Tools

My macOS and iOS tools are signed with Developer ID, notarised by Apple, and the notarisation ticket is stapled to the package — so verification works offline, before you install anything:

pkgutil --check-signature zth-assess-0.0.1.pkg
spctl --assess --type install --verbose zth-assess-0.0.1.pkg
xcrun stapler validate zth-assess-0.0.1.pkg

Team identifier: 693DSH8GN5

Packages install to /usr/local/bin.

zth-assess

Tells you what a file actually is. Point it at a path: if it is not a macOS executable, dylib, kext or bundle, it says so. If it is, it classifies the artefact. Output as JSON, tree or debug.

zth-assess <path>

zth-assess 0.0.1 — universal (.pkg)

SHA-256: 51d2a58c4b9bb9e30c66174d4a1b363db15776d5947617ff8d8d3d0182bb9b1b

zth-lclist

Lists the load command directory of a Mach-O binary, slice by slice. Fat binaries are shown per architecture, not flattened. Filter by load command type, restrict to one slice, show absolute offsets, emit JSON to stdout or to a file.

zth-lclist <path>
zth-lclist --lc LC_CODE_SIGNATURE <path>

zth-lclist 0.0.1 — universal (.pkg)

SHA-256: be3be331aba77e827ec01999a1b9810dd05c8454757d069a9492c500005778a0

Electric Eye

Detects adversary-in-the-middle attacks in real time, before your credentials are taken. Real-time proxy kits like Evilginx and Starkiller defeat MFA and leave nothing visible: the certificate is valid, the site looks right, the login works, and the session token is already gone.

Electric Eye analyses TLS fingerprints, HTTP headers and DOM content to detect proxy anomalies. Detection runs locally in WebAssembly.

Firefox extension, distributed through addons.mozilla.org. It falls outside Apple's notarisation; Mozilla's review is the chain of trust there.

Get it on Firefox Add-ons →