I am trying to reverse an OSX mach-o binary,
Disassembling gives me a bullshit, seems its encrypted with some packer.
I need to determine the encryption algorithm, and decrypt the binary.

Load Commands
Here is otool -l calculator output,
(seems there is no any crypt information... but it's encrypted)

Load command 0
      cmd LC_SEGMENT_64
  cmdsize 72
  segname __PAGEZERO
   vmaddr 0x0000000000000000
   vmsize 0x0000000100000000
  fileoff 0
 filesize 0
  maxprot 0x00000000
 initprot 0x00000000
   nsects 0
    flags 0x0
Load command 1
      cmd LC_SEGMENT_64
  cmdsize 1032
  segname __TEXT
   vmaddr 0x0000000100000000
   vmsize 0x000000000032f000
  fileoff 0
 filesize 3338240
  maxprot 0x00000007
 initprot 0x00000007
   nsects 12
    flags 0x0
Section
  sectname __text
   segname __TEXT
      addr 0x0000000100001760
      size 0x000000000028f4bc
    offset 5984
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x80000400
 reserved1 0
 reserved2 0
Section
  sectname __stubs
   segname __TEXT
      addr 0x0000000100290c1c
      size 0x0000000000000762
    offset 2690076
     align 2^1 (2)
    reloff 0
    nreloc 0
     flags 0x80000408
 reserved1 0 (index into indirect symbol table)
 reserved2 6 (size of stubs)
Section
  sectname __stub_helper
   segname __TEXT
      addr 0x0000000100291380
      size 0x0000000000000c5e
    offset 2691968
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x80000400
 reserved1 0
 reserved2 0
Section
  sectname __objc_methname
   segname __TEXT
      addr 0x0000000100291fde
      size 0x0000000000015697
    offset 2695134
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __cstring
   segname __TEXT
      addr 0x00000001002a7680
      size 0x0000000000023fdc
    offset 2782848
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __const
   segname __TEXT
      addr 0x00000001002cb660
      size 0x0000000000006b50
    offset 2930272
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __ustring
   segname __TEXT
      addr 0x00000001002d21b0
      size 0x00000000000007de
    offset 2957744
     align 2^1 (2)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_classname
   segname __TEXT
      addr 0x00000001002d298e
      size 0x0000000000000b42
    offset 2959758
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __objc_methtype
   segname __TEXT
      addr 0x00000001002d34d0
      size 0x00000000000069c4
    offset 2962640
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __gcc_except_tab
   segname __TEXT
      addr 0x00000001002d9e94
      size 0x0000000000007b48
    offset 2989716
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __unwind_info
   segname __TEXT
      addr 0x00000001002e19dc
      size 0x0000000000002814
    offset 3021276
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __eh_frame
   segname __TEXT
      addr 0x00000001002e41f0
      size 0x000000000004ae08
    offset 3031536
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Load command 2
      cmd LC_SEGMENT_64
  cmdsize 1832
  segname __DATA
   vmaddr 0x000000010032f000
   vmsize 0x0000000000160000
  fileoff 3338240
 filesize 1396736
  maxprot 0x00000007
 initprot 0x00000003
   nsects 22
    flags 0x0
Section
  sectname __program_vars
   segname __DATA
      addr 0x000000010032f000
      size 0x0000000000000028
    offset 3338240
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __nl_symbol_ptr
   segname __DATA
      addr 0x000000010032f028
      size 0x0000000000000010
    offset 3338280
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000006
 reserved1 315 (index into indirect symbol table)
 reserved2 0
Section
  sectname __got
   segname __DATA
      addr 0x000000010032f038
      size 0x0000000000000218
    offset 3338296
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000006
 reserved1 317 (index into indirect symbol table)
 reserved2 0
Section
  sectname __la_symbol_ptr
   segname __DATA
      addr 0x000000010032f250
      size 0x00000000000009d8
    offset 3338832
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000007
 reserved1 384 (index into indirect symbol table)
 reserved2 0
Section
  sectname __pointers
   segname __DATA
      addr 0x000000010032fc28
      size 0x0000000000000008
    offset 3341352
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __const
   segname __DATA
      addr 0x000000010032fc30
      size 0x00000000000051d0
    offset 3341360
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_classlist
   segname __DATA
      addr 0x0000000100334e00
      size 0x00000000000002f8
    offset 3362304
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_nlclslist
   segname __DATA
      addr 0x00000001003350f8
      size 0x0000000000000008
    offset 3363064
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_catlist
   segname __DATA
      addr 0x0000000100335100
      size 0x0000000000000048
    offset 3363072
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_protolist
   segname __DATA
      addr 0x0000000100335148
      size 0x0000000000000158
    offset 3363144
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_imageinfo
   segname __DATA
      addr 0x00000001003352a0
      size 0x0000000000000008
    offset 3363488
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_const
   segname __DATA
      addr 0x00000001003352a8
      size 0x000000000002c718
    offset 3363496
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_selrefs
   segname __DATA
      addr 0x00000001003619c0
      size 0x0000000000004c70
    offset 3545536
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000005
 reserved1 0
 reserved2 0
Section
  sectname __objc_protorefs
   segname __DATA
      addr 0x0000000100366630
      size 0x0000000000000028
    offset 3565104
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_classrefs
   segname __DATA
      addr 0x0000000100366658
      size 0x0000000000000530
    offset 3565144
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_superrefs
   segname __DATA
      addr 0x0000000100366b88
      size 0x0000000000000218
    offset 3566472
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_data
   segname __DATA
      addr 0x0000000100366da0
      size 0x0000000000001e00
    offset 3567008
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_ivar
   segname __DATA
      addr 0x0000000100368ba0
      size 0x0000000000001888
    offset 3574688
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __cfstring
   segname __DATA
      addr 0x000000010036a428
      size 0x000000000000ff60
    offset 3580968
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __data
   segname __DATA
      addr 0x000000010037a390
      size 0x0000000000109c38
    offset 3646352
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __bss
   segname __DATA
      addr 0x0000000100483fd0
      size 0x000000000000a898
    offset 0
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000001
 reserved1 0
 reserved2 0
Section
  sectname __common
   segname __DATA
      addr 0x000000010048e868
      size 0x00000000000004a8
    offset 0
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000001
 reserved1 0
 reserved2 0
Load command 3
      cmd LC_SEGMENT_64
  cmdsize 72
  segname __LINKEDIT
   vmaddr 0x000000010048f000
   vmsize 0x000000000001b000
  fileoff 4734976
 filesize 108304
  maxprot 0x00000007
 initprot 0x00000001
   nsects 0
    flags 0x0
Load command 4
            cmd LC_DYLD_INFO_ONLY
        cmdsize 48
     rebase_off 4734976
    rebase_size 10256
       bind_off 4745232
      bind_size 6696
  weak_bind_off 4751928
 weak_bind_size 40
  lazy_bind_off 4751968
 lazy_bind_size 8056
     export_off 4760024
    export_size 28752
Load command 5
     cmd LC_SYMTAB
 cmdsize 24
  symoff 4788776
   nsyms 492
  stroff 4799444
 strsize 10680
Load command 6
            cmd LC_DYSYMTAB
        cmdsize 80
      ilocalsym 0
      nlocalsym 1
     iextdefsym 1
     nextdefsym 1
      iundefsym 2
      nundefsym 490
         tocoff 0
           ntoc 0
      modtaboff 0
        nmodtab 0
   extrefsymoff 0
    nextrefsyms 0
 indirectsymoff 4796648
  nindirectsyms 699
      extreloff 0
        nextrel 0
      locreloff 0
        nlocrel 0
Load command 7
          cmd LC_LOAD_DYLINKER
      cmdsize 32
         name /usr/lib/dyld (offset 12)
Load command 8
     cmd LC_UUID
 cmdsize 24
    uuid 1AF510C1-9C81-3DCA-9ADE-2B00ED53EF5F
Load command 9
      cmd LC_VERSION_MIN_MACOSX
  cmdsize 16
  version 10.7
      sdk 10.9
Load command 10
        cmd LC_UNIXTHREAD
    cmdsize 184
     flavor x86_THREAD_STATE64
      count x86_THREAD_STATE64_COUNT
   rax  0x0000000000000000 rbx 0x0000000000000000 rcx  0x0000000000000000
   rdx  0x0000000000000000 rdi 0x0000000000000000 rsi  0x0000000000000000
   rbp  0x0000000000000000 rsp 0x0000000000000000 r8   0x0000000000000000
    r9  0x0000000000000000 r10 0x0000000000000000 r11  0x0000000000000000
   r12  0x0000000000000000 r13 0x0000000000000000 r14  0x0000000000000000
   r15  0x0000000000000000 rip 0x0000000100001760
rflags  0x0000000000000000 cs  0x0000000000000000 fs   0x0000000000000000
    gs  0x0000000000000000
Load command 11
          cmd LC_LOAD_DYLIB
      cmdsize 88
         name @loader_path/../Frameworks/Sparkle.framework/Versions/A/Sparkle (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1.5.0
compatibility version 1.5.0
Load command 12
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name @rpath/libLLVM-3.4.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 0.0.0
compatibility version 0.0.0
Load command 13
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libexpat.1.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 7.2.0
compatibility version 7.0.0
Load command 14
          cmd LC_LOAD_DYLIB
      cmdsize 88
         name /System/Library/Frameworks/Python.framework/Versions/2.7/Python (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 2.7.5
compatibility version 2.7.0
Load command 15
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libncurses.5.4.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 5.4.0
compatibility version 5.4.0
Load command 16
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libSystem.B.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1197.1.1
compatibility version 1.0.0
Load command 17
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libcrypto.0.9.8.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 50.0.0
compatibility version 0.9.8
Load command 18
          cmd LC_LOAD_DYLIB
      cmdsize 48
         name /usr/lib/libc++.1.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 120.0.0
compatibility version 1.0.0
Load command 19
          cmd LC_LOAD_DYLIB
      cmdsize 48
         name /usr/lib/libz.1.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1.2.5
compatibility version 1.0.0
Load command 20
          cmd LC_LOAD_DYLIB
      cmdsize 96
         name /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1.8.0
compatibility version 1.2.0
Load command 21
          cmd LC_LOAD_DYLIB
      cmdsize 88
         name /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 275.0.0
compatibility version 1.0.0
Load command 22
          cmd LC_LOAD_DYLIB
      cmdsize 88
         name /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 20.0.0
compatibility version 1.0.0
Load command 23
          cmd LC_LOAD_DYLIB
      cmdsize 96
         name /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1056.13.0
compatibility version 300.0.0
Load command 24
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libobjc.A.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 228.0.0
compatibility version 1.0.0
Load command 25
          cmd LC_LOAD_DYLIB
      cmdsize 88
         name /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1265.19.0
compatibility version 45.0.0
Load command 26
          cmd LC_LOAD_DYLIB
      cmdsize 112
         name /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 48.0.0
compatibility version 1.0.0
Load command 27
          cmd LC_LOAD_DYLIB
      cmdsize 104
         name /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 59.0.0
compatibility version 1.0.0
Load command 28
          cmd LC_LOAD_DYLIB
      cmdsize 104
         name /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 855.14.0
compatibility version 150.0.0
Load command 29
          cmd LC_RPATH
      cmdsize 48
         path @executable_path/../Frameworks (offset 12)
Load command 30
      cmd LC_DATA_IN_CODE
  cmdsize 16
  dataoff 4788776
 datasize 0
Load command 31
      cmd LC_CODE_SIGNATURE
  cmdsize 16
  dataoff 4810128
 datasize 33152

Diassembling
Here is otool -tvV calculator output chunk

0000000100001760    lahf
0000000100001761    popq    %rcx
0000000100001763    rolb    $0xe2,0xc3c024ac(%rax)
000000010000176a    jne 0x1000016ef
000000010000176c    .byte 0x06 #bad opcode
000000010000176d    sbbb    %al,0x5b(%rsi)
0000000100001770    jle 0x10000178f
0000000100001772    xorl    %edi,0x30659afe(%rsi)
0000000100001778    fldenvq 0xc9e9c0e1(%r14)
000000010000177f    xorl    %esp,%esp
0000000100001781    xchgl   %esp,%eax
0000000100001782    xchgl   %esi,%eax
0000000100001783    wait/jrcxz  0x1000017ed
0000000100001786    stosl   %eax,(%edi)
0000000100001787    xchgl   %edi,%eax
0000000100001788    jbe 0x100001727
000000010000178a    stc
000000010000178b    jns 0x100001748
000000010000178d    xorl    %ecx,0x13(%rbx,%rbx,8)
0000000100001791    popq    %rax
0000000100001793    sbbl    $0xe9507796,%eax
0000000100001798    popq    %rbx
0000000100001799    incb    (%rbx)
000000010000179b    js  0x100001778
000000010000179e    addb    %ch,%bh
00000001000017a0    testl   0xe4(%rcx),%ebp
00000001000017a3    imull   $0xfe,0xf6(%rcx),%esp
00000001000017a7    clc
00000001000017a8    imull   $0x85bb1b76,0x65(%rdx),%ebp
00000001000017af    cld
00000001000017b0    testb   0xc9(%rax),%cl
00000001000017b3    loop    0x10000175d
00000001000017b5    andb    %ah,0x4c79a1ae(%rax)
00000001000017bb    orl 0x90da6a05(%rbp,%rdx),%esi
00000001000017c2    sbbb    %ch,%ch
00000001000017c4    jrcxz   0x100001780
00000001000017c6    xorb    $0x6c,%al
00000001000017c8    jne 0x1000017b9
00000001000017ca    orb %cl,0x13(%rcx,%rsi)
00000001000017ce    ficompl 0x7d4a8745(%rbp)
00000001000017d4    .byte 0x07 #bad opcode
00000001000017d5    mov %?6,(%rax)
00000001000017d7    insl
00000001000017d8    .byte 0xd4 #bad opcode
00000001000017d9    movb    %dl,%al
00000001000017db    .byte 0xdd, 0x2f #bad opcode
00000001000017dd    lcall   $0x76f5,$0xedc7f289
00000001000017e4    subb    $0xd3,%al
00000001000017e6    mull    0xa4(%rsi)
00000001000017e9    popf
00000001000017ea    inl $0xf4,%eax
00000001000017ec    adcl    $0x413fe92b,(%rdi)
00000001000017f2    sarl    $0x12,0xf5(%rcx)
00000001000017f6    addb    %dh,0xec(%rbx,%rcx)
00000001000017fa    movabsb 0x63ea27230d2c31f2,%r8d
0000000100001804    movl    $0x12d794f0,%ecx
0000000100001809    subb    $0x20,%al
000000010000180c    shll    %esi
000000010000180e    repz/falc
0000000100001810    movb    $0xd9,%dh
0000000100001812    outl    %eax,%dx
0000000100001813    loop    0x1000017ab
0000000100001815    movl    $0x781ecd57,%edi
000000010000181b    pushq   %rdi
000000010000181c    addb    $0x7e,%ah
000000010000181f    inl $0x40,%eax
0000000100001821    adcl    $0xd480505a,%eax
0000000100001826    cmpl    $0x28a6762d,%eax
000000010000182b    ljmpl   *0x36(%rdx,%rbx)
000000010000182f    .byte 0xce #bad opcode
0000000100001830    xchgl   %edx,%eax
0000000100001831    movabsl %eax,0x6d3cb9568b4b88a5
000000010000183a    subl    0xa8d980d9(%rbx,%rdi,8),%eax
0000000100001841    popq    %rdi
0000000100001842    pushq   $0x4c
0000000100001844    subb    $0x97,%al
0000000100001846    .byte 0x43, 0x82, 0x25 #bad opcode
0000000100001849    adcb    %ah,%ah
000000010000184b    testb   0x3141d9d1(%rbx),%ah
0000000100001851    sbbl    $0xc405e320,%eax
0000000100001856    xchgl   %ecx,%eax
0000000100001857    paddb   %mm2,%mm1
000000010000185a    xorl    %edi,%edi
000000010000185c    clc
000000010000185d    jmp 0x100001885
000000010000185f    xchgl   %esi,%eax
0000000100001860    wait/jae    0x1000018a8
0000000100001863    lret
0000000100001864    jb  0x1000018ae
0000000100001866    fisubrs (%rsi)
0000000100001869    lodsb   (%esi),%al
000000010000186a    pushq   %rsp
000000010000186b    .byte 0x27 #bad opcode
000000010000186c    lret
000000010000186d    cmpl    %eax,(%rdx)
000000010000186f    orb $0xa2,%al
0000000100001871    movl    $0xb2bf2631,%ebp
0000000100001876    sti
0000000100001877    movl    0x87b0df80(%rsp,%rcx,8),%ecx
000000010000187e    hlt
000000010000187f    inb $0x42,%al
0000000100001881    andl    %esi,%ebx
0000000100001883    adcl    %eax,0xa587d6ff(%rsi)
0000000100001889    movsll  %ch,%esp
000000010000188b    clc
000000010000188c    xchgl   %ecx,%eax
000000010000188d    sbbb    $0x82,%al
000000010000188f    cwtl
0000000100001890    movl    $0x673e9a73,%ebx
0000000100001895    movb    $0x18,%bl
0000000100001899    leal    0x87(%rax),%edi
000000010000189c    .byte 0x37 #bad opcode
000000010000189d    jns 0x10000187a
000000010000189f    .byte 0x06 #bad opcode
00000001000018a0    rolb    $0x44,(%rsp,%rax,4)
00000001000018a4    movsll  %cl,%edx
00000001000018a6    fiaddl  0xf4061e00(%rip)
00000001000018ac    jo  0x100001838
00000001000018ae    stosl   %eax,(%edi)
00000001000018af    adcb    0xac1ff7e3(%rcx),%dl
00000001000018b5    testl   $0x51d2321e,%eax
00000001000018ba    movl    $0x10cb41ba,%ebp
00000001000018bf    shrb    0xa724e9d8(%rdx)
00000001000018c5    fcompl  0x31(%rbp)
00000001000018c8    xorb    (%rdi,%rdx,4),%ch
00000001000018cb    leal    %eax,%eax
00000001000018cd    addb    %dh,%ah
00000001000018cf    movsl   (%esi),(%edi)
00000001000018d0    addb    0x64cc6bfb(%rcx),%bh
00000001000018d6    testl   0xb4f698f5(%r10),%esi
00000001000018dd    mov %esp,%?6
00000001000018df    pushf
00000001000018e0    popq    %rsi
00000001000018e1    jmp 0x83f231a4
00000001000018e6    .byte 0xd3, 0xf3 #bad opcode
00000001000018e8    orl %ebp,0xf1(%rdx)
00000001000018eb    movl    $0xf2f3e10c,0x35(%rdi,%rbx)
00000001000018f3    xchgl   %esi,%eax
00000001000018f4    sbbb    %r11d,%esp
00000001000018f7    movl    $0x30412d40,%eax
00000001000018fc    insl
00000001000018ff    popq    %rsi
0000000100001900    sahf
0000000100001901    popq    %rax
0000000100001902    jrcxz   0x10000197c
0000000100001904    andl    0x758d6d0d(%rsi),%ecx
000000010000190a    movb    $0x89,%ch
000000010000190c    fistpq  0xa5(%rsi)
000000010000190f    .byte 0x62 #bad opcode
0000000100001910    sahf
0000000100001911    loop    0x10000193b
0000000100001913    jg  0x100001908
0000000100001915    cmpsl   (%esi),(%edi)
0000000100001916    movsl   (%esi),(%edi)
0000000100001917    iret
0000000100001918    scasl   %eax,(%edi)
0000000100001919    .byte 0x0e #bad opcode
000000010000191a    xorb    %cl,(%rcx)
000000010000191c    stosb   %al,(%edi)
000000010000191d    andb    $0x9b,%al
000000010000191f    cmpl    $0x72a850c7,0xbdced867(%rax,2)
000000010000192a    jae 0x1000018c0
000000010000192c    .byte 0xd3, 0xf6 #bad opcode
000000010000192e    lcall   $0x608c,$0x851d69e3
0000000100001935    .byte 0x62 #bad opcode
0000000100001936    xchgl   %ecx,%eax
0000000100001937    cmpb    %ah,%cs:%cl
000000010000193a    movsb   (%esi),(%edi)
000000010000193b    subb    $0xc7,%al
000000010000193d    outl    %eax,$0x05
000000010000193f    je  0x100001999
0000000100001941    inl $%cs:0x7d,%eax
0000000100001944    sbbl    %ebp,0x7c5ec982(%rdx)
000000010000194a    movsl   (%esi),(%edi)
000000010000194b    xchgl   %ecx,%eax
000000010000194c    movl    $0x1393211e,%ecx
0000000100001951    .byte 0x27 #bad opcode
0000000100001952    cmpsl   (%esi),(%edi)
0000000100001953    xchgl   %esp,%eax
0000000100001954    .byte 0x1f #bad opcode
0000000100001955    addl    $0x6ed2f22b,%eax
000000010000195a    insb
000000010000195b    .byte 0x67, 0xd5 #bad opcode
000000010000195d    cmpl    (%rdi),%edi
000000010000195f    popq    %rbp
0000000100001960    ret
0000000100001961    addl    $0x961d3d82,%eax
0000000100001966    ret
0000000100001967    jle 0x100001938
0000000100001969    .byte 0x1e #bad opcode
000000010000196a    loop    0x100001936
000000010000196c    movsl   (%esi),(%edi)
000000010000196d    andb    $0xfc,(%rax)
0000000100001970    xchgl   %ecx,%eax
0000000100001971    pushf
0000000100001972    movb    $0xb0,%ah
0000000100001974    popq    %rbp
0000000100001975    lahf
0000000100001976    sbbl    $0x9605ee9d,%eax
000000010000197b    incb    %bh
000000010000197d    cmpl    (%rcx),%ecx
000000010000197f    testb   0x90(%rsp,%rsi,8),%ecx
0000000100001985    repz/int    $0x3
0000000100001987    .byte 0x4c, 0x2f #bad opcode
0000000100001989    ljmp    $0x072a,$0x233e8063
0000000100001990    leave
0000000100001991    orb %al,(%rdx)
0000000100001993    andl    (%rcx),%ebp
0000000100001995    ljmpl   *(%rbx)
0000000100001997    shlb    0x26(%rdi)
000000010000199a    movl    $0x592a9d36,%esp

LLVM disassembler fails with output

(__TEXT,__text) section
Segmentation fault: 11

Injecting via cycript

I have tried cycript to dump image and patch it back via dd tool, but seems this trick doesn't work and binary gets corrupted.

Debuggers

gdb/lldb can't attach/start the process, as it's uses pt_deny_atach/sysctl/kauth anti-debugging techniques.

I have also tried to patch osx kernel (as the assembly is not available and I can't nop out that calls) - to ignore anti-debugging calls, but after this process doesn't event start, just hangs up (But other application like Github, iTunes are starting without any problem, seems it has anti-anti-anti debugging protection :)).

Can you please advise some extra technique (or suggestion what I can try) to get the plain assembly?

  • You might find onyx the black cat useful. It's a kernel extension that disable some features like PT_DENY_ATTACH – toasted_flakes Jul 19 '14 at 15:18
  • @toasted_flakes I tried it, but when onyx is on, target hangs up, and doesn't even run(only hangs up) – l0gg3r Jul 20 '14 at 14:33
  • Trying to crack Hopper? Eh eh eh eh eh You need to be a bit smarter, it requires extra work ;-) – fG- Jul 23 '14 at 12:48
  • @fG- can you please advise me way, to continue working? or some technique to start learning. – l0gg3r Jul 23 '14 at 13:01
  • @fG-: how did you figure the OP is trying to reverse engineer Hopper? Anyway, if is, in 2016 a quick search in google will reveal youtube.com/watch?v=pCITcLqgS9Q. Now, during the first 20mins, cigoL actually mentions a couple of techniques (MachOView, DyLD OpCode/Action view, lldb with br on sysctl, and so on) to tackle some of the difficulties raised by the OP, but as you mentioned, it requires extra work :). – Moreaki Dec 26 '16 at 22:57

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.