1

I am working on a crackme (Mach-O, mac app).

Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me where the serial verification is located.

Instead of going through main, I went through _objc_msgSend and found some interesting functions that print the usual 'you win/you lose'.

If I check the reference of those, I end up here:

; Segment type: Pure data
000062F4 __inst_meth segment dword public 'DATA' use32
000062F4 assume cs:__inst_meth
000062F4 ;org 62F4h
000062F4 stru_62F4 __objc_method_list <0, 0Eh>   ; DATA XREF: __class:stru_60C4↑o
000062FC __objc_method <offset sel_dealloc, offset aV804, \ ; -[MCAppDelegate dealloc] ...
000062FC                offset __MCAppDelegate_dealloc_>
00006308 __objc_method <offset sel_succeed, offset aV804, \ ; -[MCAppDelegate succeed] ...
00006308                offset __MCAppDelegate_succeed_>
00006314 __objc_method <offset sel_crackDetected, offset aV804, \ ; -[MCAppDelegate crackDetected] ...
00006314                offset __MCAppDelegate_crackDetected_>
00006320 __objc_method <offset sel_fail, offset aV804, \ ; -[MCAppDelegate fail] ...
00006320                offset __MCAppDelegate_fail_>
0000632C __objc_method <offset sel_a, offset aV804, offset __MCAppDelegate_a_> ; -[MCAppDelegate a] ...
00006338 __objc_method <offset sel_b, offset aV804, offset __MCAppDelegate_b_> ; -[MCAppDelegate b] ...
00006344 __objc_method <offset sel_c, offset aV804, offset __MCAppDelegate_c_> ; -[MCAppDelegate c] ...
00006350 __objc_method <offset sel_d, offset aV804, offset __MCAppDelegate_d_> ; -[MCAppDelegate d] ...
0000635C __objc_method <offset sel_e, offset aV804, offset __MCAppDelegate_e_> ; -[MCAppDelegate e] ...
00006368 __objc_method <offset sel_f, offset aV804, offset __MCAppDelegate_f_> ; -[MCAppDelegate f] ...
00006374 __objc_method <offset sel_mk, offset aV804, \ ; -[MCAppDelegate mk] ...
00006374                offset __MCAppDelegate_mk_>
00006380 __objc_method <offset sel_applicationDidFinishLaunching_, \ ; -[MCAppDelegate applicationDidFinishLaunching:] ...
00006380                offset aV12048, \
00006380                offset __MCAppDelegate_applicationDidFinishLaunching__>
0000638C __objc_method <offset sel_window, offset a804_0, \ ; -[MCAppDelegate window] ...
0000638C                offset __MCAppDelegate_window_>
00006398 __objc_method <offset sel_setWindow_, offset aV12048, \ ; -[MCAppDelegate setWindow:] ...
00006398                offset __MCAppDelegate_setWindow__>
00006398 __inst_meth ends

Now, unfortunately this doesn't lead me anywhere. I checked the references and found nothing.

After this failed attempt, I tried to trace functions via IDA with the local MacOS debugger.

First thing first, it throws this error just after starting the process:

Unexpected dyld_opcode in the debugger server (init_dyld): 5ffb

I found absolutely no info about this, so I just ignored it.

Then I started the function tracing and got this:

got SIGBUS signal (bus error) (exc.code a, tid 24571)

Now, keep in mind that this is my first 'real' crackme. Everything that I did before was just a command line application, so it was much more straightforward than this.

I am not even sure if 'function tracing' is what I think it is. I was hoping for some kind of function call hierarchy where I could find what exactly called the 'fail' function.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.