The Art of Mac Malware, Volume 2 Detecting Malicious Software (Patrick Wardle) (z-library.sk, 1lib.sk, z-lib.sk)

【One-Line Pitch】 A hands-on guide to building your own macOS malware detection tools, teaching you how to turn system internals, binary formats, and code signing into programmatic heuristics. Essential for Mac admins, malware analysts, and security-minded developers who want to move beyond postmortem analysis to real-time threat detection. 【Book Arc】 - **Opening (~0%–15%)**: Establishes the case for heuristic-based detection and introduces the book's core philosophy—capturing system state snapshots to reveal infection signs, starting with process enumeration and analysis. - **Early (~15%–35%)**: Dives into process inspection techniques, including extracting arguments, hierarchies, loaded libraries, and detecting anomalies like hidden directories or self-deleting binaries (e.g., KeRanger, DazzleSpy). - **Middle (~35%–55%)**: Shifts to static analysis of Mach-O binaries—parsing universal/fat binaries, extracting dependencies and symbols, and detecting packed or encrypted code via entropy calculations. - **Late (~55%–80%)**: Covers code signing as a detection lever (verifying signatures, extracting notarization info) and network state collection (sockets, file descriptors, NetworkStatistics framework). - **Ending (~80%–100%)**: Culminates in leveraging Apple's Endpoint Security and Network Extension frameworks to build real-time monitoring tools, synthesizing earlier techniques into proactive defense systems. 【Key Takeaways】 - **Heuristic-based detection beats signature matching** (Opening): The book's central thesis—malware evolves too fast for static signatures, so you must build tools that identify behavioral and structural anomalies. - **Process enumeration is your first diagnostic lens** (Early): Extracting paths, arguments, and loaded libraries from running processes reveals telltale signs like hidden directories (.local/softwareupdate) or self-deleted binaries (KeRanger's unlink call). - **Mach-O parsing unlocks binary-level intelligence** (Middle): Understanding universal binaries, load commands, and dependency paths lets you spot packed binaries via entropy calculations and flag suspicious symbols or section names. - **Code signing is a powerful false-positive reducer** (Late): Verifying signatures and notarization status helps distinguish legitimate software from malware, especially when combined with other heuristics. - **Network state collection completes the picture** (Late): Enumerating sockets and file descriptors via NetworkStatistics reveals backdoor listeners and unauthorized connections that process analysis alone might miss. - **Private APIs extend detection capabilities** (Early–Middle): The book shows how to leverage undocumented XPC routines and private frameworks (e.g., xpc_pipe_interface_routine) for deeper system introspection. - **Real-time monitoring requires Apple's frameworks** (Ending): Endpoint Security and Network Extension enable proactive, event-driven detection rather than periodic snapshots—the book's ultimate goal. - **False positives are inevitable—design for them** (Throughout): Wardle repeatedly notes that legitimate software (e.g., Wacom tablets) can mimic malicious behavior, so heuristics must be layered and contextual. 【Reading Tips】 - **Deep-read Chapters 1–2** (process and binary analysis): These form the foundation for everything else; skim only if you're already fluent in Mach-O internals. - **Treat code listings as templates**: The book is code-heavy—focus on understanding the APIs and logic flow rather than memorizing syntax; adapt examples to your own tools. - **Skim the network chapter if you're host-focused**: Chapter 4 is valuable but can be deferred if your priority is endpoint detection; return to it when building comprehensive monitoring. - **Pair with Volume 1 if new to macOS malware**: The author explicitly assumes foundational knowledge; this volume builds on, not replaces, the first book. - **Take away the methodology, not just the code**: The real value is learning Wardle's heuristic mindset—how to think about anomalies—which transfers to any detection engineering. 【Coverage Limits】 This guide synthesizes the book's structure and core themes from the provided excerpts, which cover the table of contents, foreword, and portions of early chapters. Detailed chapter-by-chapter techniques (especially later chapters on Endpoint Security and Network Extension) are inferred from the book's stated scope rather than fully excerpted content.