Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Mac OS Kernel Debugging
Pro tips:
- Use a VMVirtual Machine or a thunderbolt-to-ethernet adapter. USB-to-ethernet adapters do not work.
- Look for the README.html included with the KDK, usually, /Library/Developer/KDKs/*/README.html
- Use ifconfig to find the interface you'll be attaching to
- Setup a static ARPAddress Resolution Protocol entry on the target system: arp -s 1.2.3.4 XX:XX:XX:XX:XX:XX
- Set your boot-args like this: nvram boot-args="debug=0x146 kdp_match_name=en0 kext-dev-mode=1 pmuflags=1 slide=0 -v"
- Reboot, the target
- Press left-cmd + right-cmd + power to trigger an NMI
- It should say Debugger Not Configured, Hanging...
- On the debug host: xcrun lldb /Library/Develoer/KDKs/*/kernel, then kdp-remote 1.2.3.4 to attach