Reported by 1 outlet

Timeline

1. original reporting

   ARM64 stack internals and obfuscation on Apple Silicon

   mdsec.co.uk · 60d ago · August 14th, 2026

   Introduction We closely monitor the detection mechanisms employed by EDR sensors to better understand how they identify suspicious activity. Recently, we observed that one of the major players in the EDR market takes an interesting approach to walking thread call stacks: rather than implementing a custom unwinder, it uses the built-in macOS diagnostic utility spindump . The presence of /usr/sbin/spindump caught our attention and prompted a deeper investigation into how the sensor collects and analyses call stacks. Although macOS EDR sensors are generally less aggressive than their Windows counterparts, this discovery led me to explore whether call-stack obfuscation—a well-established technique on Windows—could be adapted for ARM64 macOS. That work, and its implications for EDR visibility, is the focus of this post. The ARM64 stack model Before unwind metadata makes sense, three registers need distinct jobs: sp tracks the current allocation boundary, x29 anchors a stable frame record, and x30 carries the immediate return address. Register Role Unwinding significance sp Current stack pointer; moves as storage is allocated and released. The caller’s value is reconstructed by the unwind recipe. x29\FP Conventional frame pointer in a framed function. Points at the frame’s saved FP/LR record. x30\LR Link register containing the return address. Saved in memory by non-leaf framed functions; may remain live in a leaf function. x19–x28 Callee-saved general-purpose registers. Recovered