Image: github.com · Illustrations of the DX-Ball sound-pan, Notion clipboard-bridge, and TH04 bullet-ring showcases
MachSentry: macOS malware analysis built on REA
A static Mach-O malware analyser derived from REA, with evidence-linked function addresses, behaviour scoring and opcode-aware YARA rules.
Credits
Earliest dated source:
The full story
MachSentry is a fork of REA specialised in static analysis of macOS (Mach-O) malware. REA and its Ghidra provider supply the functions, references, assembly and pseudocode. A Python module then reads that evidence over MCP and adds a behaviour report, recovered AppleScript fragments, an explainable risk score and candidate YARA detection rules built from strings and opcodes.
The main output is a report.html with fixed sections for the analyst and a justification for each YARA criterion. Samples are never run and indicators are never contacted. The report separates observed evidence from inferred behaviour and gaps in coverage. The README is in Portuguese.
How it was done
Tools
Themes
Loading themes…
Sources
From the maker's own write-up or code. We summarise what they report; we haven't tested it ourselves.
- REA community: h4wk0x01/machsentry: Static macOS Mach-O malware analysis with evidence-linked function addresses, bRepository account: h4wk0x01Published
The fork, set-up steps and report format (README in Portuguese).