// Comparison

The Art of Mac Malware, Volume 1 vs The Mac Hacker's Handbook: Which Should You Read?

Two cybersecurity books on macOS, compared honestly: who each is for, what each does best, and which to read first.

Advanced

4/52022

The Guide to Analyzing Malicious Software

Patrick Wardle

Patrick Wardle's deep dive on macOS malware analysis: persistence patterns, injection techniques, anti-analysis tricks, and the macOS-specific tooling needed to triage real samples.

Advanced

3/52009

The Mac Hacker's Handbook

Charlie Miller, Dino Dai Zovi

Charlie Miller and Dino Dai Zovi's 2009 deep dive into the Mac OS X exploit landscape — Mach-O, IPC, sandboxing as it then existed, and the early-Intel-Mac exploitation chains.

Read this if

Malware analysts who need to handle macOS samples and have so far worked Windows-only. The only serious book in print on Mac malware, by the most prominent practitioner in the field.

Reverse engineers and exploit developers who want the historical foundation of Mac exploitation, especially as a stepping stone to The Art of Mac Malware (Wardle). Most useful for the conceptual scaffolding around Mach, Objective-C runtimes, and IPC, which are still load-bearing on modern macOS.

Skip this if

Analysts who don't see macOS in their pipeline. The platform specifics (Mach-O, code signing, TCC, XPC, launch agents) are non-transferable to other operating systems.

Anyone needing current Apple-silicon, Hardened Runtime, System Integrity Protection, Endpoint Security, or modern sandbox-escape tradecraft. The book is pre-iPhone-era macOS in spirit; 2009 was a different planet.

Key takeaways

Mach-O analysis differs from PE analysis in non-trivial ways; the chapters on entitlements, code signing, and notarization are the practical foundation.
macOS persistence has its own taxonomy (LaunchAgents, LaunchDaemons, login items, period plists, dylib hijacks); learning it is half the analyst's job.
Apple's own tooling (Console.app, sample, fs_usage, Endpoint Security framework) is the right starting toolkit for triage; Wardle's framing is the cleanest in print.

The conceptual material (Mach, IPC, Mach-O, Objective-C dispatch) generalizes to modern macOS; the specific exploits do not.
Most of the value is historical archaeology — knowing why the macOS sandbox and SIP exist is far easier after this book.
Pair with current Wardle and Apple Platform Security material for any operational use; treat this as background reading.

How they compare

We rate The Art of Mac Malware, Volume 1 higher (4/5 against 3/5 for The Mac Hacker's Handbook). For most readers, that means The Art of Mac Malware, Volume 1 is the primary pick and The Mac Hacker's Handbook is a useful follow-up.

Both books target advanced-level readers, so the choice is about topic, not difficulty.

The Art of Mac Malware, Volume 1 and The Mac Hacker's Handbook both cover macOS, Reverse Engineering, so reading them in sequence reinforces the same material from different angles.

Keep reading

The Art of Mac Malware, Volume 1

→ Alternatives to The Art of Mac Malware, Volume 1 → What to read after The Art of Mac Malware, Volume 1