code signing, how it works, and how to create a basic macOS CLI app and sign it using your Apple Developer ID Application certificate.
Facing 'User interaction is not allowed' when using 'xcrun notarytool store-credentials' on CircleCI
In this post, we discuss how to resolve the 'User interaction is not allowed' error when using xcrun notarytool store-credentials on CircleCI.
Define CPU architecture in C++ with pre-processor
How to defined CPU architecture in you C++ code?
Spawning a basic curl command in C++
How to spawn process in C or C++?