Macos Process Injection

This is a comprehensive playbook for injecting code into macOS processes using DYLD_INSERT_LIBRARIES, dylib hijacking (weak/rpath/proxy variants), XPC service exploitation, and Mach port manipulation. You'd use this when pentesting macOS apps or researching privilege escalation vectors. The skill covers the critical details base models miss, like which binaries accept DYLD environment variables (hardened runtime blocks them unless explicitly entitled), how PID reuse attacks work against poorly validated XPC services, and why audit tokens matter more than PIDs for validation. It's thorough on both technique and constraints, with tables showing exactly what works against SIP-protected binaries versus sandboxed apps. The practical code snippets and one-liners for finding injectable targets make it immediately actionable.

skills.sh installs: 3.7K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill macos-process-injection --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: macOS Process Injection — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert macOS process injection techniques. Covers DYLD_INSERT_LIBRARIES, dylib hijacking (weak/rpath/proxy), XPC PID reuse attacks, Mach port manipulation, MIG abuse, and Electron injection. Base models miss entitlement prerequisites and SIP constraints on injection vectors.

0. RELATED ROUTING

Before going deep, consider loading:

macos-security-bypass when you need to bypass TCC, Gatekeeper, or SIP protections blocking your injection
linux-privilege-escalation for Unix-layer escalation (shared object hijacking concepts apply)