I am trying to decompile a dylib called libConfigurer64.dylib, which is loaded from the environment variable "DYLD_INSERT_LIBRARIES"

I want to analyze what it really does, so I dragged it in to IDA, and found that it exported "_sub_06adf","_sub_06bdf","InitFunc_0"

In _sub_06adf:

db 'VfhT2zwxQpLeHRL6j4Oe4mrsmrjEAW',0
align 10h

In _sub_06bdf

db '(c) 2014 - Cryptic Apps SARL - Disassembling not allowed.',0
db    0
db    0
db    0
db    0

They aren't correct asm code! And I have no clue what tool obfuscated this file.
And I'm also curious about how can this dylib overwrite exisiting functions?

Note: I've read https://alexomara.com/blog/a-silly-anti-disassembly-trick/, however this dylib isn't that trick, but is really obfuscated XD

  • did u do anything related to this file ? I'm working on reversing it but it's really heavily obfuscated.
    – Coldzer0
    Sep 23 '19 at 23:06
  • @Coldzer0 Nope. I gave up at last.... This file is really hard to deobfuscate! Oct 6 '19 at 6:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.