4

I'm trying to disassemble Dock.app on macOS Sierra, and IDA is giving me this error message:

enter image description here

What does this mean?

5

If you look in macho.cfg you find:

// Key used to decrypt apple-protected binaries.
// Due to copyright reasons we cannot publish the key,
// but we can give you clues...
//   http://www.takwing.idv.hk/tech/virtual/faq/no_more_fakesmc.html

SMC_DEVICE_KEY = "";

The link mentioned no longer works, but there are many other places on the internet where the key can be found.

4

Here you have more details about Apple Binary Protection: Creating undetected malware for OS X

Setting SMC_DEVICE_KEY value in ~/.idapro/macho.cfg works fine.

Hopper Disassembler out of the box can decrypt those binaries too.

At last, you can also run deprotect from class-dump to decrypt those binaries (__TEXT,__text) section.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.