2

I have a packed executable. To take care of the unpacking, I would like to extract the in-memory version of the process, which would ideally be rolled back into the equivalent Mach-O binary -- such that it can be viewed in a disassembler -- I do not need the unpacked file to be runnable.

A Windows version of the same program exists, and it is also packed. Utilities such as PE Tool make this task simple: you select the process, then the module, and then you have an unpacked binary.

I am not able find any applications that can do this on the OS X side. I can imagine two broad approaches with runtime in mind:

  • the automatic way PE Tool can generate a binary when given a process and a module

  • attempting to roll a generic memory dump into the correct Mach-O file of the program's main module

I would appreciate any advice on either of these points. I have an OS X environment at my disposal though I am not familiar with it.

Advice relating to solving this problem through static analysis would also be appreciated

2

You can get some ideas from the dumpdecrypted tool by Stefan Esser. It's for iPhone but shouldn't be too difficult to port to OS X.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.