Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mach-o]

the Mach object file format is the standard executable format in iOS, Mac OS X, NeXTSTEP.

1
vote
1answer
80 views

When I write into a memory address in gdb, is it an absolute address or PC-relative address?

Recently I tried to use Hopper Disassembler to do the reverse engineering on a Mac application. After decompiling the executable file, I got a bunch of cstrings defined in the specific location. For ...
4
votes
2answers
1k views

Why are there absolute jmps in disassembly of position independent code?

I'm playing around with Hopper and am looking at the disassembly of a binary that otool reports as having the PIE flag. It's my understanding that as a result, the executable base address will be ...
1
vote
1answer
48 views

Powermac gdbserver wrapper/How to attach IDA to powermac application?

How do I debug a powermac application using gdbserver provided there is no gdbserver I've tried compiling various version of gdb found in apple opensource -specifically the gdbserver part but it ...
5
votes
5answers
4k views

What is a free & open source alternative to IDA Pro for MacOS?

I am looking for a free & open source alternative to IDA Pro runs on MacOS - the suggestions should have as close to the features of IDA as possible. I should also be able to edit an executable ...
5
votes
1answer
739 views

getting function address by reading ADRP and ADD instruction values

Hello reverse engineers, I'm analysing a fat Macho-O binary, and it has an ADRP and an ADD instruction in it. I'm talking about these instructions: __text:00000001002E050C ADRP ...
1
vote
1answer
142 views

iOS Position-independent code and relocations

I'm reversing few iOS Mach-O application executables these days and all of them use Position-independent code (PIC; the MH_PIC flag is set). I've been expecting a large number of relocation entries (...
1
vote
1answer
244 views

Mach-O : Convert virtual address to file offset on disk

Hello reverse engineers, I am reverse engineering a Mach-O executable for iOS. File says: Mach-O universal binary with 2 architectures: [arm_v7: Mach-O arm_v7 executable] [64-bit architecture=12]. I ...
1
vote
2answers
255 views

Why do I get different addresses for the printf function when I disassemble with otool?

I'm using otool on macOS to disassemble some simple C programs I built in order to gain a better understanding of assembly language. I disassembled three programs, all of which consist of a single ...
3
votes
1answer
129 views

No LC_UNIXTHREAD segment in iOS application Mach-O

I'm analyzing load commands section of executable Mach-O file in iOS 9.3.3, Twitter app is used for ilustration. # otool -hV Twitter Twitter: Mach header magic cputype cpusubtype caps ...
3
votes
1answer
3k views

Remove code signature from a Mac binary

How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards? Needless to say, I'm not the original creator of the binary, nor I have the ...
0
votes
1answer
93 views

Order of architecture headers in fat (universal) executables

I'm working on a reverse engineering project with fat executables on OS X. So far I have established the structure of the fat_header, fat_arch and macho_header, but am having trouble finding ...
0
votes
1answer
278 views

Mach-O functions pointer

I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
4
votes
2answers
2k views

Method disassembly of Objective C Mach-O with Radare 2

Is is possible to retrieve the dissassembly of Objective-C methods declared in Mach-O files using Radare 2 ?
8
votes
1answer
955 views

Retrieving Objective-C Control Flow?

I am learning to disassemble and analyze objective-c binaries. One of my frustrations is that in Hopper, and IDA, it seems that the proper cross-references and control flow are not preserved. I ...
3
votes
2answers
706 views

Patching a Mach-O Binary Header to remove a LC_SEGMENT

i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection. more information here under point 3. of preventing dyld injection....
6
votes
2answers
3k views

In a Mach-O executable, how can I find which function a stub targets?

Before exposing my problem, here's my understanding of the whole thing, so that you may correct me if I'm saying something wrong. In a Mach-O file (at least on x86), the __TEXT.__stubs section ...
1
vote
3answers
592 views

Can one modify a program by “wrapping” its binary? What tools exist?

(This question is related to How do I add functionality to an existing binary executable?). I too would like to add functionality to an existing application, but I do not want to modify the original ...
1
vote
0answers
162 views

Merging static library into mach-o executable

I got a mach-o executable and a static library that has a few __attribute__((constructor)) functions. Is there a (least painful) way to merge the static library into the mach-o executable ?
3
votes
1answer
811 views

Interacting with command line programs in Hopper disassembler (Mac OS 10.9)

To test the debugging capabilities of Hopper, I wrote a simple C++ command line application, and tried to run it on the remote debugging server (with gdb). However, I learned after I failed to be able ...
3
votes
0answers
2k views

Unpacking and disassembling mach-o binary

I am trying to reverse an OSX mach-o binary, Disassembling gives me a bullshit, seems its encrypted with some packer. I need to determine the encryption algorithm, and decrypt the binary. Load ...
1
vote
1answer
595 views

Editing a Mach-O x86_64 binary with 0xED results in a app crash

I created a simple Cocoa app (Mac 64bit) in Xcode, and in it I created a string object, and then outputted the contents of the string in a NSLog statement. Then I decided to see if I could modify the ...
2
votes
2answers
852 views

Reversing a Mac OS X binary that appears to be non encrypted, backtrace just shows mach_msg_trap ()

Currently I have a binary that I am investigating. The application is GUI / event driven, so that makes it difficult to set a break point. I would like to set a break point on a certain button click,...
11
votes
2answers
2k views

Encrypted Mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors: when I load this binary into GDB and try to disassemble the code at the address ...
5
votes
1answer
216 views

Strange GDB behavior in OSX

I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...
5
votes
1answer
3k views

Printing Unicode strings in Gdb in OSX

Are there any useful snippets or Gdb functions that you guys normally use to print out Unicode strings? I'm trying to debug Mach-O binaries and x/s seems to be printing out junk. I believe the default ...