We’re rewarding the question askers & reputations are being recalculated! Read more.
3 Trying to focus on encrypted Mach-O binaries only
source | link

Working mach Encrypted Mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze a Mach-O binaryan encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors:

  • when I load this binary into GDB and try to disassemble the code at the address indicated by the entry point, GDB returns garbage instead of any meaningful asm.
  • the same happens with radare2
  • Hopper disassembler shows the same entry point address but delivers a clear disassembly.

I've tried to execute this application in GDB - nothing works at all. Surprisingly, executing this app from terminal works plenty well.

I'm afraid that my target has been packed/compressed/obfuscated in some way GDB/radare2 cannot cope with. Surprisingly, Hopper processes it pretty well.

Unfortunately, I don't own a full version of the Hopper. Moreover, I would like to be able to debug this app in GDB. Is there any way to do this?

Has anyone else run into something like this? If so, how should I proceed?

Working mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze a Mach-O binary (non-iPhone one), and I am observing the following strange behaviors:

  • when I load this binary into GDB and try to disassemble the code at the address indicated by the entry point, GDB returns garbage instead of any meaningful asm.
  • the same happens with radare2
  • Hopper disassembler shows the same entry point address but delivers a clear disassembly.

I've tried to execute this application in GDB - nothing works at all. Surprisingly, executing this app from terminal works plenty well.

I'm afraid that my target has been packed/compressed/obfuscated in some way GDB/radare2 cannot cope with. Surprisingly, Hopper processes it pretty well.

Unfortunately, I don't own a full version of the Hopper. Moreover, I would like to be able to debug this app in GDB. Is there any way to do this?

Has anyone else run into something like this? If so, how should I proceed?

Encrypted Mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors:

  • when I load this binary into GDB and try to disassemble the code at the address indicated by the entry point, GDB returns garbage instead of any meaningful asm.
  • the same happens with radare2
  • Hopper disassembler shows the same entry point address but delivers a clear disassembly.

I've tried to execute this application in GDB - nothing works at all. Surprisingly, executing this app from terminal works plenty well.

I'm afraid that my target has been packed/compressed/obfuscated in some way GDB/radare2 cannot cope with. Surprisingly, Hopper processes it pretty well.

Unfortunately, I don't own a full version of the Hopper. Moreover, I would like to be able to debug this app in GDB. Is there any way to do this?

Has anyone else run into something like this? If so, how should I proceed?

    Tweeted twitter.com/#!/StackReverseEng/status/360929046932111360
2 grammatical changes and rewording the question to be a little more pointed in the direction you want to go. Also, you don't really need to leave a signature.
source | link

I'm trying to analyze a Mach-O binary (non-iPhone one), and I am observing the following strange behaviors:

  • when I load this binary into GDB and try to disassemble the code at the address indicated by the entry point, GDB returns garbage instead of any meaningful asm.
  • the same happens with radare2
  • Hopper disassembler shows the same entry point address but delivers a clear disassembly.

I've tried to execute this application in GDB - nothignothing works at all. Surprisingly, executing this app from terminal works plenty goodwell.

I'm afraid that my target has been packed/compressed/obfuscated in some way GDB/radare2 cannot cope with. Surprisingly, Hopper does process thatprocesses it pretty well.

Unfortunately, I don't own a full version of the Hopper. Moreover, I would like to be able to debug this app in GDB. Is there any way to do this?

Does someone ever observed smthHas anyone else run into something like thatthis? Any hintsIf so, how should I proceed?

Best regards Max

I'm trying to analyze a Mach-O binary (non-iPhone one) and observing the following strange behaviors:

  • when I load this binary into GDB and try to disassemble the code at the address indicated by the entry point, GDB returns garbage instead of any meaningful asm.
  • the same happens with radare2
  • Hopper disassembler shows the same entry point address but delivers a clear disassembly.

I've tried to execute this application in GDB - nothig works at all. Surprisingly, executing this app from terminal works plenty good.

I'm afraid that my target has been packed/compressed/obfuscated in some way GDB/radare2 cannot cope with. Surprisingly, Hopper does process that pretty well.

Unfortunately, I don't own a full version of the Hopper. Moreover, I would like to be able to debug this app in GDB.

Does someone ever observed smth like that? Any hints?

Best regards Max

I'm trying to analyze a Mach-O binary (non-iPhone one), and I am observing the following strange behaviors:

  • when I load this binary into GDB and try to disassemble the code at the address indicated by the entry point, GDB returns garbage instead of any meaningful asm.
  • the same happens with radare2
  • Hopper disassembler shows the same entry point address but delivers a clear disassembly.

I've tried to execute this application in GDB - nothing works at all. Surprisingly, executing this app from terminal works plenty well.

I'm afraid that my target has been packed/compressed/obfuscated in some way GDB/radare2 cannot cope with. Surprisingly, Hopper processes it pretty well.

Unfortunately, I don't own a full version of the Hopper. Moreover, I would like to be able to debug this app in GDB. Is there any way to do this?

Has anyone else run into something like this? If so, how should I proceed?

1
source | link

Working mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze a Mach-O binary (non-iPhone one) and observing the following strange behaviors:

  • when I load this binary into GDB and try to disassemble the code at the address indicated by the entry point, GDB returns garbage instead of any meaningful asm.
  • the same happens with radare2
  • Hopper disassembler shows the same entry point address but delivers a clear disassembly.

I've tried to execute this application in GDB - nothig works at all. Surprisingly, executing this app from terminal works plenty good.

I'm afraid that my target has been packed/compressed/obfuscated in some way GDB/radare2 cannot cope with. Surprisingly, Hopper does process that pretty well.

Unfortunately, I don't own a full version of the Hopper. Moreover, I would like to be able to debug this app in GDB.

Does someone ever observed smth like that? Any hints?

Best regards Max