https://hideouts.io/research/ Evidence-first research on macOS and iOS privacy and security. en https://hideouts.io/research/macos-install-security/ https://hideouts.io/research/macos-install-security/ Thu, 01 Oct 2026 03:05:17 GMT Installer, recovery RAMDisk, firmware, and EFI forensics for macOS 26.6.2. A partial research snapshot of macOS 26.6.2 (build 25G83): a retained install-data tree compared byte for byte with Apple’s distribution, then traced through ramrod, firmware helpers, EFI paths, NVRAM, and trust checks, with 100 finding records and their evidence limits. https://hideouts.io/research/apple-infrastructure/ https://hideouts.io/research/apple-infrastructure/ Mon, 28 Sep 2026 08:57:52 GMT What four minutes of Unified Logs reveal about Apple’s network. Apple CDN and Akamai edges, iCloud Private Relay topology, QUIC and HTTP/3, Daiquiri backend metadata, and the hybrid cloud behind Apple services, reconstructed from a macOS log snapshot. https://hideouts.io/research/ios-system-research/ https://hideouts.io/research/ios-system-research/ Fri, 25 Sep 2026 09:10:50 GMT Carrier profiles, OTAUpload, sysdiagnose, and unexplained MDM records. Evidence-first investigations of iOS artifacts: T-Mobile and AT&T Passpoint profiles and evil-twin exposure, OTAUpload, LambdaTest references in a sysdiagnose, and Bushel / Jamf Now managed-configuration records on a personal phone. https://hideouts.io/research/optical-airgap-lab/ https://hideouts.io/research/optical-airgap-lab/ Fri, 25 Sep 2026 09:10:45 GMT Recovering near-invisible QR codes from an iPhone photo of a screen. A closed-loop, offline reproduction of low-contrast optical signaling through an LCD, with a verified decode of a synthetic identifier from a real iPhone photograph. https://hideouts.io/research/suramdisk/ https://hideouts.io/research/suramdisk/ Thu, 27 Aug 2026 05:12:31 GMT T2 DFU restore, the ramrod pipeline, SSV sealing, and firmware Option ROMs. Forensic and architectural study of the StarSecurityRome21G115 RAMDisk from macOS Monterey 12.6 (x86_64): boot and init, the ramrod restore engine, APFS Sealed System Volume Merkle sealing, Image4 and FDR trust, and controller firmware. https://hideouts.io/research/skywalkctl-guide/ https://hideouts.io/research/skywalkctl-guide/ Tue, 18 Aug 2026 02:44:39 GMT Apple’s kernel networking subsystem, one command at a time. A hands-on guide to macOS skywalkctl built from 175 sanitized, read-only invocations on macOS 26.4, with a safety map, full command reference, and expanded man page.