I'm a beginner to reverse engineering, I've read through a few tutorials and know my way around some basic GDB and assembly code. After working my way through a few trivial examples I'd like to try something a bit more 'real-world'. My goal is to reverse-engineer and 'crack' Introversion Software / Ambrosia Software's game 'Uplink'.
Note that I am only doing this for the challenge, if I just wanted to play the game for free I would find a crack, not make one. The demo is freely available at http://www.ambrosiasw.com/games/uplink/.
Now, I have learned a few important things through static-analysis, using the tools Hopper and class-dump. It soon became clear that the registration-related functions lived in ASWRegistration.framework
, but after trying some static analysis, to no avail, I decided it would be best to throw GDB at it. Loaded it up, tried to set a breakpoint on one of the interesting-looking functions.
(gdb) b +[ASWRegistration isRegistered:]
Function "+[ASWRegistration isRegistered:]" not defined.
Make breakpoint pending on future shared library load? (y or [n]) n
Aw, that's annoying. Let's try something else.
(gdb) b isRegistered
Function "isRegistered" not defined.
Make breakpoint pending on future shared library load? (y or [n]) n
Hm, maybe I'm doing something wrong...
(gdb) b isRegistered:
No symbol table is loaded. Use the "file" command.
Make breakpoint pending on future shared library load? (y or [n]) n
(gdb)
Well, that give me a different error message, it's still not working though...
Upon further examination, I've found that I can't even properly break on functions inside the executable itself.
(gdb) b applicationDidFinishLaunching:
[0] cancel
[1] all
Non-debugging symbols:
[2] -[SUStatusChecker applicationDidFinishLaunching:]
[3] -[SUUpdater applicationDidFinishLaunching:]
> 0
canceled
Two possible applicationDidFinishLaunching
s, not one of them come from the actual game (I suspect they're from Sparkle.framework). It WOULD seem as though Ambrosia was smart and stripped all debugging symbols, but class-dump gives me full headers, nm gives me a bunch of symbols, and Hopper finds all sorts of methods. So I don't see why GDB can't use that. Again, I'm a beginner in all of this, maybe I'm doing something blatantly wrong. I also tried the same thing with a Mac App Store games, "Hack RUN Free", and got the same No symbol table is loaded. Use the "file" command
error. Of course, the file command doesn't help at all.
Does anybody know how to fix this? I'd like to advance beyond the purely theoretical level in this ?
info functions
to display all function symbols within the executable ? Hopper seems to have a different (more efficient) method to extract the symbol table. It might be a GDB limit here.b *0xdeadbeef
orb *myfunction
.objdump -x
(look at the export table)?