Design-Based Vulnerabilities on macOS： Oops, Not a One-Shot Fix

Preface 0. macOS Userland : Based on Old Apple Bug Bounty 0.1 Userland Root LPE 0.2 General / Full TCC Bypass 0.3 SIP : System Integrity Protection 1. Remote Full TCC Bypass And Persistence 1.1 Threat model 1.2 package_script_service 1.3 Data Vault 1.4 Persistence 1.5 Easter Eggs in My Black Hat USA 2024 Presentation 1.6 How Apple Verifies / Protects the Integrity of An App 1.7 Exploit Steps 1.7.1…