Questions tagged [macos]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
20 views

Where is the Google Chrome History Stored in Time Machine Backups on Mac?

If I have a Time Machine backup of a Mac, where do I go within that backup to find the files(s) containing the Google Chrome browser history? Thank you, James Pedersen
user avatar
0 votes
0 answers
45 views

Is there a way to open .storyboardc and .nib files without Xcode?

I am actually reverse engineering an iOS app, and I want to open .storyboardc and .nib files, but without Xcode because I have big issues with it (it's not the subject). I tried https://apps.apple.com/...
user avatar
  • 1
1 vote
0 answers
43 views

Hopper Disassembler AArch64 assemble instruction syntax error

As the screenshot shown above, I attempt to change cbz to cbnz, hopper gives me "syntax error". At this moment I can only change it by editing the instruction encoding in hex view as a ...
user avatar
0 votes
0 answers
14 views

"Rejecting invalid page" error when using patched private framework binary

The background is - I got tired of my bluetooth headset button opening Apple Music and wanted it to do something useful instead. After some investigation I concluded that on button click a message is ...
user avatar
0 votes
0 answers
57 views

How to extract SSL pre-master key from Mac app?

I would like to analyse the traffic generated by one of the apps that I use. This .app contains an OpenSSL 1.1.0 dylib in its Frameworks folder. I would like to extract the pre-master keys using the ...
user avatar
2 votes
0 answers
45 views

Attempting to understand non-XZ file signatures within PBZX chunks

After my previous question from nearly a year ago directing me to the YAA format to make sense of the chunks that could be decompressed, this time we're dealing with the chunks that made pbzx tell us ...
user avatar
1 vote
1 answer
69 views

Kernel debug two physical MacBook pro devices

I've asked the same question at stackoverflow, but i'm gonna copy-paste it here as i might get more relevant answers(?): I'm trying to kernel debug a physical Macbook pro device. When my setup ...
user avatar
  • 638
1 vote
1 answer
92 views

macOS under M1, cannot find library

I'm looking for the following dylib file which is included from process loginwindow. If I run vmmap to inspect loginwindow while it's up and running I get : user@mycomp / % sudo vmmap -I ``pgrep ...
user avatar
  • 273
1 vote
1 answer
49 views

Inbound network queries not appearing in developer tools of browser

When trying to understand the behavior of web apps, I find myself stumbling against the fact that some network messages do not appear on the network tab of the web developer tool of the browser. For ...
user avatar
  • 111
0 votes
1 answer
482 views

How to fix an extracted dyld from dyld_shared_cache_x86_64?

As part of challenging my self I was trying to run a program that doesn't exist on Catlina taken from Big Sur. I had to extract the dylibs from the shared cache by using this tool. The library called ...
user avatar
3 votes
2 answers
202 views

Extract closed format metadata from audio file

I am writing an app to analyze .wav audio files and extract metadata. The way the metadata works for RIFF based files is shown in this picture: You need to have "format" and "data&...
user avatar
-2 votes
1 answer
479 views

How to fix Mach-O segment section to deobfuscate the binary

When reversing a Mach-O crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments. Loading file 'target' into database... ...
user avatar
3 votes
3 answers
8k views

GDB hangs when I try to run and debug a binary

When I type gdb a.out and then run inside the gdb itself I get stuck on the empty line: jericho-laptop:exploit.education jericho$ gdb a.out GNU gdb (GDB) 9.1 ... Reading symbols from a.out... (No ...
user avatar
1 vote
1 answer
406 views

Not able to find Hard coded strings in the mac executable file

I know that there is a string called "Activate your subscription" used in this particular app. But Im not able to find this string from its executable. I tried strings myapp and also searched for same ...
user avatar
5 votes
2 answers
8k views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
user avatar
3 votes
2 answers
2k views

(MacOS) disable codesign check / run codesign on multiple files

so I have two questions, I'll try to keep it short (also, im a noob): I run logic pro x and other software to make music, and some third party plugins make program crash if they get a: Exception ...
user avatar
  • 41
5 votes
1 answer
665 views

Import symbols containing strange characters

I am analyzing a macOS app with radare2, and the app depends on a number of Qt frameworks. When I printed out the import symbols of the app's main executable, the names of the frameworks' functions ...
user avatar
  • 161
3 votes
2 answers
2k views

How to use Hopper Debugger Server

I am assuming that Hopper Debugger Server is meant to allow you to remotely debug an potentially malicious app. For example, I would like to debug an app that is running on a VM or on a separate ...
user avatar
  • 63
4 votes
2 answers
547 views

IDA Pro: "File is apple protected"

I'm trying to disassemble Dock.app on macOS Sierra, and IDA is giving me this error message: What does this mean?
user avatar
  • 213
1 vote
1 answer
95 views

OSX User level application Preferences (plist) are not loaded after binary modification

I am working on a project that requires to modify an existing OSX application's dylib binary (few bytes to correct an obsolete URL). I do not have access to the application source code nor the code ...
user avatar
4 votes
2 answers
2k views

Why are there absolute jmps in disassembly of position independent code?

I'm playing around with Hopper and am looking at the disassembly of a binary that otool reports as having the PIE flag. It's my understanding that as a result, the executable base address will be ...
user avatar
2 votes
0 answers
432 views

IDA Pro macOS kernel debugging and lldb support

I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can ...
user avatar
0 votes
1 answer
144 views

What does the M68k $FBE6 instruction do on a classic Mac?

I have a classic Mac OS executable where control is given to an instruction whose hex encoding is $FBE6. I have been unable to find documentation for this F-line instruction, and it doesn't appear to ...
user avatar
1 vote
1 answer
82 views

Is there a static address to a pointer on Mac OS?

Given the sample code below: #include <iostream> struct Data { int a; int b; int c; }; int main() { Data *d = new Data; d->a = 1337; d->b = 1338; d->c = ...
user avatar
7 votes
1 answer
1k views

Reverse engineering the PluginKit MacOS framework

I've been tasked with an assignment requiring a thorough reverse engineering effort on the PluginKit framework in modern Mac operating system, and I'm looking for information to start off, instead of ...
user avatar
  • 11.3k
15 votes
6 answers
19k views

What is a free & open source alternative to IDA Pro for MacOS?

I am looking for a free & open source alternative to IDA Pro runs on MacOS - the suggestions should have as close to the features of IDA as possible. I should also be able to edit an executable ...
user avatar