Recently I tried to use Hopper Disassembler to do the reverse engineering on a Mac application. After decompiling the executable file, I got a bunch of cstrings defined in the specific location. For example, on 0x105d4a804 there is a string "SQLITECIPHER".

But my problem is that: is 0x105d4a804 a relative address or an absolute one?

I found that if I use gdb to run the executable file, I can use x/s to print that string correctly, exactly in that location.

This raises my concern. Is this string probably defined as a global variable? Why is the memory location in gdb as same as defined in the executable? Any explanation will be appreciated!

enter image description here


I don't know exactly about Mac applications, but .text, .rodata, .data etc are usually at static locations which stay the same while parsing the ELF in a disassembler and during runtime. There's a feature called Position Independent Executables(PIE) in which even these sections are subject to ASLR. In newer gcc versions PIE is enabled by default unless specifically opted out in the compiler flags.

From here

You can use the -pie or -PIE flags to GCC to create what is called a “position independent executable” (a.k.a. PIE). When you do this GCC will only generate relocatable code. There is still an entry point for the program with a hard-coded address, but all the entry point does is set things up to run the relocatable code.

The main use case for this is ASLR hardening. When a PIE ASLR binary starts up the kernel picks a random virtual memory address to load all code other than the entry point stub at. This makes it harder to exploit a large class of security vulnerabilities common to C/C++ programs. Most Linux distributions do not compile typically binaries with this option because there is real, measurable overhead to invoking relocatable functions. Distributions like Debian and Ubuntu only compile particularly security sensitive binaries (e.g. ssh) as PIEs. (Traditional non-PIE binaries will still use ASLR on Linux, but only for loading dynamic libraries).

In the application you're reversing PIE may have been disabled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.