1. Understand the macOS architecture#

Part 23: Case Studies | Computer Architecture & OS Mastery - Wasil Zafar

wasilzafar.com

macOS uses the XNU kernel, which combines three major components:

Other important components include:

• libSystem: Core user-space system libraries.
• launchd: System and service management.
• APFS: Apple’s filesystem.
• IOKit frameworks: Interfaces for interacting with hardware.
• System calls: The boundary between user applications and the kernel.

A useful high-level execution path is:

             User Applications
                     |
              macOS Frameworks
                     |
                 libSystem
                     |
                System Calls
                     |
       +-------------+-------------+
       |                           |
    Mach Kernel                 BSD Layer
       |                           |
       +-------------+-------------+
                     |
                 I/O Kit
                     |
              Hardware Devices

This is a conceptual diagram, not a literal call path for every operation.

2. Follow this learning sequence#

I recommend studying the kernel in the following order.

1. Stage 1 — Darwin and macOS fundamentals

   Learn:

   • Darwin architecture
   • User space vs. kernel space
   • System calls
   • Process and thread models
   • Virtual memory

2. Stage 2 — Mach kernel

   Learn:

   • Mach tasks and threads
   • Mach ports
   • IPC (Inter-Process Communication)
   • Virtual memory management
   • Scheduling
   • Exceptions and traps

3. Stage 3 — BSD subsystem

   Learn:

   • Process management
   • File descriptors
   • VFS (Virtual File System)
   • BSD sockets
   • Signals
   • Permissions and credentials
   • System-call implementation

4. Stage 4 — Memory management

   Learn:

   • Virtual address spaces
   • Page tables
   • Physical memory
   • TLB
   • Memory mapping (mmap)
   • Copy-on-write
   • Mach VM objects

5. Stage 5 — I/O Kit and drivers

   Learn:

   • I/O Kit architecture
   • Device matching
   • Driver objects
   • Hardware interrupts
   • DMA
   • DriverKit

6. Stage 6 — Kernel security

   Learn:

   • System Integrity Protection (SIP)
   • Apple Mobile File Integrity (AMFI)
   • Code signing
   • Entitlements
   • Sandbox
   • Secure Boot
   • Kernel extensions and their restrictions

7. Stage 7 — Kernel source-code analysis

   Read actual XNU implementation, trace functions, inspect structures, and understand how components interact.

3. Study the official Apple documentation#

These are the most useful documentation resources.

Apple Documentation | kean.blog

1. Apple Developer Documentation

Apple Developer Documentation

Start here for public macOS APIs and frameworks.

Why is macOS often referred to as ‘Darwin’? - Ask Different

2. XNU Kernel Documentation

Apple XNU source repository and README

This is the most important resource. Read the architecture, source tree, and build instructions.

Darwin · iOS逆向：Apple操作系统

3. Kernel Programming Guide

Building and Debugging Kernels

An older, archived guide covering kernel architecture and development. Use it for foundational concepts, not as the definitive guide to current macOS.

Creating a Driver Using the DriverKit SDK | Apple Developer Documentation

4. I/O Kit Fundamentals

Introduction to I/O Kit Fundamentals

Learn the historical and architectural foundations of Apple’s driver model.

What’s new in DriverKit - Discover - Apple Developer

5. DriverKit

DriverKit Documentation

Learn modern user-space driver development.

Apple Publishes New Apple Platform Security Guide - MacRumors

6. Apple Platform Security

Apple Platform Security Guide

Study Secure Boot, SIP, code signing, and kernel security.

4. Download and explore the XNU source code#

The most important repository is:

Oakstone & Github | Executive Search for GTM SaaS

apple-oss-distributions/xnu

Clone it:

git clone https://github.com/apple-oss-distributions/xnu.git

cd xnu

Explore the source tree:

tree -L 2

If tree isn’t installed:

brew install tree

xnu/
 ├── osfmk/
 │    ├── kern/       # Kernel scheduling and tasks
 │    ├── vm/         # Virtual memory
 │    ├── ipc/        # Mach IPC
 │    ├── mach/       # Mach interfaces
 │    └── arm/        # ARM-specific implementation
 │
 ├── bsd/
 │    ├── kern/       # BSD process and syscall logic
 │    ├── vm/         # BSD virtual memory integration
 │    ├── net/        # Networking
 │    ├── vfs/        # Filesystem layer
 │    └── sys/        # System interfaces
 │
 ├── iokit/
 ├── libkern/
 ├── pexpert/
 └── security/

5. Set up your macOS kernel research environment#

I recommend using your macOS terminal with these tools.

Install basic utilities:

xcode-select --install

brew install \
    git \
    cmake \
    ninja \
    llvm \
    lldb \
    cscope \
    universal-ctags \
    jq

Check your system:

uname -a
uname -m
sw_vers

Inspect kernel information:

sysctl kern.version
sysctl kern.osrelease
sysctl kern.osrevision

Inspect processes:

ps aux

Inspect virtual memory:

vm_stat

Inspect loaded kernel extensions:

kmutil showloaded

Inspect Mach-O binaries:

file /usr/lib/system/libsystem_kernel.dylib

otool -L /usr/lib/system/libsystem_kernel.dylib

Inspect symbols:

nm -gU /usr/lib/system/libsystem_kernel.dylib

For assembly and debugging:

xcrun llvm-objdump --help
xcrun lldb

Important: The publicly available XNU source is not the complete source of every component shipped in macOS. Some Apple hardware, firmware, and platform-specific implementations are not publicly available.

6. Practical exercises: Learn by investigating the kernel#

Don’t just read documentation. Write small programs and investigate what happens inside macOS.

Here are seven exercises I recommend.

For example, investigate virtual memory:

#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <unistd.h>

int main(void) {
    size_t size = getpagesize();

    void *ptr = mmap(
        NULL,
        size,
        PROT_READ | PROT_WRITE,
        MAP_PRIVATE | MAP_ANON,
        -1,
        0
    );

    if (ptr == MAP_FAILED) {
        perror("mmap");
        return 1;
    }

    printf("Allocated address: %p\n", ptr);

    *(int *)ptr = 1234;

    printf("Value: %d\n", *(int *)ptr);

    munmap(ptr, size);

    return 0;
}

Compile and run:

clang -g -O0 main.c -o vm_test

./vm_test

lldb ./vm_test

Investigate:

1. How does mmap() reach the kernel?
2. How does XNU allocate virtual memory?
3. How are Mach VM objects involved?
4. When are physical pages actually allocated?
5. What happens when the process accesses the allocated address?

This exercise connects macOS APIs to actual kernel implementation.

7. Learn kernel debugging and reverse engineering#

For deeper investigation, learn these tools:

Since macOS has strong security protections, some tracing and kernel-debugging operations require special permissions or a separate development environment.

Avoid disabling SIP or changing boot security on your everyday Mac just to study XNU. Apple recommends disabling system protections only temporarily when necessary for development.

image

Apple Developer Documentation+1

For kernel experiments, use a dedicated test Mac or an appropriate virtualized environment.

8. Recommended books#

‎Mac OS X Internals by Amit Singh on Apple Books

1. Mac OS X Internals

Amit Singh

Excellent for understanding Mach, BSD, virtual memory, I/O Kit, and macOS internals. It describes older macOS versions, so verify implementation details against current XNU.

Operating Systems: Three Easy Pieces Paperback 9781985086593| eBay

2. Operating Systems: Three Easy Pieces

Remzi and Andrea Arpaci-Dusseau

Excellent for understanding processes, concurrency, memory management, and filesystems.

Free online textbook

The design and implementation of the FreeBSD operating system Second edition - relié - Marshall K Mckusick, George V. Neville-Neil, Robert N.M. Watson - Achat Livre ou ebook | fnac

3. The Design and Implementation of the FreeBSD Operating System

George V. Neville-Neil and Marshall Kirk McKusick

Useful for understanding BSD concepts that are relevant to XNU’s BSD subsystem.

9. My recommended learning path#

Given your existing work on ARM64, x86-64, Rust, page tables, and bare-metal operating systems, I would approach XNU by connecting what you already know to its implementation.

Suggested 8-week curriculum

Final project

Trace a user-space program calling mmap() through the macOS system-call interface into XNU’s virtual-memory implementation.