3

I was taking a look at the OSX-Crisis sample obtained from this site and trying to analyze it for fun and learning. Choosing to disassemble as a Mac binary causes the start function to be discovered wrongly and hence affect the rest of the disassembly. I was reading the analysis of the malware here, and am curious about how I can go about finding the correct entry point address.

I believe it can be figured out using the LC_UNIXTHREAD command eip value. In this case, should my approach be to disassemble the file within IDA as a "binary"(rather than a mach-o binary), navigate to 0x409c and press "C" ?

  • 2
    had a look at this ? – Ange Apr 15 '13 at 16:11
3

According to fG!'s blog entry on OSX-Crisis (recommended read), the true EntryPoint is located in the segment __INIT_STUB, with code execution permission.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy