MOXiI 2nd Edition Status Update Page

10/10/2019 - Ultimate update, in more than one way :-)

TL;DR - I'm done

Slightly longer version: Exactly a year after schedule, *OS Internals, Volume II, is going to print at last. Yes, it was delayed, but - the wait is over, the book covers XNU-6153 (Darwin 19), and this time I didn't need any open sources from AAPL.

You can get book direct only for now (I've pulled it from AMZN since I'm sick of them shaving 20% off every time!) Order details at And it's the preferred method if you're domestic: $75, and shipping is on me. If you're not, it's (alas) PYPL, with +$50/book extra ($45 shipping and $5 their fees). And you can get it in BTC, too,. 0.02BTC includes int'l priority shipping. More details on main page of site.

Also, if you're reading this (or saw my Tweet) this marks the end of the trilogy - so

08/23/2019 - Penultimate update

TL;DR - At the latest, 9/30/2019, book will be published

Slightly longer version: Apple may be pulling their "Designed by Apple in California" book, first published when I started MOXiI2, from print, but I'm happy to report that my books are here to stay.. and - that Vol II is basically done. I've already got the world's best minds helping me review chapters, I'm up to date with the latest betas (which seem to have stabilized around 6153.x.x.x), and I have 94-96% of the content written (485 out of a guesstimated 505-515 pages!). At this point I just want to make sure that AAPL doesn't throw a nasty September surprise at me by changing something again in the final release (and if they do, that's why I'm giving myself up to 2 more weeks to either cover it or at least mention it and deem it out of scope). Honestly, I'd release it sooner, but I bet readers would be disgruntled if when D19 comes out I release an update already.

Final date: 09/30/2019 - And this is not a guess/wishful thinking/etc as before - this is f-i-n-a-l. I'll submit the copy to be printed there and then (or earlier), and books should ship 1-2 weeks later. So only a year behind schedule - but, hey, you get up-to-date XNU-6153 stuff!

Part of me is also hoping that my readers in Cupertino (you know who you are - there's quite a few of you, too ;-) will favor me and maybe, just maybe, release the sources MacOS 13 style (read: three days after) and not MacOS 14 style (i.e. three months after). You know. slip of the finger on them push scripts? :-) That said, SOURCES ARE NOT A PREREQUISITE FOR RELEASE as they were last year.

With or without updated 6153 sources, this is coming out. When sources *ARE* out, whenever, I reserve the right to perform minor updates - namely, adapt listings and maybe plug in names of new constants, for a v1.1, which I will also document in the changelog page. Otherwise, the v1.0 book should be considered final, barring the usual typos my astute readers point out. When those are squashed, I'll get on the hardcover, full color edition.

More details on the hardcover edition:

In other news, I am thinking of putting in Darwin 19 changes and Ned Williamson's amazing Sockpuppet exploit into a v1.7 of Volume III. Yes, I said I wouldn't update it anymore.. but.. such an awesome exploit... So if you want to buy Volume III , maybe wait a week or two.

And, for those enthusiasts of the other operating system - Android Internals Volume II will be the only book left at that point. And Volume I will get a signficant update to cover all the delta between Nougat and Q/10.

08/04/2019 - Can't keep up with them betas

q.v. - I'm going to wait till Cupertino-folk make up their minds about critical structures before committing them to the printed volume II - wait for Darwin 19's golden master, at the very least. Incidentally, you're looking at a book of 500 pages.

05/03/2019 (= May 3rd) - *Still* Wrapping things up (but..)

Long story short, and no excuses, it's six months after where I wanted to be - both the other volumes were largely on time, this one isn't. I hoped it would be ready for my British sojourn. It wasn't. Though it's mostly done, but here's what remains:

  • Review of existing chapters by some of the best minds in the industry
  • Another chapter I thought I'd avoid (networking stack). This was the chapter I added from the user mode perspective (free, in the Volume I v1.2 update), but there's a lot to cover from the kernel perspective, as well. To be honest, not too much has changed from the first edition's Chapter 17, hence I thought I'd avoid it, like I avoid HFS+ by referring to the 1st edition. Unlike HFS+, however, which is effectively obsolete, networking will remain relevant forever, I want to cover it fully, and this will be a complete rewrite.
  • The book is 430+ pages already, and I'm aiming for 470 (with said chapter).
  • And here's the complication - I'm working (in my real job as part of Technologeeks) for the next couple of weeks, spreading the gospel of MOXiI and Android around the world. My bandwidth for the book is fairly constrainted. Meaning by the time I get to finally publish this, it will be the last week of May. And you know what that means, right? That Darwin 19 is due a week and a half later. If I do print v1.0 by end of May (which I can), I feel some readers will feel cheated that Darwin 19 might introduce features/updates/changes (or might not - I don't know) which will merit a v1.1

    So my dilemma was, should I get this out, or should I wait just a bit more. I KNOW you've been waiting for this. I also know you know that elucidating the dark reaches of XNU is far more complicated than Volume I (User Mode) was. I therefore, at the moment, think I'll stretch a bit longer, just to see what Darwin 19 beta 1 brings, and possibly incorporate as much as I can into MOXiI. I am giving myself till the third week of June at this point (i.e. up to two weeks after AAPL releases the beta). BEAR IN MIND ALL DARWIN 19 CONTENT will be reversed only - since sources won't be available for a long time. If the best AAPL can muster is greyscale mode, I'll release earlier. If there're as many under the hood features as there were in '18, I'll take the full two weeks.

    The silver lining in all this? Though I repeatedly stated I intent to quit this endeavor before Darwin 19 emerges, I'll have to stick around for a bit longer. If iOS13/MacOS15 merit significant changes to Volume I, I'll publish a v1.3 of that as well. As it stands, though, this will signal EOL for Volume I, and finalize Volume II.

    I still maintain this will be worth the wait. Going over this stuff in depth, I realized two things - one , how much has changed since Singh's seminal tome. Two, how much Singh actually had to skim. It takes a LOT to get all this covered, and it's excruciating grunt work with -273.15° help from AAPL (unlike "Windows Internals" had from MSFT). The book is ridiculously detailed. Have a look at the detailed ToC to see what I mean. Many topics are seeing the light of day (outside Cupertino) for the first time in history

    So, my apologies for a(nother, seriously, the last) delay, but better wait a bit longer than frustrate people who will buy Volume II v1.0 only to be hit with a v1.1 a week or two later. And yes, it should have been out by now, but , no, I seriously had no idea there would be THIS MUCH MORE to write, especially compared to the 1st Edition. And I know I proimsed it sooner in my previous two updates, but, real life and circumstances beyond my control, people. I hope you appreciate the update. If you want to comment on this, please let me know via the forum.

    And while I have you here:

    12/15/2018 - Wrapping things up (but..)

    Sources are (finally) out. That's great as I'll include the Zone Cache, Turnstiles, Priority Queues and other goodies from the sources (as well others which were redacted by AAPL..). That said, there's holidays ahead and a much needed vacation I had hoped would be also to celebrate the completion of the books. So right now expect Volume II mid-late January 2019. Yeah, I know you're waiting (And I appreciate that) - but please understand there's this little thing called real life, too :-) Volume II is absolutely going to be worth the wait, and I expect it to be the definitive XNU kernel reference for many years to come.

    11/21/2018 - Waiting on AAPL

    So, it's been a while. To be honest I thought I'd be keeping with tradtion and releasing late October/putting the book out on Black Friday (like last year). Thanks to AAPL shuffling their feet with XNU sources, this won't happen. More than before, I need the latest XNU source since, after all, this IS the volume dealing with the kernel.. I have a ton of illustrations showing the exact kernel structures and their offsets - and so I have to make sure I'm up to date and have the right field names (which are lost during compilation). Assuming AAPL holds to their informal promise of "the week after Thanksgiving", expect the book by Christmas..

    In other news, I realized that some stuff I've been pushing to Volume II - notably, networking - has so much user mode stuff in it that it would have been better in Volume I. The network stack implementation still will be in II, but the user mode syscalls, PF_NDRV, PF_SYSTEM, BPF, Firewalling/ALF.kext and such are now in their own chapter in Volume I. Yes, that means an update to Volume I, but keeping with another tradition of publishing free chapters, expect that chapter (Volume I's 16th) to be available as a PDF. Keep an eye out on the Change Log for when it comes out.

    Buying the books in BTC hasn't looked so attractive in years.. But I'm not sure I want to risk it myself anymore..

    08/24/2018 - I'm alive and well, Volume II is still on track, Oct/Nov 2018

    LOTS of additions to original ToC, describing under-the-hood Darwin 18 changes - but still on track.

    New BTC price for every one of the trilogy: 0.025BTC. Get 'em while you can.

    04/28/2018 - Volume II is being worked on - ETA Oct/Nov 2018

    Not to break an informal tradition - expect this to be released Oct-Nov this year, subject to AAPL being nice and releasing their Darwin 18 sources early like last time (and please, with ARM64 again ;-) . Why? Because it doesn't make sense to publish a book about the kernel, which is the most important component of the system and the one most affected by Darwin versioning, only to have a new OS come out a few months later.

    Watch this space for more news. Volume II is still in its infancy, but is shaping up to be the biggest and best-est of the trilogy! Topics covered include:

    Loads of examples will be given using Xnoop, my kernel inspection tool (which will also be released officially by @Technologeeks , hopefully sooner than the book is published

    It's not too late to submit requests via the website forum!

    Oh, and - When Vol II will be out, I will also be doing the limited edition COLOR HARDCOVER edition. Stay tuned for that.

    11/22/2017 - Volume I goes on sale - just in time for Black Friday!

    Yes, I know, longer than expected. I have a life and other things to take care of. But - at least when I say a book is coming you know it'll be there within a 1-3 month standard deviation, eh? :-)


    09/28/2017 - Volume I Status Update


    Apple is mutating 10.13 in between betas (and people are already bugging me for "if I buy it, will I get updates") that I have decided to wait till End of September for the official release of Volume I - Just like I did last year with Volume III.

    Procrastination is the devil's gift - and I got another gift from AAPL today. For whatever reason, which baffles my mortal mind, Apple put out the sources of XNU-4570, libdispatch, dyld, libpthread, Security.framework and a bunch of other goodies - early. What's really amazing is that I was getting ready to submit the very first batch of MOXiI Volume I for next week!

    Well, it ain't happening

    I now ABSOLUTELY MUST push back by a few weeks, to incorporate refs to the sources (esp. DYLD) and specific constant names that I had reversed but didn't know the "official" name of until now. This is a necessary evil, because otherwise I'd be putting out a v1.1 a week later.

    NO, THIS IS NOT AN EXCUSE FOR AN INDEFINITE PUSHBACK. NEW DATE is 2nd or 3rd week of October. I may be slow, but I try to be thorough. And when I say a book is coming out, it's coming out (within a reasonable margin of error - Android notwithstanding). So - MOXiI Vol 1 is coming out, at 450+ pages, a few weeks later, yeah, but it's going to be even better than I had hoped. This does screw my plans to officially launch the book at MacSysAdmin, which is a conference I really like, and bring their amazing organizer a signed copy :-( Sorry Tycho.. (next year? ;-)

    Other good news:

    So stay tuned. And yes, it's coming out. And a mighty mighty thanks to Apple for this, even if I can't begin to fathom the reasoning behind it

    Long version

    I'm finally in the process of getting Volume I finalized and ready for printing! It's just as hefty as Volume III was (i.e. ~400 pages).

    09/27/2016 - Volume III is OUT


    Volume III is out - you can get it directly here when orders open next week, or just preorder and buy through Amazon

  • Why was this delayed? you promised Late August! Yeah, well, what can I do. I was really hoping to get my hands on a sample of Pegasus/Trident so I could also add it to the book. All entities in possession of this sample were very promising, but didn't really deliver. And I can't hold back anymore now that Mac OS 12/iOS 10 is out!
  • So how do we get the book? Direct ordering via this website will be available soon, but you can also get preorders via Amazon
  • Why not direct orders through this website now??? Because I still need to print stock. I'll open this up when I have more - just so you get the idea I have preorders in the (low) hundreds. I'm doing my best. I'm just one guy here!
  • What if I preordered through the website already? Then you get preference, of course. I'll be reaching out to you to ask you if you haven't changed your mind, and if so ask for a humble payment.
  • Can I see what's in the book? sure. In a nutshell, everything related to security in Apple's OSes - both MacOS and the *OS variants, of course. Part I deals with the mechanisms (Authentication, Authorization, Auditing, MACF, Code Signing, Gatekeeper, AMFI, SIP, Sandboxing, Privacy and Data Protection), and Part II deals with all modern jailbreaks from evasi0n 6 to Pangu's 9.1, as well as classic vulnerablities for [10.]10.x and [10.]11.x, some of which are explained in detail for the very first time! Oh, yeah, and there's an appendix with a MacOS Hardening checklist, too
  • No, really, like detailed what's in the book? - Sure. The detailed ToC is right here.
  • Where can I comment/flame/ask questions? - Same place as usual - The NewOSXBook forum. I welcome all suggestions and queries in The Book's Forum, anytime. My only request is that you post there (anonymously is fine), rather than email or twitter, please.
  • Wait, what's this "print" thing - What, no e-Book?!?!?! Nope. Not for a while. Sorry
  • When's Volume I and II coming? Soon. Volume III started as one chapter in Volume I.. just so you get the level of detail we're talking about here. Volume I (user space) will be next, then Volume II (kernel/hardware). But I also owe a debt to Android enthusiasts first, which I intend to repay with interest.
  • When's the next instance of your MOXiI training? - That's The Tg Training in NYC this 10/31!.