Skip to content

feat: add native macOS agent (ARM64 Apple Silicon)#333

Open
En3nr4 wants to merge 1 commit into
Adaptix-Framework:dev-v1.3from
En3nr4:feat/macos-agent
Open

feat: add native macOS agent (ARM64 Apple Silicon)#333
En3nr4 wants to merge 1 commit into
Adaptix-Framework:dev-v1.3from
En3nr4:feat/macos-agent

Conversation

@En3nr4
Copy link
Copy Markdown

@En3nr4 En3nr4 commented May 23, 2026

Summary

  • Native C agent for macOS ARM64 (Apple Silicon M1/M2/M3/M4)
  • Cross-compiled from Linux via osxcross (aarch64-apple-darwin23.5-clang)
  • Formats: Mach-O binary, shellcode ARM64 (XOR-encoded dylib), Go fallback
  • 26 commands: fs ops, process mgmt, shell, screenshot, clipboard, persistence, TCC check, EDR detection, keychain dump, browser dump, SOCKS proxy
  • dyld resolver for runtime API resolution
  • AES-128-GCM crypto, msgpack wire protocol, TCP connector
  • Polymorphic ARM64 XOR decoder stub
  • ~100 KB Mach-O, ~120 KB shellcode blob

Test plan

  • Build: make compiles macOS agent extender (requires osxcross)
  • Generate Mach-O ARM64 binary, verify check-in over TCP
  • Generate shellcode ARM64, verify check-in over TCP
  • Test macOS-specific commands (screenshot, clipboard, TCC, keychain)

Split from #324 as requested

Native C agent for macOS ARM64 (M1/M2/M3/M4):
- Cross-compiled via osxcross (aarch64-apple-darwin23.5-clang)
- Formats: Mach-O binary, shellcode ARM64, Go fallback
- 26 commands: fs ops, screenshot, clipboard, persistence, TCC,
  keychain, browser dump, EDR detection, SOCKS proxy
- AES-128-GCM crypto, msgpack wire protocol, TCP connector
- Polymorphic ARM64 XOR decoder stub
@En3nr4 En3nr4 force-pushed the feat/macos-agent branch from 9560170 to 9e6c357 Compare May 23, 2026 09:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant