I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors:
- when I load this binary into GDB and try to disassemble the code at the address indicated by the entry point, GDB returns garbage instead of any meaningful asm.
- the same happens with radare2
- Hopper disassembler shows the same entry point address but delivers a clear disassembly.
I've tried to execute this application in GDB - nothing works at all. Surprisingly, executing this app from terminal works plenty well.
I'm afraid that my target has been packed/compressed/obfuscated in some way GDB/radare2 cannot cope with. Surprisingly, Hopper processes it pretty well.
Unfortunately, I don't own a full version of the Hopper. Moreover, I would like to be able to debug this app in GDB. Is there any way to do this?
Has anyone else run into something like this? If so, how should I proceed?