Unlocking macOS Internals: A Beginner's Guide to Apple's Open Source

This talk is an orientation to macOS internals for people new to the area. It explains that macOS and iOS share the Darwin base, including the XNU kernel, system libraries and launch daemons, so Apple's public source code is a useful entry point even though Apple withholds some frameworks and licenses parts of its crypto library under restrictive terms.

The speaker covers the practical hurdles of locating that code. Apple moved releases from its download site to GitHub repositories in 2024, tags have to be mapped to OS versions through release metadata or the distribution manifests inside installer packages, and shipped binaries are stripped of symbols, so developer debug kits and the iOS simulator serve as alternatives. A set of tools is introduced, including strings, nm, class-dump, disassemblers and debuggers such as Ghidra, IDA, Binary Ninja and LLDB, along with dynamic instrumentation with Frida. Building the open source components is presented as difficult because of missing files and environment mismatches, so reading build scripts and headers is often more productive.

To show the workflow, the talk walks through binary diffing of a historical syslogd patch, where a single changed function pointed to a heap overflow fix. The takeaway is to treat the public source as a map, match functions and call patterns against binaries, and diff updates to find what changed, since partial source is still valuable for research.