Skip to content
TCCParser

Series

Investigating with TCC.db

3 posts in this series. Read them in order or jump to any one.

  1. How to Analyze TCC.db in Your Browser

    Step by step: load macOS TCC.db files and their WAL into a free in-browser parser, read the findings, review permissions and history, and export.

  2. Recovering Removed TCC Grants from TCC.db-wal

    How deleted or changed TCC permissions can survive in TCC.db-wal and freed pages: SQLite WAL format basics, what tccutil reset leaves behind, and the limits.

  3. Investigating TCC Permission Abuse on macOS

    How attackers abuse macOS TCC permissions, what each technique leaves in TCC.db, and how to pivot to unified logs, launchd, quarantine and shell history.

All posts in this series

How to Analyze TCC.db in Your Browser
Step by step: load macOS TCC.db files and their WAL into a free in-browser parser, read the findings, review permissions and history, and export.
tccmacostools
Recovering Removed TCC Grants from TCC.db-wal
How deleted or changed TCC permissions can survive in TCC.db-wal and freed pages: SQLite WAL format basics, what tccutil reset leaves behind, and the limits.
tccmacossqlite
Investigating TCC Permission Abuse on macOS
How attackers abuse macOS TCC permissions, what each technique leaves in TCC.db, and how to pivot to unified logs, launchd, quarantine and shell history.
tccmacosincident-response