ARM64 Stack Internals and Call-Stack Obfuscation on Apple Si...

[carlospolop]

Blog URL

https://mdsec.co.uk/2026/08/arm64-stack-internals-and-obfuscation-on-apple-silicon

Blog Title

ARM64 Stack Internals and Call-Stack Obfuscation on Apple Silicon

Blog high summary

The post explains ARM64 stack frames, Mach-O unwind metadata, and ARM64e PAC, then shows how an implant can build synthetic frames that a tool such as /usr/sbin/spindump accepts as legitimate.

Valid executable PCs, matching unwind recipes, CFA-based PAC signatures, and a signed trampoline can make EDR telemetry show a false call chain. No CVE, copy-paste PoC, or privilege-escalation technique is described.

PR changes

• src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/README.md: Added or revised coverage of ARM64/ARM64e Call-Stack Spoofing.
• src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/arm64-arm64e-call-stack-spoofing.md: Created a page covering ARM64/ARM64e Call-Stack Spoofing; Why metadata-driven unwinding can be spoofed; ARM64 frame state; Selecting a Mach-O unwind recipe.

Errors

mdbook build unavailable

[carlospolop]

Previous merge signal withdrawn for head 9835794fb1e93870fbe644d168f8bdeb5a2d656a.

The live Sunday review deferred this head after a rendered-link regression. A fresh passing review is required.

[carlospolop]

Sunday editorial verdict: defer
Reviewed head: 9835794fb1e93870fbe644d168f8bdeb5a2d656a

This proposal needs a fresh or manual review before a merge signal can be posted.

• candidate_introduces_broken_rendered_links_or_fragments

[carlospolop]

Sunday editorial verdict: ready
Reviewed head: 6237000bd7a0172d883691c8f135c41be0d5a811

Documents ARM64/ARM64e call-stack spoofing on macOS by constructing synthetic frames that match Mach-O unwind recipes. It explains frame layout, compact-unwind selection, PAC prerequisites, and safe restoration constraints that can make telemetry show a false call chain.

• The technique is reusable macOS telemetry evasion, not an incident, malware-family, or CVE recap.
• The current base covers ARM64 fundamentals, stack collection, and Windows stack spoofing, but not Mach-O metadata-driven synthetic call chains.
• Primary specifications corroborate the frame layout, compact-unwind modes, and ARM64e return-address signing requirements.
• Placement under macOS Process Abuse is discoverable from the offensive objective and links to the existing stackshot and ARM64 background pages.
• Corrected an overstatement so pointer signing is required specifically for authenticated returns and branches, rather than every branch instruction.
• Markdown structure, citations, reference numbering, banners, local links, and reference blocks were checked without running mdBook or repository scripts.

Editorial repairs:

• src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/arm64-arm64e-call-stack-spoofing.md: Corrected the ARM64e trampoline wording to distinguish authenticated control transfers, which require correctly signed pointers, from unauthenticated branch forms.

[carlospolop]

merge

[carlospolop]

Sunday editorial verdict: defer
Reviewed head: 6237000bd7a0172d883691c8f135c41be0d5a811

This proposal needs a fresh or manual review before a merge signal can be posted.

• ready_retains_disqualified_contribution

[carlospolop]

Sunday editorial verdict: ready
Reviewed head: 6237000bd7a0172d883691c8f135c41be0d5a811

Documents macOS ARM64/ARM64e call-stack telemetry spoofing through synthetic frames that match Mach-O unwind recipes. It explains the CFA and PAC constraints, failure conditions, and restore bridge required to produce symbolizable false call chains without changing executable unwind metadata.

• The macOS-specific mechanism is substantive, reusable, source-supported, and absent from the current base coverage.
• MDSec's research supports the synthetic-frame workflow and restore bridge; LLVM, Clang, and Arm documentation corroborate the unwind encodings, return-address PAC schema, and frame-record rules.
• The macOS Process Abuse section is the canonical destination. The parent navigation, SUMMARY entry, relative links, banners, citations, and References section are correctly formed.
• No relevant overlapping pending PR was identified, and no editorial repair was necessary.

[carlospolop]

merge

[carlospolop]

Sunday editorial verdict: defer
Reviewed head: 6237000bd7a0172d883691c8f135c41be0d5a811

Adds macOS-specific coverage of ARM64/ARM64e call-stack spoofing through synthetic frames that satisfy Mach-O unwind metadata. It documents recipe selection, PAC-bound return addresses, and the trampoline/restore requirement for preserving execution.

• The proposal contains a reusable macOS mechanism absent from the current base; existing stack-spoofing coverage is Windows-specific.
• The original research and primary LLVM, Clang, and Arm documentation support the retained mechanism and constraints.
• Placement under macOS Process Abuse is coherent, and current-base navigation anchors remain valid.
• Citations, references, banners, code fences, internal links, and fragments were checked. No unresolved editorial errors remain.
• No other open PR matched the mechanism, compact-unwind, synthetic-frame, or spindump searches.
• The base changed after review; source/coverage and candidate validation need a fresh review. No repairs or merge signal were published.

Editorial repairs:

• src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/arm64-arm64e-call-stack-spoofing.md: Condensed duplicated ARM64 register and prologue background into a link to the canonical assembly page while retaining the frame relationships required by the spoofing technique.

[carlospolop]

Sunday editorial verdict: ready
Reviewed head: 29afa8946dc056d53fa53fd11dbb1b9d0b0bd6a2

Adds macOS ARM64/ARM64e call-stack spoofing coverage, including Mach-O unwind-recipe matching, PAC constraints, and safe restoration requirements.

• The proposal documents a reusable macOS telemetry-deception mechanism absent from the current book, not merely a campaign, product, or incident recap.
• The MDSec research supports synthetic recipe-matching frames and the restore bridge; LLVM, Clang, and Arm sources corroborate the unwind encodings, PAC discriminator, and frame-record details.
• Placement under macOS Process Abuse is appropriate, with links to existing stackshot and ARM64 background pages and navigation in the parent page and SUMMARY.
• The duplicated ARM64 register primer was removed in favor of a link to the existing canonical overview; unique CFA and unwinding context remains.
• References, citations, Markdown fences, banners, internal links, and the target fragment were checked successfully.

Editorial repairs:

• src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/arm64-arm64e-call-stack-spoofing.md: Removed duplicated register and calling-convention explanation and linked that prerequisite context to the existing ARM64 overview while preserving the unique unwind-specific material.

[carlospolop]

merge

[carlospolop]

Sunday editorial verdict: ready
Reviewed head: 68a6fc746e17453d9f5d4c4325eb4f98baab2615

Documents macOS ARM64 call-stack spoofing through synthetic frames that match Mach-O unwind recipes, including arm64e pointer-authentication constraints and the restore trampoline needed for safe execution. This can produce mapped, symbolizable stacks that misrepresent real control flow to metadata-driven collectors.

• MDSec's original research directly supports the reusable macOS technique, including recipe-matched synthetic frames, PAC-bound return addresses, and the trampoline/restore requirement.
• LLVM, Clang, and Arm documentation corroborate the compact-unwind encodings, arm64e return-address schema, and ARM64 frame-record semantics.
• Current coverage describes Windows stack spoofing and basic macOS stack collection, Mach-O, and ARM64 concepts, but not this Apple-specific synthetic-unwind workflow.
• The page is correctly placed under macOS Process Abuse, with valid navigation, internal links, banners, references, citations, and balanced code fences.
• Plausibly related pending PR diffs were checked and do not duplicate this contribution.

Editorial repairs:

• src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/arm64-arm64e-call-stack-spoofing.md: Corrected attribution for compact-unwind mode behavior by citing the original research alongside LLVM's encoding definitions.

[carlospolop]

merge

[carlospolop]

Sunday editorial verdict: ready
Reviewed head: 68a6fc746e17453d9f5d4c4325eb4f98baab2615

On macOS ARM64, metadata-driven unwinders can accept synthetic frame records when selected PCs match Mach-O unwind recipes, producing a false but symbolizable call chain. On arm64e, saved return addresses and control transfers must satisfy PAC key and CFA-discriminator requirements; a compatible trampoline restores execution state.

• The proposal documents a reusable macOS telemetry-evasion mechanism absent from the current book: constructing synthetic ARM64 frames that satisfy Mach-O unwind metadata.
• The MDSec research supports the synthetic-frame mechanism, exact-recipe constraint, PAC-aware trampoline, and restoration requirements. LLVM, Clang, and Arm documentation corroborate the unwind encodings, arm64e return-address schema, and frame-record layout.
• Existing Windows stack-spoofing and generic ARM64 PAC/stack-pivot material do not cover the macOS Mach-O unwind workflow or its CFA-bound arm64e requirements.
• Placement under macOS Process Abuse is appropriate for in-process stack manipulation, with navigation from the parent page and SUMMARY and links to the existing ARM64 and stackshot context.
• No relevant overlapping open PR was found. References, citations, includes, relative links, banners, and navigation paths were checked without errors.