Quick start for testing:
chmod +x build.sh
./build.shThe build.sh script automatically:
- Checks for the presence of Xcode command-line tools
- Verifies all necessary source files
- Locally signs the binary file
- Launches the built app bundle
The module is launched once per bot_id using a mutex.
- POST /config — receives an encrypted Salsa20 response containing {login, password, address, version}
- Reverse SOCKS5: establishes a persistent connection to the server, performs SOCKS5 authentication, and supports CONNECT, BIND, and UDP_ASSOCIATE commands.
- In parallel, polls the control stream every 10 seconds; on HTTP 200 response, stops and exits.
In main.m:
dynamicBotId— automatically generated based on the MAC address in a specified format.servers\":[\"https://127.0.0.1:50443\"]— C2 server address.- Salsa20 key (32 bytes):
(uint8_t*)"\x00\x01\x02\x03\x04\x05\x06\x07" "\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F" "\x10\x11\x12\x13\x14\x15\x16\x17" "\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F", servers\":[\"http://127.0.0.1:1080\"]— backup.
- macOS (Apple Silicon M1/M2 or Intel)
- Xcode command-line tools (clang)
Allows editing parameters and customizing the build process.
Automatically checks and installs dependencies: Python, PyQt5, Xcode CLT, Homebrew, create-dmg, ImageMagick.
Supports modes: debug binary, release .app bundle, DMG (with/without installer), PKG.
Compiles with clang, signs with codesign, adds icons/backgrounds, creates bundles with AppleScript for DMG.
- build.py: Main Python script with PyQt5 GUI for configuration and building.