The Art of Mac Malware: The Guide to Analyzing Malicious Software
Patrick Wardle · No Starch Press · 2022
Identifier: ISBN 978-1-7185-0194-2
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
Volume I of a series on macOS malware: infection and delivery methods, the persistence mechanisms available on macOS, and static and dynamic analysis of Mach-O binaries with the tooling that actually works on a Mac.
Who it is for, and when
The reference for anyone who has to say whether a Mac was compromised and how the code survived reboot. The persistence chapter alone is the checklist for a macOS compromise assessment: launch agents and daemons, login items, configuration profiles, and the less obvious hooks. The author publishes the full text free at taomm.org; the No Starch print edition is the paid form.
What it does not cover
Malware analysis, not general macOS forensics — it does not cover APFS structures, unified logging as a timeline source, FileVault handling, or mobile. macOS security controls move every annual release, so specific TCC, notarisation and SIP behaviour needs checking against the version in front of you.
Go to the source
Open at taomm.org (opens in a new tab)https://taomm.org/
Details
- Type
- Book
- Written for
- AdvancedAdvanced
- Author
- Patrick Wardle
- Publisher
- No Starch Press
- Year
- 2022
- Identifier
- ISBN 978-1-7185-0194-2
- Topics
- macos, malware, reverse-engineering, incident-response
- Checked at source
Related entries
Memory acquisition and analysis across Windows, Linux and macOS, written by the people who built Volatility: process and kernel structures, code injection, rootkit detection, registry and event logs recovered from RAM, the GUI subsystem, network state, and case studies.
CyberDefenders
Partly freeA blue-team lab platform hosting scenario-based investigations grouped as endpoint forensics, network forensics, malware analysis, cloud forensics, threat hunting, detection engineering and threat intelligence. Challenges are question-and-answer over supplied evidence, with a scoreboard.
A community-maintained, machine-readable knowledge base of digital forensic artefact definitions — where an artefact lives and how to collect it — expressed in YAML and licensed Apache-2.0. It is documented at artifacts.readthedocs.io and coordinated through the forensicartifacts Google Group and the Open Source DFIR Slack.
Ghidra
FreeAn open-source software reverse engineering framework released by the NSA, with a disassembler, a decompiler producing C-like output, scripting in Java and Python, and support for many processor architectures. The former ghidra-sre.org address now redirects to the GitHub project.
OpenSecurityTraining2
Partly freeAn Open edX platform hosting long-form, university-length classes in low-level computing: x86-64 assembly, OS internals, firmware and UEFI, debuggers (WinDbg, GDB, IDA, Ghidra, Binary Ninja, HyperDbg), reverse engineering, vulnerability classes, exploitation, fuzzing, trusted computing and Bluetooth security. Actively maintained — 2025 additions include AFL++ fuzzing, Bluetooth reconnaissance and TPM programming in Python, with an introductory emulator course listed for 2026.