1

I know that there is a string called "Activate your subscription" used in this particular app. But Im not able to find this string from its executable. I tried strings myapp and also searched for same string with Hopper disassembler but it both haven't found location of that string.

So my question what am I missing here and is this some kind of obfuscation used by these apps ?

Image of a screen in this particular mac app where "Activate your subscription" string is used

Mac App

After Searching for "Activate" string in Hopper

Hopper

2
  • 1
    Check the resource files too
    – Igor Skochinsky
    Commented Mar 28, 2019 at 10:17
  • More here on what @Igor Skochinsky is referring to. Also if it's a client/server type app, it could be getting messages from an external source over a network. Commented Mar 28, 2019 at 13:50

1 Answer 1

4

Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can find this types of techniques on them.

For example instead of do this

const char *msg = "Good morning";

You can do

const char *msg = "R29vZCBtb3JtaW5nCg=="; /* base64 of 'Good morning' */

and on every use of msg you just call a base64 decode function and that's how works in a very basic environment. You can use RC4, Xor or any other encryption algorithm for hide the strings, but bear in mind that somebody with experience will find the way to decode the string

printf("My message is %s\n", decode64(msg));
4
  • Could you explain it with some example Code. Because I can't completely understand you. I can understand encryption on string but input to this encryption algorithm must be "Activate your subscription" string and strings command must have found at least that occurrence of string. Instead it shows zero result for that string search. Commented Mar 28, 2019 at 8:21
  • So in order to find string we have to search for various encrypted values of our desired string in the target executable ? Or is there any other tool available for this? Commented Mar 28, 2019 at 8:33
  • @JafferSheriff: You might want to check out this question for recommendations of tools. Although the question is for Windows, at least one of the tools is also available for Mac. Commented Mar 28, 2019 at 13:54
  • @GuitarPicker Thanks for your help and I really appreciate it . Commented Mar 28, 2019 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.