There are currently no publicly known kernel rootkits for the latest version of MacOS X (10.5). This talk will go into hands-on details on how to develop a kernel based rootkit for MacOS X. Features will include file hiding, process hiding, keyboard sniffing and anti-forensics.