L0Psec

@l0psec · Twitter ·

Here's a cool uncommon technique seen in a dylib (written in beautiful Swift) for an App that had its signature revoked. Grabbing a config from the http://com.apple.metadata:kMDItemFinderComment xattr of an app bundle using the getxattr() func. cool!

Post media