12

Much reverse engineering has been done on Windows over the years leading to great undocumented functionality, such as using NtCreateThreadEx to inject threads across sessions.

On OSX the topic of thread injection seems relatively uncharted. With the operating system being so incredibly large, where can I begin looking in order to uncover the functionality I desire?

For example, if someone were to ask me this about Windows, I would expect an answer telling me to begin reverse engineering CreateRemoteThread or to start looking at how the kernel creates user threads and point them into ntoskrnl.exe.

  • The software is redundant as the majority of questions here involve software. – asheeshr Mar 31 '13 at 2:59
  • Seems that there are a significant number of hardware related questions as well. If a hardware RE wanted to use this site, wouldn't it be nice if he/she could just put "software" on their ignored tags and be free from questions like mine? – mrduclaw Mar 31 '13 at 3:13
  • A hardware RE could also add the hardware to his favorite tags. It would have a similar effect. Do post you opinion here -> meta.reverseengineering.stackexchange.com/questions/3/… – asheeshr Mar 31 '13 at 3:22
  • @AshRj Fair point. I'll fix it in the future. – mrduclaw Mar 31 '13 at 3:56
11

Admittedly, I don't know much about OSX, or even Linux. But I would suggest looking at the GDB source code. GDB somehow is able to attach to running processes in order to debug them. I would imagine this would, at least, provide similar functionality that you're looking for and prove a decent place to start.

If you're looking for a system call, it appears that ptrace is how GDB might do it. Also, here's a nice overview of how debuggers work.

Update:

Actually it seems that Uninformed wrote an article that covers this topic somewhat. In the article they discuss:

A lot of people seem to move to Mac OS X from a Linux or BSD background and therefore expect the ptrace() syscall to be useful. However, unfortunately, this isn't the case on Mac OSX. For some ungodly reason, Apple decided to leave ptrace() incomplete and unable to do much more than take a feeble attempt at an anti-debug mechanism or single step the process.

Also from that article, it looks like thread_create_running might be the function you're looking for. Link to the man page.

  • 1
    The Uninformed article is really great and I think right what I needed to get me started in the right direction. Thanks! – mrduclaw Mar 31 '13 at 2:20
4

For OS X injection, I would look at the mach_star projects (mach_override and mach_inject)

https://github.com/rentzsch/mach_star

Also, Pin now has os x support

http://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-downloads

0

You might find this useful -- I ended up writing a tutorial about this recently, since, as you note, documentation for this stuff is always so sketchy and often out of date.

http://soundly.me/osx-injection-override-tutorial-hello-world/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.