Scott Knight

USBApp. A small test app that tries to load a USBDriverKit system extension

gapstone. gapstone is a Go binding for the capstone disassembly library

XProtect. macOS XProtect definition files

osx_and_ios_kernel_programming. Updated sample code for OS X and iOS Kernel Programming book

system_policy. osquery table extension that allows querying of information from the macOS private SystemPolicy.framework

hopper. A collection of Hopper plugins and scripts

EndpointSecurity. A module to expose the Endpoint Security library to Swift

Tracer. macOS application that makes use of the EndpointSecurity framework

micromdm-webhook-blueprints. Example webhook listeners for the MicroMDM server

EnterDebugger. A kext to facilitate calling PE_enter_debugger on machines that don't respect Cmd-Ctrl-Opt-Shift-Esc

darwin-xnu. The Darwin Kernel (mirror)

CVE. A collection of CVE POC code

CoreAnimationPlayground. A Swift playground demonstrating how to use Core Animation

sandbox_profiles. A collection of sandbox files from macOS 10.9 through 10.15

lldb. A collection of lldb scripts and configuration files

LittleRooter. An Educational MACF / Root Kit Primer

Presentations. Slides from various presentations and conferences

knightsc.github.io. Content for https://knight.sc

bbstats. Python library for aggregating basketball statistics from different leagues

r2. A collection of radare2 scripts and configuration files

sb. A Go library for working with macOS SBPL files

ansible-role-macos-certificates. Ansible role to install and trust root certificates

vboxloader. Example code to load code into the kernel using VBoxDrv.kext

SmaliReverse. A Sublime Text plugin to help with APK reversing

PyfxTrade. A Python library for accessing Oanda's fxTrade REST API