MacOS DYLD_LIBRARIES Injection

This talk demonstrates the technique of dynamic library (dylib) injection on macOS by leveraging the DYLD_INSERT_LIBRARIES environment variable. The speakers explain how the macOS dynamic linker (dyld) processes library loading and how security features like System Integrity Protection (SIP) and Apple Mobile File Integrity (AMFI) attempt to mitigate such attacks. The presentation includes a practical demonstration of bypassing these protections on non-hardened binaries and discusses the impact of code signing and restricted segments on the success of the injection.