Machbox

Machbox — disposable and persistent macOS VMs for analysis and research.

System Requirements

• Apple Silicon Mac
• macOS 13+

Download

brew install ac0d3r/tap/machbox

Prebuilt Apple Silicon binaries are also on the GitHub Releases page.

curl -L -o machbox https://github.com/ac0d3r/machbox/releases/latest/download/machbox-darwin-arm64
chmod +x machbox

The release binary is ad-hoc signed, macOS Gatekeeper will block it until you remove the quarantine attribute with xattr -d com.apple.quarantine.

Build from Source

• Go 1.27+
• Xcode, for the macOS SDK, swiftc, codesign, and hdiutil

git clone https://github.com/ac0d3r/machbox.git
cd machbox
make build

The compiled binary will be at bin/machbox.

Usage

• Environment Setup: prepare and import a VirtualBuddy VM baseline.
• Plugins: install, run, update and remove plugins.
• Instances: keep a VM that persists across shutdowns, for interactive work.
• Architecture: how baselines, runs, the guest agent, plugins and the network work.

Plugins

• machbox-malware: macOS malware analysis.

Acknowledgments

• https://github.com/Code-Hex/vz
• https://github.com/insidegui/VirtualBuddy
• https://github.com/containers/gvisor-tap-vsock