GDB issues: Can't set breakpoint on Obj-C method

Question

I'm a beginner to reverse engineering, I've read through a few tutorials and know my way around some basic GDB and assembly code. After working my way through a few trivial examples I'd like to try something a bit more 'real-world'. My goal is to reverse-engineer and 'crack' Introversion Software / Ambrosia Software's game 'Uplink'.

Note that I am only doing this for the challenge, if I just wanted to play the game for free I would find a crack, not make one. The demo is freely available at http://www.ambrosiasw.com/games/uplink/.

Now, I have learned a few important things through static-analysis, using the tools Hopper and class-dump. It soon became clear that the registration-related functions lived in ASWRegistration.framework, but after trying some static analysis, to no avail, I decided it would be best to throw GDB at it. Loaded it up, tried to set a breakpoint on one of the interesting-looking functions.

(gdb) b +[ASWRegistration isRegistered:]
Function "+[ASWRegistration isRegistered:]" not defined.
Make breakpoint pending on future shared library load? (y or [n]) n

Aw, that's annoying. Let's try something else.

(gdb) b isRegistered
Function "isRegistered" not defined.
Make breakpoint pending on future shared library load? (y or [n]) n

Hm, maybe I'm doing something wrong...

(gdb) b isRegistered:
No symbol table is loaded.  Use the "file" command.
Make breakpoint pending on future shared library load? (y or [n]) n
(gdb)

Well, that give me a different error message, it's still not working though...

Upon further examination, I've found that I can't even properly break on functions inside the executable itself.

(gdb) b applicationDidFinishLaunching:
[0] cancel
[1] all

Non-debugging symbols:
[2]    -[SUStatusChecker applicationDidFinishLaunching:]
[3]    -[SUUpdater applicationDidFinishLaunching:]
> 0
canceled

Two possible applicationDidFinishLaunchings, not one of them come from the actual game (I suspect they're from Sparkle.framework). It WOULD seem as though Ambrosia was smart and stripped all debugging symbols, but class-dump gives me full headers, nm gives me a bunch of symbols, and Hopper finds all sorts of methods. So I don't see why GDB can't use that. Again, I'm a beginner in all of this, maybe I'm doing something blatantly wrong. I also tried the same thing with a Mac App Store games, "Hack RUN Free", and got the same No symbol table is loaded. Use the "file" command error. Of course, the file command doesn't help at all.

Does anybody know how to fix this? I'd like to advance beyond the purely theoretical level in this ?

Answer 1

Objective-C works a bit different than most languages. You have selectors in the _ObjC section which are used as arguments to obj_msgSend (which is how just about everything is invoked). There are no direct calls between functions. I suggest starting off with the Cameron Hotchkies slides on this topic from REcon 2008.