13

Much reverse engineering has been done on Windows over the years leading to great undocumented functionality, such as using NtCreateThreadEx to inject threads across sessions.

On OSX the topic of thread injection seems relatively uncharted. With the operating system being so incredibly large, where can I begin looking in order to uncover the functionality I desire?

For example, if someone were to ask me this about Windows, I would expect an answer telling me to begin reverse engineering CreateRemoteThread or to start looking at how the kernel creates user threads and point them into ntoskrnl.exe.

Improve this question
4
  • The software is redundant as the majority of questions here involve software.
    – asheeshr
    Commented Mar 31, 2013 at 2:59
  • Seems that there are a significant number of hardware related questions as well. If a hardware RE wanted to use this site, wouldn't it be nice if he/she could just put "software" on their ignored tags and be free from questions like mine?
    – mrduclaw
    Commented Mar 31, 2013 at 3:13
  • A hardware RE could also add the hardware to his favorite tags. It would have a similar effect. Do post you opinion here -> meta.reverseengineering.stackexchange.com/questions/3/…
    – asheeshr
    Commented Mar 31, 2013 at 3:22
  • @AshRj Fair point. I'll fix it in the future.
    – mrduclaw
    Commented Mar 31, 2013 at 3:56

3 Answers 3

Reset to default
12

Admittedly, I don't know much about OSX, or even Linux. But I would suggest looking at the GDB source code. GDB somehow is able to attach to running processes in order to debug them. I would imagine this would, at least, provide similar functionality that you're looking for and prove a decent place to start.

If you're looking for a system call, it appears that ptrace is how GDB might do it. Also, here's a nice overview of how debuggers work.

Update:

Actually it seems that Uninformed wrote an article that covers this topic somewhat. In the article they discuss:

A lot of people seem to move to Mac OS X from a Linux or BSD background and therefore expect the ptrace() syscall to be useful. However, unfortunately, this isn't the case on Mac OSX. For some ungodly reason, Apple decided to leave ptrace() incomplete and unable to do much more than take a feeble attempt at an anti-debug mechanism or single step the process.

Also from that article, it looks like thread_create_running might be the function you're looking for. Link to the man page.

Improve this answer
1
  • 1
    The Uninformed article is really great and I think right what I needed to get me started in the right direction. Thanks!
    – mrduclaw
    Commented Mar 31, 2013 at 2:20
4

For OS X injection, I would look at the mach_star projects (mach_override and mach_inject)

https://github.com/rentzsch/mach_star

Also, Pin now has os x support

http://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-downloads

Improve this answer
0

You might find this useful -- I ended up writing a tutorial about this recently, since, as you note, documentation for this stuff is always so sketchy and often out of date.

http://soundly.me/osx-injection-override-tutorial-hello-world/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.