Jonathan Levin

Not as a hands-on project I don't think, for the reasons you listed, but there are books that do explain these things, and are probably the closest to what you want. For Windows: https://learn.microsoft.com/en-us/sysinternals/resources/windows-inter… and for Mac/iOS: https://newosxbook.com Those are official sites, the books themselves can also be found elsewhere if you get my meaning.

A huge kudos to Jonathan Levin too! It looks like the full set of new *OS Internals books are now available (last I checked only two volumes were available) - http://newosxbook.com They are the spiritual successors to Amit Singh's Mac OS X Internals: A Systems Approach (http://osxbook.com).

http://newosxbook.com/home.html https://www.amazon.com/Mac-OS-iOS-Internals-Programmer/dp/1118057651 Basically the C, C++ and Objective-C stuff, nowadays Swift as well, completly unrelated to UNIX.

I mean, it might be more than you're looking for, but if you really want the nitty gritty, I think this is basically the seminal work? http://newosxbook.com/index.php

There are the APIs in iOS to do this (Apple80211.framework) but it is a private API and any app that uses it will not get accepted to the App Store. Edit: It looks like Apple’s done some switching around since I last hacked on it but this page is helpful: http://newosxbook.com/articles/11208ellpA-II.html

Aha. Feeling dumb that I didn't know that. Of course they're directories with some metadata. Duh. I always kinda guessed that DMGs were something like a ZIP file. Well, not really: "3. Mounting DMGs DMGs can be mounted, just like any other file system, though technically this is what is known as a "loopback" mount (i.e. a mount backed by a local file, rather than a device file)" http://newosxbook.com/DMG.html Pretty cool. Thanks for the tip. Now wondering about differences between loopback mount, FUSE, potential for seamless Finder UX integration...

I think you would enjoy the http://newosxbook.com/index.php series.

This is the only public place: http://newosxbook.com/bonus/vol1ch16.html. Skywalk is an asynchronous networking interface designed to be adaptable to a number of different needs. I'm not really a networking person so I don't know a lot about it, but mostly the kernel gets out of your way and writes out a bunch of data in a ring buffer of some kind asynchronously or something. The goal is to be able to have different use cases customized to their own needs, so the HTTP stack can write its own custom stuff to be optimized for that use case and the same for the IDS stuff or bluetooth stuff etc. Most people quoted a 30-50% reduction in overall cpu usage for a wide range of scenarios.

I too am very interested in this, so tried searches with "macos", then "mach" and "xnu". This led me to tentatively conclude that it's not in XNU. On the one hand, http://newosxbook.com/src.jl?tree=xnu-1504.15.3&file=/bsd/sys/vnod… seems interesting. On the other hand, https://github.com/apple/darwin-xnu/blob/0a798f6738bc1db01281fc08ae024… is suggested to be a red herring because of https://github.com/apple/darwin-xnu/blob/0a798f6738bc1db01281fc08ae024… I have no idea if these are connected but they might be. I'm not sure if my GitHub and/or Google queries aren't finding the relevant bits of magic though; had (only) a couple minutes and got curious.

> xnu supports priority inheritance through "turnstiles" Do you have any information on how long this "turnstiles" feature has been available? [1] I was aware that the userspace pthread libraries implement but ignore PTHREAD_PRIO_INHERIT, but wasn't aware that the underlying implementation gave priority inheritance semantics. Update: Looks like the "turnstiles" feature may have its origins in Solaris. [2] [1] This link would suggest as of Mac OS 10.14: http://newosxbook.com/articles/12-10.14.html [2] http://sunsite.uakom.sk/sunworldonline/swol-08-1999/swol-08-insidesola…

Here's a link to the first volume, made available on the book's website: http://newosxbook.com/MOXiI.pdf

Are there any good, up-to-date resources on macOS internals that detail everything from the boot process to the GUI? I could only find [0], and Apple's [1] was last updated in 2013.. [0] http://www.newosxbook.com/index.php?page=book [1] https://developer.apple.com/library/content/documentation/Darwin/Conce…

If signatures are checked, they are checked by the kernel (and its userland buddy AMFI) every time the process is launched. I'm not sure what the defaults are for macOS lately but a developer can opt-in to even more restrictions like requiring linked shared libraries to be signed with the same key pair as the executable. This library validation behavior changed in 10.12 and can now also prohibit mprotect(RWX). I'm fuzzy on the exact details of the {OS version, compiler version [yes, 10.12 changes codesign validation behavior based off of the version of the compiler, not the OS, used to build the binary], codesign requirements} mix but it is increasingly becoming more like iOS. Apple has spent the last decade developing a pretty impressive* chain of trust for code execution, starting with iOS and merging into macOS. Basically, code signing on iOS is dynamically secure, modulo vulnerabilities, and macOS is steadily on its way to become more like iOS in this regard. * But not fun for security research and having ultimate control of your device. Always the tradeoffs... http://www.newosxbook.com/articles/CodeSigning.pdf https://developer.apple.com/library/content/technotes/tn2206/_index.ht…

The sources I recall while writing this: - https://github.com/drduh/macOS-Security-and-Privacy-Guide - https://github.com/CISOfy/lynis - https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-179.… - https://help.apple.com/machelp/mac/10.12/index.html#/mh11389 - http://newosxbook.com/files/moxii3/AppendixA.pdf Hope it helps!