About the creator
Garage is written and maintained by Rick Mark-Penwell.
Rick is a security and AI engineer and a hardware security researcher who has worked on Apple platforms since 2007. His Apple developer account dates from then and still carries his prior name, Richard Penwell, so that’s the name on Garage’s Developer ID signature. Rick Mark and Richard Penwell are the same person, and Garage’s copyright uses the hyphenated name to make that clear.
Career
Rick has spent more than fifteen years in security engineering, most recently using AI where it genuinely helps.
- Meta, Privacy Engineer (2023 to 2025). He built PrivacyBrain, an LLM derived from Llama that evaluated privacy incidents, reviews and FTC commitments across millions of records, and Project Terminus, which linked incidents to their root causes and replaced months of manual investigation with consistent measures. He also wrote an LLVM-bitcode scanner for sensitive iOS and macOS APIs, and contributed to the design of Llama 4.
- Coinbase, Security Architect (2021 to 2022).
- Dropbox, Senior Security Engineer (2017 to 2019). He worked on corporate authentication, key management and Windows security in the datacenters, and open-sourced efivalidate for checking Mac firmware.
- Uber Advanced Technologies Group, Senior Security Engineer (2017).
- Jet.com, Senior Software Security Engineer (2016). He was the company’s first security engineer, securing what was then the largest e-commerce site on Azure.
- Bloomberg, Senior Web Application Developer (2015 to 2016), on Bloomberg’s legal research platform.
- Microsoft, Software Engineer and then Azure Security SDE II (2010 to 2015). He did threat modeling and penetration testing for Azure, automated security health reporting across more than 150 teams, and worked on the Windows Data Classification Toolkit. He holds a patent on detecting and preventing phishing attacks.
He also founded Hot Mess and AudienceKit, products that apply social science to in-person community (more below).
Apple security research
He is best known for his research into Apple’s T2 security chip as part of Team t8012:
- He built an early T2 integrity verification tool in 2017.
- In October 2019 he proposed that the checkm8 bootrom exploit reached the T2, and extended ipwndfu for it.
- In 2020 he performed the team’s first successful SecureROM dump.
- He helped bring the exploit into the checkra1n jailbreak.
- He adapted libimobiledevice to talk to the T2, and reverse engineered the USB Target Disk Mode protocol.
When the research went public in October 2020, Rick explained to the press, including Forbes and The Register, why the flaw can’t be patched in shipping Macs. He also corrected how the work had been credited. The team’s own account is On bridgeOS / T2 Research.
Rick is part of Hack Different, an open-source community around Apple platforms. There he maintains apple-knowledge, a machine-readable collection of reverse-engineered Apple hardware and software facts. He also contributes to The Apple Wiki.
Research and open source
Rick publishes most of his work on GitHub. Beyond the T2 work, it falls into a few areas.
Firmware and boot security.
- mojo_thor (2017) is research into malware that infects the EFI and SMC firmware of MacBooks.
- peiutil (2017) converts UEFI PEI images (TE and VZ files) to PE, so they can be disassembled.
- apple_ssv (2020) explores macOS Signed System Volumes.
- windows-bluepill (2022) looks at breaking a system’s security without breaking Secure Boot.
Ports, cables and radios.
- badusb (2019) detects and exploits time-of-check/time-of-use gaps in USB mass storage.
- lightning_strike (2019) and lightning_dfu (2021) study the security of the Lightning connector.
- apple_utdm (2020) is a Linux kernel driver for Apple’s USB Target Disk Mode.
- apple-malicious-baseband (2022) documents a malicious cellular baseband image that carried Apple’s signature.
Libraries for Apple formats and services. libapfs for the Apple File System, pyxar for XAR archives, libiupdate for Apple software updates, libicloud for iCloud, apple_net_recovery for Internet Recovery, and Rust reimaginings of libimobiledevice (libidevice) and XPC (libxpc).
Tools that protect people.
- isafety (2020) examines iPhones and iPads for security and safety threats.
- chainfix (2024) checks and repairs Keychain and iCloud Keychain.
In the organizations he runs. Rick also owns the Hack Different and Team t8012 organizations on GitHub. Besides apple-knowledge, their projects include:
- webmuxd and go-webmuxd, which talk to iPhones and iPads from a web browser over WebUSB, and demuxusb, which analyzes their USB sessions;
- smcutil for Apple’s SMC payloads, efivalidate for validating the firmware of Macs up to the T1, and libapplefw for Apple firmware images;
- go-aapl-integrity and cnklverify for Apple’s integrity formats (img4, chunklists, trust caches), and secure_emu, which runs SecureROM under the Unicorn emulator;
- mootool for Mach-O files, yolo_dsc for extracting the dyld shared cache, symbol-server for Apple symbols, xnudex for indexing XNU OS images, and kext-kmem, a kernel extension for reading and writing kernel memory;
- homebrew-jailbreak, a Homebrew tap of research tools, and newosxbook-tools, which packages Jonathan Levin’s tools for it;
- libibackup for iOS backups, apple-diagnostics-format for Apple’s wireless diagnostics files, apple-baseband for the modem baseband, and uarp for Apple’s accessory firmware update protocol;
- from the T2 work, pongo-flash, a flash storage driver for checkra1n’s pongoOS, and RemoteServiceDiscovery, a reverse-engineered rewrite of Apple’s framework of that name.
He also runs AudienceKit, a generalization of Hot Mess, his 2015 app that indexed subcultures by their people, places and events. AudienceKit has its own API, admin interface, and Swift and Ruby SDKs. He also built hedonism_bot, where photographers upload photos. It uses the same Postgres, pgvector and embedding approach as Garage to find and group faces without naming anyone, so people can find and download the photos they appear in.
His most widely used project is apple-knowledge, mentioned above, with over 1,400 stars on GitHub.
Contributions to other projects. Rick has had pull requests merged in more than 25 projects outside his own. Among them:
- Apple platform tooling: Mach-O fileset support and new segment types in Homebrew’s ruby-macho (five merged PRs), T2 support in usbmuxd, Linux fixes to ipwndfu, build work on checkra1n’s PongoOS, pkg-config support in ldid, the convert verb in dmglib, and firmware sources in Acidanthera’s MacInfoPkg.
- Reverse engineering: universal macOS builds of the Capstone disassembler, a fix to Vector 35’s Objective-C workflow for Binary Ninja, and an easier install for MEAnalyzer, Intel’s Management Engine analyzer.
- Security:
OpenSSL::BN#absin Ruby’s openssl library, removing unsafe OpenSSL patches from money-tree, and a stricter content security policy for Dropbox’s merou permissions system. - Data and infrastructure: the build and validation tests for AppleDB (four merged PRs), universal macOS build instructions for Zstandard, fixes to Homebrew, overcommit and keccak.rb, and Meshtastic firmware dev containers.
He also wrote meshtastic-map-manager for managing Meshtastic map data.
Outside of work
Away from the keyboard, Rick makes documentary film and photography centered on the LGBT community.
Why Garage
Garage brings that security background to AI. It makes your own documents, code and messages searchable by your AI assistant. The database, the index and, by default, the models all run on your Mac, and Garage itself never sends your messages to another computer. Your AI assistant receives only the excerpts it asks for, and what happens to them after that depends on the assistant; the privacy page covers the details. Garage is open source, so you can check all of this for yourself.
Work with Rick
Rick is available for hire, for AI security, privacy engineering and security research roles, remote or hybrid. If you or your team could use help with software like this, get in touch on LinkedIn.
Support the project
Garage is free. If it’s useful to you, you can support Rick’s work on Patreon, and you can report bugs, suggest features or send pull requests on GitHub.