Ilya Andr (@andrd3v)

Detect when any process grabs your Mach task port by checking the CS_INVALID_ALLOWED code signing flag via csops(). Unlike TASK_EXTMOD_INFO, this catches both task_for_pid and the pid_for_task workaround. First in world public detection method pid_for_task.

Calling dlopen directly in a remote process by hijacking thread state on arm64. No shellcode, no intermediate libraries. Built on top of remote_call.

A sandboxed Mac App Store app can lock your entire screen with custom text and block all input, using Apple's own Classroom feature via unauthenticated XPC access to loginwindow. Apple says it's not a security issue.

Unauthenticated XPC access to macOS DFRHUD service, enabling the Touch Bar debug overlay from any unprivileged client.

End-to-end reverse engineering of Apple's DeviceCheck token generation flow on iOS, tracing the path from DCDevice API through devicecheckd to the final AES-GCM encrypted payload.