I was taking a look at the OSX-Crisis sample obtained from this site and trying to analyze it for fun and learning. Choosing to disassemble as a Mac binary causes the start function to be discovered wrongly and hence affect the rest of the disassembly. I was reading the analysis of the malware here, and am curious about how I can go about finding the correct entry point address.
I believe it can be figured out using the
LC_UNIXTHREAD command eip value. In this case, should my approach be to disassemble the file within IDA as a "binary"(rather than a mach-o binary), navigate to 0x409c and press "C" ?