XUnprotect: Reverse Engineering macOS XProtect Remediator

Overview: Koh presents an in-depth reverse engineering analysis of Apple's XProtect Remediator (XPR), the modular post-execution malware removal subsystem introduced in macOS Monterey to replace the legacy Malware Removal Tool (MRT). Examining over 20 stripped Swift scanning modules, Koh details how Apple organizes behavioral scanning, XOR string decryption, and a custom declarative remediation engine built using Swift Result Builders. Furthermore, he reveals the forensic mechanics of Apple's Provenance Sandbox and demonstrates how race conditions in XPR allow local unprivileged users to execute arbitrary file deletion with root and Full Disk Access privileges.

Key Topics: - Reverse engineering stripped Swift binaries using BinDiff, ipsw, and the custom binja-swift-analyzer plugin - Architecture of XPR: Central Task Scheduler (cts), XProtectPluginService, XOR string decryption, and vnode rapid aging - Declarative remediation logic via the Swift Result Builder domain-specific language (DSL) - Threat intelligence findings (XPR.Launch, XPR.BadCaliber, XPR.RedPayload), Provenance Sandbox tracking, and TOCTOU arbitrary file deletion

Technical Details: To reverse engineer the 23 stripped Swift binaries comprising XPR inside /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/MacOS/, Koh utilized BinDiff against XProtectPayloads to recover shared exported symbols. Because Swift binaries strip type metadata accessors and protocol witness tables (PWT), he developed binja-swift-analyzer (leveraging Blacktop's ipsw swift-dump) to extract reflection metadata from swift5_proto and swift5_types sections and annotate vtables. He also created custom LLDB dynamic scripts to resolve indirect runtime branch targets. At execution time, the Central Task Scheduler (cts) launches the main daemon, which dispatches scanning jobs to XProtectPluginService via XPC. During scanner startup, model_init_0 decrypts XOR-encrypted strings containing target file paths, hashes, and YARA rules. Scanners instantiate XPAPIHelpers to inspect LaunchServices, process memory, and keychain items, while invoking sysctl to enable vnode rapid aging, suppressing access time (atime) updates to preserve forensic timestamps and optimize I/O.

Koh identified that Apple uses Swift 5.4 Result Builders to construct a declarative Domain-Specific Language (DSL) called Remediation Builder (FileRemediationBuilder, ProcessRemediationBuilder, etc.), replacing convoluted nested conditionals with clean declarative rules. Analyzing specific scanner modules yielded novel threat intelligence: XPR.Launch remediates 3CX supply chain malware (UpdateAgent) and contains an undocumented second CDHash pointing to an unknown variant; XPR.BadCaliber serves as a generic threat hunter that inspects mounted disk images, running optical character recognition (OCR) on background images to detect Gatekeeper social engineering bypass strings ("right-click", "click open"); and XPR.RedPayload targets the memory-only macOS implant of Operation Triangulation (TriangleDB), leveraging the com.apple.system-task-ports.read entitlement to scan live memory and detect reflective dynamic library loading (identifying fake backing paths like FMCore.framework). Additionally, Koh analyzed the Provenance Sandbox, where syspolicyd tags untrusted apps with 8-byte random attributes in the execpolicy database that propagate to child processes and dropped files, enabling XPR to trace secondary persistence payloads back to originating cracked applications.

Key Takeaways: Reverse engineering XPR exposes valuable Apple-internal threat intelligence, including indicators for unpublished malware variants and in-memory attack techniques. However, security subsystems running with elevated entitlements must be audited carefully: Koh discovered a Time-of-Check to Time-of-Use (TOCTOU) vulnerability where an attacker monitors the macOS unified log for YARA detection events and swaps the flagged malicious file with a symlink to an arbitrary system target, exploiting XPR's Full Disk Access (FDA) and root privileges to achieve arbitrary file deletion. Defenders can also utilize Koh's open-source tooling and macOS incident response framework extensions to harvest file provenance attributes during forensic investigations.

(AI summary — Gemini Flash)