XProtect Remediator stores its configuration data (such as file paths, regular expressions, and YARA rules) in encrypted form. This encrypted configuration data is decrypted at runtime by the _mod_init_func function and the resulting data is written to the __DATA.__bss section. The details of this process are described in this blog post.
This repository contains the decrypted configuration data of XProtect Remediator. To track which configuration data was added in each version of XProtect Remediator, each git commit corresponds to a specific version of XProtect Remediator. You can use the git diff command to check what configuration data was introduced with each version update.
| Date | Version |
|---|---|
| 2022/09/29 | 75 |
| 2023/05/02 | 97 |
| 2023/06/08 | 99 |
| 2023/08/08 | 108 |
| 2023/09/01 | 109 |
| 2023/09/15 | 111 |
| 2023/09/29 | 112 |
| 2023/10/12 | 114 |
| 2023/10/26 | 118 |
| 2023/12/07 | 120 |
| 2023/12/19 | 122 |
| 2024/01/16 | 123 |
| 2024/02/05 | 125 |
| 2024/02/21 | 126 |
| 2024/03/05 | 128 |
| 2024/03/19 | 129 |
| 2024/04/02 | 130 |
| 2024/04/23 | 131 |
| 2024/04/30 | 132 |
| 2024/05/02 | 133 |
| 2024/05/28 | 135 |
| 2024/06/18 | 137 |
| 2024/07/09 | 139 |
| 2024/07/23 | 140 |
| 2024/08/06 | 141 |
| 2024/08/20 | 142 |
| 2024/09/03 | 145 |
| 2024/10/16 | 147 |
| 2024/12/17 | 149 |
| 2025/03/04 | 151 |
Koh M. Nakagawa (@tsunek0h) © FFRI Security, Inc. 2025