macos-process-injectionlisted

# SKILL: macOS Process Injection — Expert Attack Playbook > **Scope**: Expert macOS process injection techniques. Covers DYLD_INSERT_LIBRARIES, dylib hijacking (weak/rpath/proxy), XPC PID reuse attacks, Mach port manipulation, MIG abuse, and Electron injection. Notes entitlement prerequisites and SIP constraints per injection vector. ## Related Skills Before going deep, see also: - `macos-security-bypass` when you need to bypass TCC, Gatekeeper, or SIP protections blocking your injection - `linux-privilege-escalation` for Unix-layer escalation (shared object hijacking concepts apply) ### Advanced Reference Also load [DYLIB_XPC_TECHNIQUES.md](./DYLIB_XPC_TECHNIQUES.md) when you need: - Step-by-step dylib hijacking methodology with tooling commands - XPC exploitation walkthrough with code examples - Mach port technique details and task_for_pid patterns --- ## 1. DYLD_INSERT_LIBRARIES INJECTION The most straightforward injection: set an environment variable that forces the dynamic linker to preload your dylib. ### 1.1 Requirements and Restrictions | Condition | Can Inject? | Reason | |---|---|---| | Normal (non-hardened) binary | Yes | No restrictions | | Hardened Runtime enabled | No | DYLD strips env vars | | Hardened Runtime + `com.apple.security.cs.allow-dyld-environment-variables` | Yes | Entitlement explicitly allows it | | Apple system binary (SIP-protected) | No | DYLD env vars stripped by SIP | | SUID/SGID binary | No | DYLD env vars stripped for privilege sa