AI
XProtect Remediator as an Attack Surface
XProtect Remediator (XPR) is macOS’s third malware defense layer. Unlike Gatekeeper and traditional XProtect, which block execution and distribution, XPR activates after malware is already running and removes it. Introduced in Monterey to replace MRT, it now ships 23 scanning modules, each targeting a specific malware family. Apple updates it weekly.
XPR runs with both root and user privileges and holds entitlements including full disk access. Bugs in it can yield TCC bypass or privilege escalation. Patrick Wardle published a proof-of-concept demonstrating full disk access obtained through an XPR scanner.
Toolchain for Reversing Stripped Swift Binaries
XPR’s 23 modules are stripped Swift binaries. Nakagawa recovered partial symbols by binary diffing XPR scanners against XProtect payload derivatives using BinDiff, then wrote binja-swift-analyzer, a Binary Ninja plugin that annotates type metadata accessors and protocol witness table symbols in the disassembly. He walked through the Binary Ninja Swift analyzer plugin demo (08:23) live.
An LLDB script captures indirect branch targets at runtime and imports them into Binary Ninja. A second script fully decrypts XOR-obfuscated strings that a prior Huntress script had left partially undecrypted, exposing file paths, hashes, and YARA rules inside each module.
Remediation Builder: Apple’s Detection DSL
XPR encodes its detection logic using Swift result builders, a DSL Apple introduced in Swift 5.4. Nakagawa named this system Remediation Builder. Each scanner expresses conditions declaratively: file path, size limit, format check, notarization status, YARA match. The result reads like a policy spec rather than nested if-statements. Separate builders handle files, processes, services, and Safari extensions.
“This is exactly what Apple did.” — Koh Nakagawa
About half the 23 scanners use this DSL. The rest call lower-level XProtect plugin APIs directly. Nakagawa published the full DSL specification and an open-source reference implementation on GitHub.
What Individual Scanners Reveal About Apple’s Threat Intel
Three scanners reveal Apple’s private threat intelligence. XPRLaunch kills processes by CD hash, targeting two Upgrade Agent variants from the 3CX supply chain attack; the second hash points to a more capable variant Patrick Wardle predicted but had not confirmed. XPRBadger scans mounted disk image backgrounds via OCR, catching “right click” and “click open” Gatekeeper bypass strings used by ChromeLoader. XPRRedPrime, now retired, read process memory because the Operation Triangulation macOS implant leaves nothing on disk. Its checked paths include FM Core framework as a fake dylib backing file, suggesting a custom reflective loader. Nakagawa built one to confirm this (30:37).
Provenance Sandbox: Tracing Malware to Its Dropper
Provenance sandbox traces any file back to the app that created it. When an app first runs, syspolicyd records it in the AMFI policy database and stamps a random 8-byte attribute on every file the app creates or renames. XPR reads this at remediation time, identifies which cracked dropper delivered the payload, and reports it to Apple for notarization and certificate revocation. Multiple cracked apps distributing the same payload can all be surfaced this way.
Provenance attributes serve as forensic artifacts for third-party defenders. Nakagawa demonstrated the provenance attribute tool (35:32) and is adding provenance collection to the incident response framework.
Vulnerabilities in XPR and Provenance Sandbox
XPR carries a TOCTOU deletion bug matching the “iDontKnoWiper” class found in Windows EDR products. After a YARA rule matches, substituting the target file with a symlink redirects deletion to any file on the system. The timing window is visible: unified log emits a YARA match entry before the delete runs. XPR’s full disk access entitlement makes the primitive dangerous.
Provenance sandbox had the same structural weakness as app sandbox. Launching a process via Launch Services or through XPC were both bypasses, now patched. Prior app sandbox escape research is a good starting point for finding new provenance sandbox holes.
Notable Quotes
current XPO remedies threat silently Koh Nakagawa · ▶ 13:45
This is exactly what Apple did. Koh Nakagawa · ▶ 19:54
Xperia is a treasure t of Apple’s authentic intelligence. Koh Nakagawa · ▶ 38:19
Key Takeaways
- XPR’s 23 stripped Swift modules can be partially reversed using binary diffing, Swift reflection metadata, and custom LLDB scripts.
- Individual scanner detection strings reveal Apple’s private threat intelligence, including malware variants not publicly documented.
- TOCTOU file deletion and provenance sandbox bypass bugs follow the same patterns as known app sandbox escapes.