Skip to main content
reformat, removed duplicated links (were in first link), added `deprotect` and Hopper instructions.
Source Link

Here you have more details about Apple Binary Protection: http://cerbero-blog.com/?p=1311Creating undetected malware for OS X http://osxbook.com/book/bonus/chapter7/binaryprotection/ http://osxbook.com/book/bonus/chapter7/tpmdrmmyth/

Setting SMC_DEVICE_KEY value in ~/.idapro/macho.cfg works fine.

Hopper Disassembler out of the box can decrypt those binaries too.

At last, you can also run deprotect from class-dump to decrypt those binaries (__TEXT,__text) section.

Here you have more details about Apple Binary Protection: Creating undetected malware for OS X

Setting SMC_DEVICE_KEY value in ~/.idapro/macho.cfg works fine.

Hopper Disassembler out of the box can decrypt those binaries too.

At last, you can also run deprotect from class-dump to decrypt those binaries (__TEXT,__text) section.

Source Link