ARM64 Stack Internals and Call-Stack Obfuscation on Apple Si...

[carlospolop]

Blog URL

https://mdsec.co.uk/2026/08/arm64-stack-internals-and-obfuscation-on-apple-silicon

Blog Title

ARM64 Stack Internals and Call-Stack Obfuscation on Apple Silicon

Blog high summary

The post explains ARM64 stack frames, Mach-O unwind metadata, and ARM64e PAC, then shows how an implant can build synthetic frames that a tool such as /usr/sbin/spindump accepts as legitimate.

Valid executable PCs, matching unwind recipes, CFA-based PAC signatures, and a signed trampoline can make EDR telemetry show a false call chain. No CVE, copy-paste PoC, or privilege-escalation technique is described.

PR changes

• src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/README.md: Added or revised coverage of ARM64/ARM64e Call-Stack Spoofing.
• src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/arm64-arm64e-call-stack-spoofing.md: Created a page covering ARM64/ARM64e Call-Stack Spoofing; Why metadata-driven unwinding can be spoofed; ARM64 frame state; Selecting a Mach-O unwind recipe.

Errors

mdbook build unavailable

[carlospolop]

merge

[carlospolop]

Sunday editorial verdict: defer
Reviewed head: 9835794fb1e93870fbe644d168f8bdeb5a2d656a

This proposal needs a fresh or manual review before a merge signal can be posted.

• candidate_introduces_broken_rendered_links_or_fragments

[carlospolop]

Decision: keep

Documents ARM64/ARM64e call-stack spoofing on macOS by constructing synthetic frames that match Mach-O unwind recipes. It explains frame layout, compact-unwind selection, PAC prerequisites, and safe restoration constraints that can make telemetry show a false call chain. The technique is reusable macOS telemetry evasion, not an incident, malware-family, or CVE recap.

Head: 6237000bd7a0172d883691c8f135c41be0d5a811

[carlospolop]

merge

[carlospolop]

Sunday editorial verdict: defer
Reviewed head: 6237000bd7a0172d883691c8f135c41be0d5a811

This proposal needs a fresh or manual review before a merge signal can be posted.

• ready_retains_disqualified_contribution

[carlospolop]

Decision: keep

Documents macOS ARM64/ARM64e call-stack telemetry spoofing through synthetic frames that match Mach-O unwind recipes. It explains the CFA and PAC constraints, failure conditions, and restore bridge required to produce symbolizable false call chains without changing executable unwind metadata. The macOS-specific mechanism is substantive, reusable, source-supported, and absent from the curre…

Head: 6237000bd7a0172d883691c8f135c41be0d5a811

[carlospolop]

merge

[carlospolop]

Sunday editorial verdict: defer
Reviewed head: 6237000bd7a0172d883691c8f135c41be0d5a811

Adds macOS-specific coverage of ARM64/ARM64e call-stack spoofing through synthetic frames that satisfy Mach-O unwind metadata. It documents recipe selection, PAC-bound return addresses, and the trampoline/restore requirement for preserving execution.

• The proposal contains a reusable macOS mechanism absent from the current base; existing stack-spoofing coverage is Windows-specific.
• The original research and primary LLVM, Clang, and Arm documentation support the retained mechanism and constraints.
• Placement under macOS Process Abuse is coherent, and current-base navigation anchors remain valid.
• Citations, references, banners, code fences, internal links, and fragments were checked. No unresolved editorial errors remain.
• No other open PR matched the mechanism, compact-unwind, synthetic-frame, or spindump searches.
• The base changed after review; source/coverage and candidate validation need a fresh review. No repairs or merge signal were published.

Editorial repairs:

• src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/arm64-arm64e-call-stack-spoofing.md: Condensed duplicated ARM64 register and prologue background into a link to the canonical assembly page while retaining the frame relationships required by the spoofing technique.

[carlospolop]

Decision: keep

Adds macOS ARM64/ARM64e call-stack spoofing coverage, including Mach-O unwind-recipe matching, PAC constraints, and safe restoration requirements. The proposal documents a reusable macOS telemetry-deception mechanism absent from the current book, not merely a campaign, product, or incident recap.

Head: 29afa8946dc056d53fa53fd11dbb1b9d0b0bd6a2

[carlospolop]

merge

[carlospolop]

Decision: keep

Documents macOS ARM64 call-stack spoofing through synthetic frames that match Mach-O unwind recipes, including arm64e pointer-authentication constraints and the restore trampoline needed for safe execution. This can produce mapped, symbolizable stacks that misrepresent real control flow to metadata-driven collectors. MDSec's original research directly supports the reusable macOS technique,…

Head: 68a6fc746e17453d9f5d4c4325eb4f98baab2615

[carlospolop]

merge

[carlospolop]

Superseded repeated review: this PR already had a merge approval and should not have been reviewed again. That existing approval is restored and preserved; this historical report is not a new decision.