XUnprotect: Reverse Engineering macOS XProtect Remediator

The talk examines XProtect Remediator, the macOS component Apple uses to find and remove malware that is already running, after earlier defenses such as Gatekeeper have failed to stop it. The scanner modules are stripped Swift binaries, so the work relied on recovering type information from Swift's reflection metadata, a Binary Ninja plugin that annotates that data, and an LLDB script that records indirect branch targets. A custom script was also written to decrypt the strings that each scanner's initializer hides.

The remediation rules turned out to be written in a domain-specific language built on Swift result builders, which keeps complex conditions readable. Several scanners stood out. One runs OCR on disk image backgrounds to spot Gatekeeper bypass instructions. Another matches code signature hashes tied to a known supply chain payload and a possible unknown variant. A third scans process memory for a rule linked to the TriangleDB implant but only reports its findings rather than removing anything. The loaded library scanner's paths, which include directories and symlinks, led to hypotheses about reflective loading with a spoofed backing file, which the speaker tested with a custom loader.

For practitioners, the main takeaways are to watch for new scanners in the frequent XProtect updates, since they can reveal Apple-held threat intelligence, and to use the published reversing notes and tools to analyze future versions. The speaker points to a longer white paper that also covers sandboxing and vulnerability research.