A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture

Post by potsandpans » Sun, Nov 23, 2025, 6:02 AM UTC

hu3 wrote: post #12

ethin wrote: post #5

This is a really interesting deep dive but why does the article hedge so much? For example, in the first few sections it says things like "... typically reveals the following sequence" or "The Boot ROM sets a specific control bit in the AES configuration register (e.g., AES_CMD_USE_GID)", which makes it sound like the author wasn't actually sure if any of this was accurate and was guessing.

It's AI assitance. If you search for "e.g." the page lights up like a christmas tree. There's 90 appearances if "e.g." I have never seen this frequency before.

Post by nicolas_17 » Sun, Nov 23, 2025, 6:32 AM UTC

ethin wrote: post #27

jjtech wrote: post #19

Earlier quoted context omitted.

All of these errors have now been stealth-corrected. New strategy discovered: Ask LLM to write article, nerdsnipe HN into correcting it, feed corrections back into LLM until people stop complaining

Yeah, definitely not at all a fan of stealth editing. I suspected LLM rewriting or generation but I don't possess enough knowledge into how the Apple pre-boot environment works to make an accurate judgement on the accuracy of the post. But I definitely had very strong suspicions of LLM influence with all the bullet lists and hem-hawing the post does; I would expect that someone who successfully reverse engineered the…

Post by deaux » Sun, Nov 23, 2025, 8:29 AM UTC

QuantumNomad_ wrote: post #11

ethin wrote: post #5

This is a really interesting deep dive but why does the article hedge so much? For example, in the first few sections it says things like "... typically reveals the following sequence" or "The Boot ROM sets a specific control bit in the AES configuration register (e.g., AES_CMD_USE_GID)", which makes it sound like the author wasn't actually sure if any of this was accurate and was guessing.

> e.g., AES_CMD_USE_GID Sometimes people mix up “i.e.” (“id est”; “that is”) and “e.g.” (“exempli gratia”; “for example”). Of course, only the author knows if this case was a mix up, or if they really wrote what they meant.

Post by matu3ba » Sun, Nov 23, 2025, 11:15 AM UTC

nicolas_17 wrote: post #16

kmeisthax wrote: post #10

Earlier quoted context omitted.

I smell AI writing assistance. Which is a shame because this is otherwise very good and well-collated information about Apple's security. But AI loves to use bullet point lists just for the hell of it and it makes the information here smell way less reliable than it actually is. I'm also not sure if it's 100% accurate. My (possibly wrong) understanding of the guarded execution feature is that each GL is paired with a…

There's many factual errors in this AI slop. For example, it says quite unambiguously that the bootloader is encrypted directly with the GID key (loading the LLB ciphertext into the AES engine), but that's not how it works, the GID key is used to decrypt the LLB's KBAG into an AES key:IV pair and that is used to decrypt the LLB. More: > The behavior of the Boot ROM changes fundamentally based on the "Security Domain"…

Post by Genbox » Sun, Nov 23, 2025, 1:16 PM UTC

hulitu wrote: post #38

Genbox wrote: post #36

The security of the Apple ecosystem is miles ahead of others. Every time I reverse engineer some component of their OS, it is very different from what I've seen before. I always find myself surprised by their thoughtfulness and engineering craft. Recently I've taken on their code signing component. The concepts they've created, such as identifying applications by their "designated requirements" is a stroke of genius.…

> The security of the Apple ecosystem is miles ahead of others. cough iMessage, hardware backdoors cough