I am exploring MacOS Deckset app. It has a trial version available on the official website. But there's a cracked version available on torrent trackers.
I want to know what was changed by the people who cracked that app: strings? symbols? few assembly instructions?
Both (genuine and cracked) versions are available as .DMG installers. I've extracted Deckset.app containers from both of them.
Now, I'm able to explore
Deckset.app/Contents/MacOS/Deckset binary in
But as the cracked version is patched, I want to understand what actually was patched.
For this, I used
radiff2 tool from
radiff2 genuine.app/Contents/MacOS/Deckset cracked.app/Contents/MacOS/Deckset > bin_diff.txt
It gave me output like this:
0x00000e98 901e => 101c 0x00000e98 0x0000201c 109a => 9097 0x0000201c 0x0027d486 770c => 585e 0x0027d486 0x0027d48b 04 => 03 0x0027d48b 0x0027d493 2c => 24 0x0027d493 0x0027d49a 511a => 5097 0x0027d49a 0x0027d49d 00 => 01 0x0027d49d 0x0027d49f 05 => 00 0x0027d49f 0x0027d4a3 fe00010000 => 07fade0c02 0x0027d4a3 0x0027d4aa 53bcfade0c02 => 507300020100 0x0027d4aa 0x0027d4b2 50ee => 0000 0x0027d4b2 0x0027d4b5 020500 => 0000b3 0x0027d4b5 0x0027d4b9 01 => 00 0x0027d4b9 0x0027d4bb 00 => 30 0x0027d4bb 0x0027d4be 012e => 0003 0x0027d4be 0x0027d4c2 0060 => 027e 0x0027d4c2
Now, when I open "genuine" app in Hopper, and search for either
101c, it gives nothing useful.
E.g. when I do
Menu > Navigate > Go to Address or Symbol and enter
0x00000e98, it gives me such segment:
What am I doing wrong? Do you know better tools for doing this (except IDA Pro, because it's expensive)?