I am working on a crackme (Mach-O, mac app).
Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me where the serial verification is located.
Instead of going through main, I went through _objc_msgSend and found some interesting functions that print the usual 'you win/you lose'.
If I check the reference of those, I end up here:
; Segment type: Pure data
000062F4 __inst_meth segment dword public 'DATA' use32
000062F4 assume cs:__inst_meth
000062F4 ;org 62F4h
000062F4 stru_62F4 __objc_method_list <0, 0Eh> ; DATA XREF: __class:stru_60C4↑o
000062FC __objc_method <offset sel_dealloc, offset aV804, \ ; -[MCAppDelegate dealloc] ...
000062FC offset __MCAppDelegate_dealloc_>
00006308 __objc_method <offset sel_succeed, offset aV804, \ ; -[MCAppDelegate succeed] ...
00006308 offset __MCAppDelegate_succeed_>
00006314 __objc_method <offset sel_crackDetected, offset aV804, \ ; -[MCAppDelegate crackDetected] ...
00006314 offset __MCAppDelegate_crackDetected_>
00006320 __objc_method <offset sel_fail, offset aV804, \ ; -[MCAppDelegate fail] ...
00006320 offset __MCAppDelegate_fail_>
0000632C __objc_method <offset sel_a, offset aV804, offset __MCAppDelegate_a_> ; -[MCAppDelegate a] ...
00006338 __objc_method <offset sel_b, offset aV804, offset __MCAppDelegate_b_> ; -[MCAppDelegate b] ...
00006344 __objc_method <offset sel_c, offset aV804, offset __MCAppDelegate_c_> ; -[MCAppDelegate c] ...
00006350 __objc_method <offset sel_d, offset aV804, offset __MCAppDelegate_d_> ; -[MCAppDelegate d] ...
0000635C __objc_method <offset sel_e, offset aV804, offset __MCAppDelegate_e_> ; -[MCAppDelegate e] ...
00006368 __objc_method <offset sel_f, offset aV804, offset __MCAppDelegate_f_> ; -[MCAppDelegate f] ...
00006374 __objc_method <offset sel_mk, offset aV804, \ ; -[MCAppDelegate mk] ...
00006374 offset __MCAppDelegate_mk_>
00006380 __objc_method <offset sel_applicationDidFinishLaunching_, \ ; -[MCAppDelegate applicationDidFinishLaunching:] ...
00006380 offset aV12048, \
00006380 offset __MCAppDelegate_applicationDidFinishLaunching__>
0000638C __objc_method <offset sel_window, offset a804_0, \ ; -[MCAppDelegate window] ...
0000638C offset __MCAppDelegate_window_>
00006398 __objc_method <offset sel_setWindow_, offset aV12048, \ ; -[MCAppDelegate setWindow:] ...
00006398 offset __MCAppDelegate_setWindow__>
00006398 __inst_meth ends
Now, unfortunately this doesn't lead me anywhere. I checked the references and found nothing.
After this failed attempt, I tried to trace functions via IDA with the local MacOS debugger.
First thing first, it throws this error just after starting the process:
Unexpected dyld_opcode in the debugger server (init_dyld): 5ffb
I found absolutely no info about this, so I just ignored it.
Then I started the function tracing and got this:
got SIGBUS signal (bus error) (exc.code a, tid 24571)
Now, keep in mind that this is my first 'real' crackme. Everything that I did before was just a command line application, so it was much more straightforward than this.
I am not even sure if 'function tracing' is what I think it is. I was hoping for some kind of function call hierarchy where I could find what exactly called the 'fail' function.
