Olivia A. Gallucci

My last article was about the Low-Level Bootloader (LLB) stage on Silicon Macs, its security design, and related exploits.

My last article was about the Boot ROM stage of Silicon Macs, its security design, and related exploits.

Booting is the process of starting a computer by loading the operating system into memory.

Woah, we are gonna talk about signature-based analysis.

When source code is unavailable or incomplete, extracting information directly from binaries is the main way forward (“binary extraction”).

The post announces a meaningful expansion of the EDR Telemetry Project with the launch of a dedicated macOS telemetry framework and a reproducible telemetry generator, both aimed at bringing much-needed transparency to endpoint visibility on Apple systems.

Last year, I raised money for the Objective-See Foundation to support full-ride OBTS conference scholarships.

This post will walk you through the beginnings of macOS reversing.

This issue of Detection Engineering Weekly (DEW) highlights a strong start to 2026.

1 Jan 2026: I will be updating this post with my test results, corrections, and other info over the next few weeks.