Hacker News: tonygo

Compute iOS XNU offset from kernel cache

tonygo — Fri, 10 Apr 2026 15:51:21 +0000

Article URL: https://blog.reversesociety.co/blog/2026/kernel-rw-not-enough-extract-offsets-from-xnu-kernelcaches

Comments URL: https://news.ycombinator.com/item?id=47719968

Points: 34

# Comments: 0

New comment by tonygo in "I found a secret protocol in Predator Spyware – iOS"

tonygo — Mon, 19 Jan 2026 21:00:19 +0000

How does mercenary spyware actually control an iPhone? In this video, I reverse engineer the Predator spyware to uncover the secret internal protocol it uses to activate surveillance modules.

This is a summary of my technical research published on the Reverse Society blog. While analyzing the surveillance framework, I discovered a hidden custom text-based protocol that orchestrates the malware's operations (Camera, VoIP, etc.).

I found a secret protocol in Predator Spyware – iOS

tonygo — Mon, 19 Jan 2026 21:00:19 +0000

Article URL: https://www.youtube.com/watch?v=Q5A2Ydd1L9A

Comments URL: https://news.ycombinator.com/item?id=46684434

Points: 1

# Comments: 1

Predator iOS Spyware: Build a Surveillance Framework

tonygo — Wed, 07 Jan 2026 18:01:12 +0000

Article URL: https://blog.reversesociety.co/blog/2025/predator-ios-malware-surveillance-framework-part-1

Comments URL: https://news.ycombinator.com/item?id=46529920

Points: 2

# Comments: 0

macOS Ransomware: NotLockBit

tonygo — Fri, 25 Oct 2024 05:25:24 +0000

Article URL: https://www.sentinelone.com/blog/macos-notlockbit-evolving-ransomware-samples-suggest-a-threat-actor-sharpening-its-tools/

Comments URL: https://news.ycombinator.com/item?id=41942457

Points: 1

# Comments: 0

Ptrace internals: How it prevents debugger attachment

tonygo — Wed, 23 Oct 2024 20:26:48 +0000

Article URL: https://tonygo.netlify.app//2024/anti-debugging-using-ptrace/

Comments URL: https://news.ycombinator.com/item?id=41928983

Points: 2

# Comments: 0

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

tonygo — Mon, 14 Oct 2024 08:43:34 +0000

I try to transform my C program into a long living one (just adding a sleep).

https://github.com/tony-go/antidebug-examples/pull/1

At first, it appears that the follow fork mode works nicely. But at some point it did not ... If I run it 10 times consequtively in LLDB. Sometimes it works, sometimes not ...

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

tonygo — Fri, 04 Oct 2024 07:52:39 +0000

I tried, but I was not able to determine so far...

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

tonygo — Wed, 02 Oct 2024 08:01:11 +0000

Thanks a lot :)

I think that I should dig more on ptrace! Maybe a next post?

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

tonygo — Wed, 02 Oct 2024 07:59:48 +0000

Hi :)

I am not really experienced with ARM haha :) So the way that I approached it was: - how could I remove the call of fork (because I don't want to fork) - how could I patch the register that should contains the result of the fork operation

I guess that it sounds like a naive approach haha

Feel free to propose an alternative I patch, I could update the post and credit you :)

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

tonygo — Wed, 02 Oct 2024 07:55:18 +0000

> You may still think that mode could be still able to catch a new child process but apparently people have tried and the answer is no

Not sure I got this. IIUC there is a link between the fact that we used dlsym and the fact the child process is not catched by lldb in the follow fork mode?

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

tonygo — Fri, 27 Sep 2024 08:02:25 +0000

Also it could come from a messy thing in the code.

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

tonygo — Fri, 27 Sep 2024 07:58:58 +0000

I tried with LLDB using `settings set target.process.follow-fork-mode child` but for some reasons I feel like it still exit from the parent process.

I also tried with a long living process: https://github.com/tony-go/antidebug-examples/tree/main/swif...

And I got this:

``` (lldb) run Process 14345 launched: '/anti-debug/swift/build/anti_debug' (arm64) start pid = 14345 exit parent process for child pid = 14348 continue as child process pid = 14348 Process 14345 exited with status = 0 (0x00000000) ```

The UI did not even appeared as it should.

Maybe I miss something in my LLDB config...

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

tonygo — Fri, 27 Sep 2024 07:43:12 +0000

> A far more effective actual anti-debugging technique is to have the parent become the debugger of the child,

Do you have example of that? I am really curious, thanks for sharing tho :)

Implementing and Detecting Anti-Debugging with Fork()

tonygo — Mon, 23 Sep 2024 15:11:21 +0000

Article URL: https://tonygo.netlify.app//2024/anti-debugging-detection-with-fork/

Hacker News: tonygo

Compute iOS XNU offset from kernel cache

New comment by tonygo in "I found a secret protocol in Predator Spyware – iOS"

I found a secret protocol in Predator Spyware – iOS

Predator iOS Spyware: Build a Surveillance Framework

macOS Ransomware: NotLockBit

Ptrace internals: How it prevents debugger attachment

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

New comment by tonygo in "Implementing and Detecting Anti-Debugging with Fork()"

Implementing and Detecting Anti-Debugging with Fork()

XPC Sniffer for LLDB