re docs Download - re docs Source code download

A complete guide to macOS configuration for security researchers

Apple M4 Pro is the environment configured for demonstration. After receiving the machine, it powers up and starts setting up.

Environmental preparation

First, open App Store and download and install Xcode.

Start Xcode and install the command line tools. Or the terminal can execute xcode-select --install .

The terminal executes sudo spctl --master-disable to enable third-party or ad-hoc signature program running.

Next, install HomeBrew . The download address needs to be proxyed and run the following command to install:

/bin/bash -c " $( curl -fsSL https://github.com/Homebrew/install/raw/master/install.sh ) "

Downloading the software may sometimes fail to succeed. Run the following command to set up the agent.

 echo ' export HOMEBREW_BREW_GIT_REMOTE="https://mirrors.tuna.tsinghua.edu.cn/git/homebrew/brew.git" ' >> ~ /.zprofile
echo ' export HOMEBREW_CORE_GIT_REMOTE="https://mirrors.tuna.tsinghua.edu.cn/git/homebrew/homebrew-core.git" ' >> ~ /.zprofile
export HOMEBREW_BREW_GIT_REMOTE= " https://mirrors.tuna.tsinghua.edu.cn/git/homebrew/brew.git "
export HOMEBREW_CORE_GIT_REMOTE= " https://mirrors.tuna.tsinghua.edu.cn/git/homebrew/homebrew-core.git "

Commonly used command line tools and libraries

Install the following tools and libraries.

Installation via `brew`

brew install graphviz libsoup pkg-config grep libsoup@2 plantuml apktool gstreamer libssh2 poetry aria2 
    gtk+3 libtasn1 poppler gtk4 libtiff protobuf libtool psutils autoconf harfbuzz libunibreak pup automake 
    helm libunistring awscli help2man libusb pycparser bash libusbmuxd pygobject3 bash-completion libusrsctp 
    bc binutils imagemagick bison [email protected] libx11 brotli jadx qemu ca-certificates jpeg-turbo libxext qt 
    quickjs capstone jq json-glib readline jsoncpp rename jsonrpc-glib libyaml repo lima reprepro colima 
    coreutils llvm ruby cryptography libarchive llvm@18 scrcpy curl lua sdl2 lz4 shared-mime-info dbus lzip simg2img 
    dbus-glib smali docker-completion make dtc dwarf mbedtls dwarfutils libedit sqlite libelf meson libevent 
    mitmproxy ffmpeg libffi file-formula libgcrypt flac libgee mpg123 tcpdump flex tesseract fontconfig ncurses 
    tesseract-lang freetype texinfo libimobiledevice ninja gawk libimobiledevice-glue node npm tree gcc u-boot-tools 
    gdbm libmagic nspr ucl gettext gh unifdef libnghttp2 nvm unzip libnghttp3 vala libnice vala-language-server git 
    glib openjdk vim glib-networking openjdk webp libpcap openjpeg wget gnu-sed libplist [email protected] gnupg 
    libpng openssl@3 x264 gnutls libpsl x265 go gobject-introspection pango xz googletest pcre2 youtube-dl gost perl 
    yt-dlp gperf z3 libslirp gradle pipx zip libsodium zstd p7zip jtool2 ios-deploy binwalk upx

graphviz and plantuml are essential for drawing.

apktool and smali decompilation APKs should be used.

aria2 , wget and curl download software are used.

go and go-ios are essential for golang and ios development.

yt-dlp and youtube-dl are command-line tools for downloading youtube videos.

llvm and gcc compiler suite are used for software development.

lima and colima use command-line methods to manage virtual machines.

python , node , etc. are the basic environments for running a large number of third-party software.

scrcpy is used for Android device screen projection.

tesseract is used for OCR recognition.

ffmpeg is used for video encoding and transcoding, this one is enough.

Among them, there are a large number of libraries that are used in these software, and some are used in developing vala programs. I will not introduce them one by one here.

Configuration

Some software needs to configure login and set up agents.

gh

This is the official command line tool of github, which is very convenient to manage warehouses. You can use it after logging in.

gh auth login

pip

Set the mirror of pip.

 export HOMEBREW_PIP_INDEX_URL= " https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple "
python -m pip install --upgrade pip
pip config set global.index-url https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple

npm

Set npm mirror.

npm config set registry https://registry.npmmirror.com

Install some npm tools.

npm install -g go-ios frida

bito

Although there is a vscode plugin version. But using the command line version is cooler.

brew tap gitbito/bitocli
brew install bito-cli

Run the command to log in. Of course, you need to register an account first, and ask questions 20 free times a day.

bito

alias and bash functions

Making alias and bash functions can speed up processing of command-line operations.

 cc () {
    git rev-list --count $1
}

rebase () {
    git rebase -i HEAD~ $1 && git push -f
}

status () {
    git status
}

log () {
    git log
}

push () {
    git add --all && git commit -m " $1 " && git push
}

# squash 4 "update"
squash () {
    git reset --soft HEAD~ $1 && git add --all && git commit -m " $2 . " && git push -f
}

touchm () {
    find $1 -type f -exec touch -m {} ;
}


# rmall ~/ ".DS_Store"
rmall () {
    find $1 -name $2 -exec rm {} ;
}

rmdsstore () {
    find . -name " .DS_Store " -exec rm {} ;
}

# renameext jpg zip
renameext () {
    rename " s/ $1 / $2 / " *
}

cls () {
    /usr/bin/osascript -e ' tell application "System Events" to tell process "Terminal" to keystroke "k" using command down '
}

# xattrd ~/Downloads/1.app
xattrd () {
    /usr/bin/xattr -r -d com.apple.quarantine $1
    # or
    /usr/bin/xattr -c $1
}

# random 32
random () {
    echo $RANDOM | md5sum | head -c $1 ; echo ;
}

xattrd () {
    if [[ -z $1 ]] ; then
        echo xattrd path
        return
    fi
    xattr -r -d com.apple.quarantine " $1 "
}

alias clean=cls

alias clear= " printf '33ce[3J' "

alias ll= " ls -al "

alias simlog= " tail -f ~/Library/Logs/CoreSimulator/*/system.log "

Commonly used GUI tools

First of all, it is a commonly used IDE, which is installed according to personal development needs. brew install android-studio pycharm clion goland .

The JB series has a free community version. The professional version can be applied for free for open source projects and can be used for one year. You can also purchase it through other channels or be harmonious. If you have the conditions, it is recommended to buy it, productivity tools are really easy to use.

Installation via brew

brew install --cask cmake wireshark charles 1password disk-drill windows-app displays mitmproxy orbstack obs 
    flutter oracle-jdk usbimager flux utm balenaetcher phantomjs vienna beyond-compare visual-studio-code 
    ghidra raspberry-pi-imager github vnc-viewer hiddenbar crescendo iina cryptomator itraffic tabby termius 
    microsoft-office google-chrome xmind localsend 010-editor wechat qq telegram bilibili showyedge angry-ip-scanner 
    iterm2 sentinel battery microsoft-auto-update viz pearcleaner pdf-expert hex-fiend vmware-fusion raycast 
    ios-app-signer motrix listen1 bit-slicer clash-verge-rev qingg logseq ImageOptim Snipaste licecap

wireshark , charles and mitmproxy are essential for grabbing packets.

1password is the best password management software.

disk-drill is a good disk management tool.

windows-app is a 3389 remote connection software produced by micro-software. It is free and easy to use and basically kills similar paid software produced by Apple.

displays is a desktop resolution management software.

orbstack is a free software that integrates Docker and virtual machines, and must be installed.

obs is an open source screen recording and streaming software, which is the best use, no doubt about it.

usbimager , balenaetcher , and raspberry-pi-imager are tools for burning hard disk images. I usually use the middle one.

flux is an eye protection tool that automatically adjusts the display brightness and color temperature according to time and time zone.

vienna is a free RSS subscriber that I use every day to watch blogs and tech repository updates.

beyond-compare and 010-editor are powerful tools for file editing and comparison.

visual-studio-code is a must-use editor every day, and it can also be said to be an IDE, a tool that developers around the world produces like.

ghidra is an open source decompilation tool used to replace commercial software IDA Pro , but it cannot shake its position at present.

github is an official repository code management tool, and it is also easy to use. vnc-viewer is a VNC remote connection tool, and having is better than not.

hiddenbar is used to manage the display and hide icons of the status bar, and it is OK to use for free.

crescendo is a kernel extension for behavior and network analysis, a powerful tool for security analysts.

iina is the best open source video player, no one.

cryptomator is an encryption tool that is essential for managing small secrets.

itraffic looks at the traffic of the local process, and captures the software that transmits traffic. Malicious uploads are clear at a glance.

tabby and termius are open source free and paid terminal tools, which are also good, and I also like iterm2 for free.

microsoft-office is an office suite, produced by Microsoft, and is used by people around the world.

google-chrome is Google's Chrome browser and it is also used every day.

xmind drawing tool is considered Guoguang.

localsend to pass files across platforms, I rely on it.

Needless to say, wechat and qq .

telegram is the best IM in the world.

bilibili is a paradise of the two dimensions.

showyedge is essential for it. It displays different states of the input method in the status bar with a line of different colors, so that I know what input method is currently using, without having to stalk my neck and look at the status bar in the upper right corner.

angry-ip-scanner is used to scan local network IP and device information. A network environment with many devices is essential.

snip free screenshot tool, easy to use.

sentinel is also essential for Apple users. If the frequently downloaded third-party tools do not have signatures or ADHOC signatures, it will prompt that they are damaged and deleted. Use this tool to erase the additional information of the file.

battery is a free battery management software. Apple's battery is expensive, so it is absolutely right to use it to observe.

viz is an open source screenshot and screen QR code scanning tool, which looks better than snip .

pearcleaner is an open source software uninstallation management software.

pdf-expert is a must-have for viewing PDFs.

hex-fiend is a free hex editing tool.

utm and vmware-fusion are both free virtual machine software for personal use, but I am now using orbstack .

raycast is used to replace the official focus search, which is very useful.

ios-app-signer is an IPA signature tool, but you just buy your own certificate, which is really expensive.

motrix is an open source download software, so I don’t recommend Thunder here.

listen1 is a free cross-platform music player, which integrates song search and listening to music. I don’t recommend domestic music players.

bit-slicer is a memory search tool, and you can understand it.

clash-verge-rev is the successor of clash-for-windows .

qingg Qingge is the best free input method.

logseq is an open source note management software that supports markdown and is easy to use. It is a substitute for typora.

ImageOptim is an open source free image compression tool.

Snipaste is a powerful cross-platform screenshot and map tool, providing personal free versions and paid versions.

licecap is a cross-platform open source gif recording tool.

Configuration

Some common tools also require additional configuration.

vscode configuration

Use the following command to install the plug-in.

code --install-extension asabil.meson

Below are the plug-ins I installed.

code --list-extensions
aaron-bond.better-comments
asabil.meson
atlassian.atlascode
bierner.markdown-mermaid
bito.bito
bpfdeploy.bpftrace
bpruitt-goddard.mermaid-markdown-syntax-highlighting
codeium.codeium
codezombiech.gitignore
cornell3110sp20.rml-highlighter
davidanson.vscode-markdownlint
dbaeumer.vscode-eslint
dotjoshjohnson.xml
eamodio.gitlens
eriklynd.json-tools
formulahendry.code-runner
foxundermoon.shell-format
genieai.chatgpt-vscode
github.codespaces
github.copilot
github.copilot-chat
github.github-vscode-theme
github.remotehub
github.vscode-github-actions
github.vscode-pull-request-github
gitpod.gitpod-desktop
golang.go
google.aidl-language
googlecloudtools.cloudcode
gruntfuggly.todo-tree
jebbs.plantuml
jeff-hykin.better-cpp-syntax
jock.svg
josephcz.vscode-markdown-mindmap-preview
josetr.cmake-language-support-vscode
jrieken.md-navigate
llvm-vs-code-extensions.vscode-clangd
mesonbuild.mesonbuild
ms-azuretools.vscode-docker
ms-ceintl.vscode-language-pack-zh-hans
ms-dotnettools.csharp
ms-dotnettools.vscode-dotnet-runtime
ms-kubernetes-tools.vscode-kubernetes-tools
ms-mssql.data-workspace-vscode
ms-mssql.mssql
ms-mssql.sql-bindings-vscode
ms-mssql.sql-database-projects-vscode
ms-python.autopep8
ms-python.debugpy
ms-python.isort
ms-python.python
ms-python.vscode-pylance
ms-vscode-remote.remote-containers
ms-vscode-remote.remote-ssh
ms-vscode-remote.remote-ssh-edit
ms-vscode-remote.remote-wsl
ms-vscode-remote.vscode-remote-extensionpack
ms-vscode.azure-repos
ms-vscode.cmake-tools
ms-vscode.cpptools
ms-vscode.cpptools-extension-pack
ms-vscode.cpptools-themes
ms-vscode.hexeditor
ms-vscode.makefile-tools
ms-vscode.powershell
ms-vscode.remote-explorer
ms-vscode.remote-repositories
ms-vscode.remote-server
ms-vscode.vscode-typescript-next
msjsdiag.vscode-react-native
nicohlr.pycharm
osstekz.vala-code
prince781.vala
redhat.java
redhat.vscode-commons
redhat.vscode-xml
redhat.vscode-yaml
rogalmic.bash-debug
shakram02.bash-beautify
souche.vscode-mindmap
twxs.cmake
vadimcn.vscode-lldb
visualstudioexptteam.intellicode-api-usage-examples
visualstudioexptteam.vscodeintellicode
vscjava.vscode-gradle
vscjava.vscode-java-debug
vscjava.vscode-java-dependency
vscjava.vscode-java-pack
vscjava.vscode-java-test
vscjava.vscode-maven
vscode-icons-team.vscode-icons
webfreak.debug
xaver.clang-format
yzane.markdown-pdf
zainchen.json

orbstack configuration

Start orbstack once. Then configure it on the command line.

orb config docker
{
" registry-mirrors " : [
    " https://docker.m.daocloud.io " , 
    " https://hub.dftianyi.top " ,
    " https://noohub.ru " , 
    " https://huecker.io " ,
    " https://dockerhub.timeweb.cloud " ,
    " https://0c105db5188026850f80c001def654a0.mirror.swr.myhuaweicloud.com " ,
    " https://5tqw56kt.mirror.aliyuncs.com " ,
    " https://docker.1panel.live " ,
    " http://mirrors.ustc.edu.cn/ " ,
    " http://mirror.azure.cn/ " ,
    " https://hub.rat.dev/ " ,
    " https://docker.ckyl.me/ " ,
    " https://docker.chenby.cn " ,
    " https://docker.hpcloud.cloud " ,
    " https://docker.m.daocloud.io "
  ]
}

Install an arm64 version of Ubuntu system for daily use.

orb create ubuntu:jammy ubuntu

Installing an x86_64 version of Ubuntu system solves some x86_64 usage scenarios.

softwareupdate --install-rosetta --agree-to-license
orb create --arch amd64 ubuntu:jammy ubuntu64

Chrome Settings

Mainly extensions. The access page is: https://chromewebstore.google.com/detail/xxxx xxx is the extension ID.

Some of the extensions I installed are as follows.

cfhdojbkjhnklbpkdaibdccddilifddb
anlikcnbgdeidpacdbdljnabclhahhmd
dodmmooeoklaejobgleioelladacbeki
ghbmnnjooekpmoecnnnilnnbdlolhkhi
mclkkofklkfljcocdinagocijmpgbhab
cpcifbdmkopohnnofedkjghjiclmhdah
legbfeljfbjgfifnkmpoajgpgejojooj
padekgcemlokbadohgkifijomclgjgif
kpdjmbiefanbdgnkcikhllpmjnnllbbc
lieodnapokbjkkdkhdljlllmgkmdokcm
ikhdkkncnoglghljlkmcimlnlhkeamad
bciglihaegkdhoogebcdblfhppoilclp
bpoadfkcbjbfhfodiogcnhhhpibjhbnh
dhdgffkkebhmkfjojejmpbldmpobfkfo

Science Software

The most commonly used ones are ClashX Pro and clash-for-windows . The latter is better, so I won't expand it here.

Paid software

According to personal usage habits, there are also some paid software that need to be used. For example, CleanMyMac X , Parallels Desktop , IDA Pro , Typora , Beyond Compare , paragon-extfs , paragon-ntfs , 010-editor . Most of them can be installed through brew , except for IDA Pro . You can try it or purchase it after installation.

Parallels Desktop is really expensive to order once a year, depending on your needs.

This is about Office . Microsoft's "free" use is not strictly checked. The version installed by brew can be used without 2021 VL license on the Internet. Using microsoft-auto-update can perfectly upgrade and update. If possible, it is recommended to purchase the genuine version, which is easy to use and save trouble.