8

I've been tasked with an assignment requiring a thorough reverse engineering effort on the PluginKit framework in modern Mac operating system, and I'm looking for information to start off, instead of starting from scratch.

More specifically, I need to get a decent understanding of the internal storage and configuration layout and format of PluginKit, as well as how it's being manipulated, updated and read.

The only resource I've managed to come up with is this medium short article from over a year ago, by a person called Aditya Vaidyam.

I found no relevant information (according to table of contents) in Mac OSX Internals by Amit Singh or in MacOS and *OS Internals by Jonathan Levin, and didn't find anything else to look at.

My question therefore is two-fold:

  1. Are there any other resources available that describe in-detail the OSX frameworks and the PluginKit framework specifically?
  2. What other resources, pointers, tips and previous research would you suggest I read before going into the task?
Improve this question
3
  • That post was indeed written by me. It covers from a high level into the internals of how NSExtension bootstraps and operates, less so on how to deal with PlugInKit. There are actually zero other resources AFAIK but grab yourself a disassembler (provided you know some assembly) and go to town on the binary (which is actually located at /System/Library/PrivateFrameworks/PlugInKit.framework/Contents/MacOS/PlugInKit)
    – Aditya Vaidyam
    Commented Aug 25, 2018 at 2:14
  • 1
    Yes, of course I could reverse engineer the file, but before doing so myself I searched for existing material I could rely on.
    – NirIzr
    Commented Aug 25, 2018 at 19:51
  • @Nirlzr Ah, understood!
    – Aditya Vaidyam
    Commented Aug 28, 2018 at 13:42

1 Answer 1

Reset to default
3

My offers won't be specific for your task, so I will try to answer your second question. I hope these helps to you or anyone having a similar task. Since your task is on a quite specific subject, I will offer you searching for something similar, and solve the puzzle by combining these details.

I don't know if you have previous MacOS/iOS reversing experience. So here is a good tutorial to start for understanding platform details (Binary format etc.)

And you can start with basic understanding of Objective-C runtime details. This information will be quite helpful when you face some (dis)assembly

For exp;

This post (Introduction to LLDB and Hopper) can be quite helpful since it provides an example of decompilation of an Apple's UIKit framework. By using that approach I decompiled PluginKit, but didn't focus on internals.

You can also check interface of PluginKit via Runtime Browser and search methods to focus on, or check pre-generated intefaces which are available on github page

Good luck

Improve this answer
2
  • Thanks. Upvoted. When you say "I decompiled PluginKit", could you elaborate on that? Is there something I can read about your experience?
    – NirIzr
    Commented Sep 6, 2017 at 13:40
  • 1
    Actually not that much, I just followed the guide and disassembled the iOS binary for PluginKit. (MacOS binary is placed at /usr/bin/pluginkit ) If you have an issue until that part of course I can help. Rest is depends on what you are looking for. I think u need a real use case for PluginKit to understand, what it does and how it works. Then you can focus on specific parts for details and we can exchange knowledge.
    – qwerty
    Commented Sep 6, 2017 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.