I am exploring MacOS Deckset app. It has a trial version available on the official website. But there's a cracked version available on torrent trackers.
I want to know what was changed by the people who cracked that app: strings? symbols? few assembly instructions?
Both (genuine and cracked) versions are available as .DMG installers. I've extracted Deckset.app containers from both of them.
Now, I'm able to explore Deckset.app/Contents/MacOS/Deckset binary in Hopper tool.
But as the cracked version is patched, I want to understand what actually was patched.
For this, I used radiff2 tool from Radare2 toolset:
radiff2 genuine.app/Contents/MacOS/Deckset cracked.app/Contents/MacOS/Deckset > bin_diff.txt
It gave me output like this:
0x00000e98 901e => 101c 0x00000e98
0x0000201c 109a => 9097 0x0000201c
0x0027d486 770c => 585e 0x0027d486
0x0027d48b 04 => 03 0x0027d48b
0x0027d493 2c => 24 0x0027d493
0x0027d49a 511a => 5097 0x0027d49a
0x0027d49d 00 => 01 0x0027d49d
0x0027d49f 05 => 00 0x0027d49f
0x0027d4a3 fe00010000 => 07fade0c02 0x0027d4a3
0x0027d4aa 53bcfade0c02 => 507300020100 0x0027d4aa
0x0027d4b2 50ee => 0000 0x0027d4b2
0x0027d4b5 020500 => 0000b3 0x0027d4b5
0x0027d4b9 01 => 00 0x0027d4b9
0x0027d4bb 00 => 30 0x0027d4bb
0x0027d4be 012e => 0003 0x0027d4be
0x0027d4c2 0060 => 027e 0x0027d4c2
Now, when I open "genuine" app in Hopper, and search for either 0x00000e98, or 901e, or 101c, it gives nothing useful.
E.g. when I do Menu > Navigate > Go to Address or Symbol and enter 0x00000e98, it gives me such segment:
I don't see nor 901e, neither 101c in this segment.
What am I doing wrong? Do you know better tools for doing this (except IDA Pro, because it's expensive)?
901eat the offset0x00000e98, though it is in little endian, so it is displayed as1e90in "amount to map from the file" line. You are using the right tools. Good luck with your investigation. :)