I'm trying to disassemble Dock.app on macOS Sierra, and IDA is giving me this error message:
What does this mean?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
If you look in macho.cfg you find:
// Key used to decrypt apple-protected binaries. // Due to copyright reasons we cannot publish the key, // but we can give you clues... // http://www.takwing.idv.hk/tech/virtual/faq/no_more_fakesmc.html SMC_DEVICE_KEY = "";
The link mentioned no longer works, but there are many other places on the internet where the key can be found.
Here you have more details about Apple Binary Protection: Creating undetected malware for OS X
SMC_DEVICE_KEY value in
~/.idapro/macho.cfg works fine.
Hopper Disassembler out of the box can decrypt those binaries too.