Course Duration
5 Days
Cyber
Authorized Training
IT
Course cost:
£6,725.00
IT Certification Overview
This five-day expert led course provides an in-depth exploration of Apple operating systems, aligned with Jonathan Levin’s OS Internals trilogy. It focuses on Darwin 25, macOS “26” (Tahoe), and iOS “26”, combining theoretical insight with extensive hands-on exercises. Participants will gain a deep understanding of system internals, reverse engineering techniques, and security mechanisms across Apple platforms. The course incorporates proprietary tools, undocumented behaviours, and real-world analysis techniques used by professionals in reverse engineering and security research.
Learners will benefit from direct exposure to low level system components, gaining the ability to analyse binaries, interact with kernel interfaces, and investigate malware behaviour across macOS and iOS environments.
Newto Training Reviews
What Our Happy Alumni Say About Us
I had absolutely no experience in this field, but Newto Training recognised my potential and supported me every step of the way. The real-life scenarios were invaluable in making me job-ready.
The tutors at Newto are consistently patient, clear and more than willing to help. I couldn't have asked for a better learning environment.
From day one I felt welcomed and supported. The live sessions were interactive and the resources well thought-out. I passed my exam on the first attempt thanks to them.
I was nervous about switching careers but the practical approach and continual 1-to-1 support gave me the confidence I needed to succeed."
The training material was excellent, and the instructors really brought the subject to life with hands-on lab work. I feel fully prepared for the workplace."
What impressed me most was the flexibility and responsiveness of the support team. Whenever I had a question, they were there even outside of normal hours.
The course structure was superb. A great mix of theory and practice delivered at a pace that made sense even for beginners. Highly recommended.
Switching into IT felt overwhelming, but Newto Training made the journey manageable and quite enjoyable. Their coaching style is top class.
I particularly appreciated the way complex topics were broken down into manageable chunks, and the tutor actively encouraged questions at every stage.
The live-taught interactive classes set Newto apart from other providers. It wasn't just video-based learning and the real engagement made all the difference.
The cyber course exceeded my expectations. They've been on hand for everything and are constantly in touch with me
The resources provided were spot on and the teaching style made everything easy to understand. I particularly appreciated the extra help offered when needed.
Enrolling with Newto was one of the best decisions I've made. The job-readiness focus, strong teaching and excellent support all stood out.
I completed my SQL course and now feel confident in my skills. The real-world examples and supportive tutors made it all click.
I've just passed my AZ-900 exam thanks to the support received from Ken in the boot camp and his exam preparation sessions.
I've gained a qualification and the confidence to use it in real-world scenarios.
Their commitment to student success is obvious from the personalised guidance to the quality of delivery. I'd recommend them without hesitation.
Every tutor I encountered was professional, encouraging and keen to see me succeed. That personal touch made a big difference.
I'm now in a role I once thought was out of reach, thank you to the all the team
The bootcamps were excellent, we were given practical projects to complete and I feel so much more confident with my coding skills
I had absolutely no experience in this field, but Newto Training recognised my potential and supported me every step of the way. The real-life scenarios were invaluable in making me job-ready.
The tutors at Newto are consistently patient, clear and more than willing to help. I couldn't have asked for a better learning environment.
From day one I felt welcomed and supported. The live sessions were interactive and the resources well thought-out. I passed my exam on the first attempt thanks to them.
I was nervous about switching careers but the practical approach and continual 1-to-1 support gave me the confidence I needed to succeed."
The training material was excellent, and the instructors really brought the subject to life with hands-on lab work. I feel fully prepared for the workplace."
What impressed me most was the flexibility and responsiveness of the support team. Whenever I had a question, they were there even outside of normal hours.
The course structure was superb. A great mix of theory and practice delivered at a pace that made sense even for beginners. Highly recommended.
Switching into IT felt overwhelming, but Newto Training made the journey manageable and quite enjoyable. Their coaching style is top class.
I particularly appreciated the way complex topics were broken down into manageable chunks, and the tutor actively encouraged questions at every stage.
The live-taught interactive classes set Newto apart from other providers. It wasn't just video-based learning and the real engagement made all the difference.
I had absolutely no experience in this field, but Newto Training recognised my potential and supported me every step of the way. The real-life scenarios were invaluable in making me job-ready.
The tutors at Newto are consistently patient, clear and more than willing to help. I couldn't have asked for a better learning environment.
From day one I felt welcomed and supported. The live sessions were interactive and the resources well thought-out. I passed my exam on the first attempt thanks to them.
I was nervous about switching careers but the practical approach and continual 1-to-1 support gave me the confidence I needed to succeed."
The training material was excellent, and the instructors really brought the subject to life with hands-on lab work. I feel fully prepared for the workplace."
What impressed me most was the flexibility and responsiveness of the support team. Whenever I had a question, they were there even outside of normal hours.
The course structure was superb. A great mix of theory and practice delivered at a pace that made sense even for beginners. Highly recommended.
Switching into IT felt overwhelming, but Newto Training made the journey manageable and quite enjoyable. Their coaching style is top class.
I particularly appreciated the way complex topics were broken down into manageable chunks, and the tutor actively encouraged questions at every stage.
The live-taught interactive classes set Newto apart from other providers. It wasn't just video-based learning and the real engagement made all the difference.
The cyber course exceeded my expectations. They've been on hand for everything and are constantly in touch with me
The resources provided were spot on and the teaching style made everything easy to understand. I particularly appreciated the extra help offered when needed.
Enrolling with Newto was one of the best decisions I've made. The job-readiness focus, strong teaching and excellent support all stood out.
I completed my SQL course and now feel confident in my skills. The real-world examples and supportive tutors made it all click.
I've just passed my AZ-900 exam thanks to the support received from Ken in the boot camp and his exam preparation sessions.
I've gained a qualification and the confidence to use it in real-world scenarios.
Their commitment to student success is obvious from the personalised guidance to the quality of delivery. I'd recommend them without hesitation.
Every tutor I encountered was professional, encouraging and keen to see me succeed. That personal touch made a big difference.
I'm now in a role I once thought was out of reach, thank you to the all the team
The bootcamps were excellent, we were given practical projects to complete and I feel so much more confident with my coding skills
The cyber course exceeded my expectations. They've been on hand for everything and are constantly in touch with me
The resources provided were spot on and the teaching style made everything easy to understand. I particularly appreciated the extra help offered when needed.
Enrolling with Newto was one of the best decisions I've made. The job-readiness focus, strong teaching and excellent support all stood out.
I completed my SQL course and now feel confident in my skills. The real-world examples and supportive tutors made it all click.
I've just passed my AZ-900 exam thanks to the support received from Ken in the boot camp and his exam preparation sessions.
I've gained a qualification and the confidence to use it in real-world scenarios.
Their commitment to student success is obvious from the personalised guidance to the quality of delivery. I'd recommend them without hesitation.
Every tutor I encountered was professional, encouraging and keen to see me succeed. That personal touch made a big difference.
I'm now in a role I once thought was out of reach, thank you to the all the team
The bootcamps were excellent, we were given practical projects to complete and I feel so much more confident with my coding skills
Prerequisites
Participants should meet the following requirements:
- User level knowledge of macOS
- Experience with user mode programming
- Familiarity with x86_64 and or ARM64 architectures strongly recommended
- Access to a Mac device and optionally a jailbroken iOS device
Target audience
This course is designed for professionals seeking advanced technical expertise in Apple operating systems:
- Reverse engineers
- Security researchers
- Malware analysts
- Forensics experts specialising in macOS and iOS
It is also suitable for individuals aiming to develop deep system level knowledge and modern reverse engineering capabilities.
Learning Objectives
By the end of this course, participants will be able to:
- Understand binary linking and loading mechanisms in Apple systems
- Reverse engineer and analyse Mach O binaries
- Deconstruct Objective C and Swift binaries
- Utilise documented and undocumented APIs for tracing and debugging
- Interface with and hook kernel system calls
- Identify and analyse macOS and iOS malware techniques
- Evaluate kernel, kext, and daemon attack surfaces
Mac OS Internals Course Content
Module 1 Architectural overview
- Overview of macOS and iOS architecture
- Analysis of Apple system design and documentation gaps
- Exploration of iOS derivatives including tvOS and watchOS
- Tour of private frameworks and system components
- Introduction to the Darwin environment
- XNU kernel structure and functionality
- Hardware architecture including Intel and Apple Silicon platforms
- Use of sysctl and MobileGestalt for system interrogation
- Review of prerequisite knowledge
Module 2 What is in an IPSW
- Structure and contents of IPSW and macOS OTA packages
- Disk images and Apple encrypted archive formats
- Understanding im4p and DER encoding
- iBoot internals and bootloader behaviour
- Coprocessor firmware and RTKit architecture
- Introduction to SPTM and TXM in modern Darwin systems
- End to end boot sequence walkthrough
Exercise: hands on IPSW unpacking and exploration
Module 3 Binaries
- Mach O binary structure and format
- Fat binaries and multi architecture support
- File types including executables, bundles, dylibs, and kexts
- Load commands and segment structures
- Code signing and encryption mechanisms
- Dynamic library dependency resolution
- Static analysis using system tools
Exercises:
- Binary analysis using disarm tools
- Examination of user mode malware samples
- Techniques for bypassing iOS code encryption
Module 4 Advanced Mach O and DYLD
- Internals of the dynamic loader
- Binding, linking, and opcode processing
- Chained fixups and rebase mechanisms
- Runtime structures and callback handling
- Techniques for extending and modifying loader behaviour
Module 5 Processes and threads internals
- Darwin process and thread architecture
- Stack layout and memory organisation
- Memory allocation systems including libmalloc and zone allocators
- Modern allocator enhancements in recent Darwin versions
- Grand Central Dispatch and concurrency model
- Blocks and dispatch queue behaviour
Exercise: memory inspection using custom tools
Module 6 Debugging and tracing techniques
- System auditing and monitoring frameworks
- Endpoint Security Framework and file system events
- Memory and performance analysis tools
- System call tracing and latency analysis
- Logging systems and diagnostic tools
- DTrace usage in macOS
- Debugging with LLDB and debugserver
- Library interposing techniques
- Process corpse analysis
Exercises:
- Creating custom debugging filters
- Monitoring system activity using debugging tools
- Analysing process behaviour in real time
Module 7 Launchd and XPC
- macOS and iOS startup mechanisms
- LaunchAgents and LaunchDaemons configuration
- Persistence techniques used by malware
- Reverse engineering launchd
- Introduction to Mach ports and bootstrap services
- XPC communication and messaging
- Undocumented APIs and data formats
Exercises:
- Enumerating system services and endpoints
- Creating and managing launch services
Module 8 Mach primitives and IPC
- Core Mach concepts including tasks, threads, and ports
- Virtual memory management in Mach
- Mach Interface Generator and interface definitions
- Inter process communication mechanisms
- Source level exploration of kernel behaviour
Exercises:
- Enumerating system tasks and threads
- Decompiling Mach interfaces
- Implementing remote thread injection techniques
Module 9 Security
- macOS and iOS security architecture overview
- Mandatory access control frameworks
- Kernel authorisation and policy enforcement
- Advanced code signing mechanisms
- Sandboxing and containerisation models
- Gatekeeper and quarantine enforcement
- Entitlements and application permissions
- AppleMobileFileIntegrity and trust validation
- Analysis of amfid and related components
- System Integrity Protection mechanisms
- Jailbreaking techniques and detection methods
- Malware analysis across Apple platforms
- Case study of advanced mobile surveillance techniques
Hands-on learning
The course includes a combination of instructor led sessions, guided demonstrations, and practical exercises. Each module reinforces theoretical concepts through hands on labs. Participants are encouraged to bring malware samples or request specific binaries or subsystems for analysis.
Exams and assessments
There is no formal exam included as part of this course.
Suggested reading
macOS and iOS Internals by Jonathan Levin
OS Internals Volume I User Mode by Jonathan Levin
Upcoming Dates
Dates and locations are available on request. Please contact us for the latest schedule.
Advance Your Career with Mac OS Internals
Gain the skills you need to succeed. Enrol in Mac OS Internals with Newto Training today.
