1

I have a signed mac app and I don't have the source code of the app. I know address locations of some assembly instructions which I need to change so as to make this app to work in certain way. So I'm trying to write a patcher, which should be able to read the assembly of original mac app and change those addresses and produce new mac app with no signature.

This patcher should be a stand alone mac app. The patcher should patch the original app and produce the modified one.

How can I do this? I just need some guidance to write this patcher.

3

There are several aspects for this:

  • if the app is not protected with some sort of packaging
    • you just need to find the place that you want to patch with the help of debugger (when the app is running) or static disassembler (otool, hopper disassembler, ida disassembler)
    • understand how many bytes your patch takes (for example with online tool)
    • understand how many space you have in the original app. Every disassembler will show you or use the above tool as well
    • use any hex editor (hex fiend) to patch the file with the bytes you've got from (1).
    • if there is enough space for the patch, you apply it and the left space fill with nop instruction
    • if there is not, you will need to find that space by:
      • splitting your patch in several parts (there are always caves between functions or at the end of the section)
      • or allocate your own section and fill in your code. In that case, you will also need to edit the file adder to account for a new section.
  • if the app is packed or protected in any way from patching, then you can not just patch it on disk just like that. You'll need to unpack it, patch as explained above and repack (or not) back.
    • or you can create runtime patcher in this case, which is more complicated to do.

UPDATE:

To automate the on-disk patching, one can use a pretty easy way which is based on some pattern matching and a little bit of heuristics:

  • with the help of disassembler try to find some distinguishable bytes before the patch area
  • do the same for the area after the patch area
  • if appropriate, find the same for the patch itself:
    • for example if there is a control flow change, try to analyze the target of that change for some pattern.

All the above will be sufficient (hopefully) to accommodate version changes and assure that you change at the right place. Such patcher could be easily coded with Python. For disassembling you can use Capstone library which has Python binding.

Take into account that, you fill make OSX complain about this patched app as it will not be signed any more.

2
  • thank you for your valuable info. I have created a modified executable of a app using hopper disassembler. I have to replace the original executable with modified one to run the patched app. So instead of doing this manual process in every Mac, I want to create a app patcher which should patch the original app and produce the modified one. It Is much like dynamic patching so how can dynamically patch that Mac app? – Jaffer Sheriff Jun 29 '17 at 17:28
  • @phOsec really thank you for your help and you are a life saver. – Jaffer Sheriff Jun 30 '17 at 6:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.