Resolving Kernel Symbols in a Post-ASLR macOS World
https://www.zdziarski.com/blog/?p=6901 [www.zdziarski.com]
2017-02-03 15:19
So most of the kernel is opaque to kernel developers for good reason, and this has reduced the amount of rope they have to hang themselves with. For some doing really advanced work though (especially in security), the kernel can sometimes feel like a Fisher Price steering wheel because of this, and so many have found ways around privatized functions by resolving these symbols and using them anyway.
See also: Slides: Crafting macOS Root Kits