macOS
macOS ExecUnits use native Mach-O dynamic libraries with separate x86_64 and arm64 artifacts. This page explains the platform's compatibility, local communication, and lifetime model for commands and listeners.
Supported combinations
The current commercial macOS agent supports x86_64 and arm64 builds. Native dynamic libraries run in the agent's own process, called the self context.
| Component | Available macOS artifacts | Coverage |
|---|---|---|
| Default command ExecUnits | Native Mach-O dynamic libraries for x86_64 and arm64 | The supported Portable Operating System Interface (POSIX) command subset, plus screenshot capture |
| Simple Hypertext Transfer Protocol (HTTP), Transmission Control Protocol (TCP), and Domain Name System (DNS) listeners | Native Mach-O dynamic libraries for both architectures | All three families |
| TCP bind and TCP reverse listeners | Native Mach-O dynamic libraries for both architectures | Both families |
| TCP listener-owned commands | Native Mach-O dynamic libraries for both architectures | Both corresponding command families |
| Server Message Block (SMB) listener and its owned command | None | Windows-only |
Source shared with other POSIX platforms still needs a macOS build. The current agent does not provide the Windows managed, shellcode, or alternative-process execution combinations on macOS.
Loading model
The supplied x86_64 and arm64 artifacts are separate, single-architecture binaries. Match the library to the running process architecture; the host computer's hardware alone does not identify the architecture of every process it runs.
The default macOS build target is macOS 11.0. Runtime dependencies remain artifact-specific: for example, the simple HTTP listener uses the system libcurl library. A deployment target or successful compilation does not establish that every required library, operating-system permission, or runtime condition is available.
Local communication
The standard local channel uses two filesystem first-in, first-out (FIFO) endpoints, with one direction per endpoint. Together they support bidirectional local communication, unlike the single duplex named-pipe connection on Windows.
See the FIFO model for endpoint responsibilities and Local and External Communication for the distinction from a listener's network transport.
Lifetime and limitations
Operating-system permissions can constrain an individual command independently of ExecUnit compatibility. For example, screenshot capture requires macOS Screen Recording permission. A permission failure in that command does not imply that the library format or local communication model is unsupported.
For shared process, concurrency, and shutdown considerations, see command limitations, listener limitations, and Lifetimes and Outcomes.