Some malware families that target macOS and iOS incorporate universal anti-RE techniques that work for most other platforms. Here are some examples:
- Detection of protection software: In this case, malware checks for the presence of the corresponding files or processes and generally either terminates itself, or tries to disable them in order to remain undetected. An example could be the CookieMiner family checking for the presence of the Little Snitch firewall on macOS.
- Protection against reverse-engineering tools: Here, malware complicates malware analysis by detecting particular behaviors associated with debugging or behavioral analysis. Examples of these techniques include the following:
- Code and data obfuscation: The malware tries to complicate the analysis by making itself unreadable in disassembly.
- Checks for self-integrity: The malware calculates checksums against its body in order to detect any changes taking place.
- Detection of RE tools...
