ARM64 Stack Internals and Call-Stack Obfuscation on Apple Si...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://mdsec.co.uk/2026/08/arm64-stack-internals-and-obfuscation-on-apple-silicon
• Blog Title: ARM64 Stack Internals and Call-Stack Obfuscation on Apple Silicon
• Suggested Section: macOS Hardening > macOS Security & Privilege Escalation > macOS Process Abuse > ARM64/ARM64e Call-Stack Spoofing and Mach-O Unwind Metadata Abuse

🎯 Content Summary

Overview and security impact

The post explains ARM64/ARM64e stack unwinding on Apple Silicon and demonstrates how implants can construct synthetic call stacks to deceive macOS EDR telemetry. The research began after observing a major EDR sensor invoke the built-in /usr/sbin/spindump utility rather than implement a private stack unwinder. By reversing the metadata-driven unwind process, an implant can make a sensitive API invocation appear to originate from legitimate func...

🔧 Technical Details

Metadata-driven call-stack spoofing: A stack unwinder uses each PC to select a Mach-O compact-unwind or DWARF recipe and then reads only the locations prescribed by that recipe. An attacker can reverse this process by choosing executable PCs with known recipes and constructing matching memory. For frame mode, place the previous FP at [FP], the saved return PC at [FP+8], model caller SP as FP+16, and populate any x19-x28 slots declared by the encoding. Link records through saved x29 values. A conventional unwinder generally cannot distinguish these ABI-compatible records from compiler-generated frames.

Mach-O unwind-recipe selection: Normalize PAC bits, locate the containing Mach-O __TEXT range, calculate functionOffset=normalizedPC-loadedImageBase, search the first-level __unwind_info index, and then search the selected regular or compressed...

🤖 Agent Actions

Implemented the HackTricks update.

Changes

• Added arm64-arm64e-call-stack-spoofing.md under macOS Process Abuse.
• Documented:
  • ARM64 frame/CFA layout.
  • Mach-O compact-unwind recipe lookup.
  • Synthetic frame construction.
  • ARM64e PAC requirements.
  • Trampoline and context-restoration design.
  • Stack-based EDR telemetry limitations.
• Added numbered citations to MDSec, LLVM, Clang, and Arm specifications.
• Linked the page from the Process Abuse README and src/SUMMARY.md.

Validation

• Markdown structure, citations, internal links, and forbidden-source checks passed.
• git diff --check passed.
• mdbook was not installed, so a full build could not be run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://mdsec.co.uk/2026/08/arm64-stack-internals-and-obfuscation-on-apple-silicon

Content Categories: Based on the analysis, this content was categorized under "macOS Hardening > macOS Security & Privilege Escalation > macOS Process Abuse > ARM64/ARM64e Call-Stack Spoofing and Mach-O Unwind Metadata Abuse".

Repository Maintenance:

• MD Files Formatting: 1030 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0