Questions tagged [macos]
The macos tag has no usage guidance.
36
questions
0
votes
0
answers
22
views
Tracking where an DITL resource is called within a 68k program
Okay, so I'm a super noob at reverse-engineering and know next to nothing about 68k assembly code. I'm running an emulated version of MacOS 9.0.4, using a program called Resorcerer 2.4.1 to examine my ...
- 1
0
votes
0
answers
28
views
Serializing and Deserializing XPC objects (xpc_object_t)
As the title suggests, I am interested in serializing/deserializing xpc_object_t type objects. Unfortunately, there does not seem to be an official or private API that supports this in a robust ...
- 11
1
vote
0
answers
28
views
Differences between Mach Services and XPC Services in macOS Sandbox Profiles
I am trying to learn more about IPC implementations (mach/xpc) and how corresponding services are managed using sandbox profiles on macOS.
After looking at many different profiles, I have learned that ...
- 11
0
votes
1
answer
73
views
How can I reverse engineer a self-contained dotnet executable on MacOS?
For a challenge at OWASP WrongSecrets I have build a self-contained binary to be reverse engineered (see https://github.com/OWASP/wrongsecrets-binaries/actions/runs/8244751569), but, I have not been ...
- 101
0
votes
0
answers
28
views
PowerPC Macintosh code injection
I'm reverse engineering a game for the old PowerPC MacOS 9 pc via the static analysis in IDA Pro windows but I want to inject code during runtime(for example via the dynamic library) in an emulator ...
- 33
1
vote
1
answer
459
views
How to extract kext's from kernelcache?
I want to play with reverse engineering the Apple Neural Engine driver, which is a kernel extensions (com.apple.driver.AppleH11ANEInterface). These used to be in /System/Library/Extensions/, but on my ...
- 111
0
votes
0
answers
113
views
Reverse engineering Objective-C blocks
I'm highly experienced with objective-c reverse engineering, but every time I encounter a block representation in the decompiler, right before it is passed as an argument to a function, I can ...
1
vote
1
answer
139
views
Strange entry point for an old Mac OS X x86 32 bit binary
I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
- 11
2
votes
1
answer
335
views
MachO chained fixups parsing
I'm wondering how the info stored in the chained fixups in the Mach-O file is used to resolve binding and rebases?
My question originated from wanting to parse all the Objective-C classes inside a ...
- 185
0
votes
1
answer
278
views
Extracting obj-c class list from a machO
I'm trying to analyze and get the full list of selectors and their related classes in objective-c by first reading the __objc_classlist section and getting pointers to the struct objc_class list to ...
- 185
1
vote
0
answers
169
views
How to reverse engineer a USB sump pump controller that is not designed to connect to a computer
I have a sump pump monitor / controller that is USB-enabled. The USB port on the side is designed to hook to a WiFi module or a once-promised, now-canceled, never-produced Z-wave module (which is what ...
- 111
4
votes
0
answers
566
views
How to do live debugging of ARM64 binaries on macOS with M1/M2 chips?
I'm trying to figure out why NSSavePanel fails in my SwiftUI app. I tried every possible documentation, or asking on the Swift programming forums - to no avail.
I'm originally a Windows programmer, ...
- 1,751
4
votes
0
answers
457
views
Ghidra not loading classes and types of external library
I'm analyzing a mac OS framework, and while redefining types in the decompilation view,
I wish to define one of the types as a type defined as NSData class which is defined inside CoureFoundation ...
- 185
1
vote
0
answers
88
views
Patched Mac application throws "Invalid value of (null) for entitlement" when running it
I have patched a specific application that I downloaded from the app store but when I ran the executable, it gave me a signal kill 9. I also reverted back the change I made, but the same error was ...
2
votes
0
answers
214
views
Hopper Disassembler AArch64 assemble instruction syntax error
As the screenshot shown above, I attempt to change cbz to cbnz, hopper gives me "syntax error".
At this moment I can only change it by editing the instruction encoding in hex view as a ...
- 121
2
votes
0
answers
79
views
Attempting to understand non-XZ file signatures within PBZX chunks
After my previous question from nearly a year ago directing me to the YAA format to make sense of the chunks that could be decompressed, this time we're dealing with the chunks that made pbzx tell us ...
1
vote
1
answer
175
views
Kernel debug two physical MacBook pro devices
I've asked the same question at stackoverflow, but i'm gonna copy-paste it here as i might get more relevant answers(?):
I'm trying to kernel debug a physical Macbook pro device.
When my setup ...
- 668
1
vote
1
answer
258
views
macOS under M1, cannot find library
I'm looking for the following dylib file which is included from process loginwindow.
If I run vmmap to inspect loginwindow while it's up and running I get :
user@mycomp / % sudo vmmap -I ``pgrep ...
- 293
1
vote
1
answer
155
views
Inbound network queries not appearing in developer tools of browser
When trying to understand the behavior of web apps, I find myself stumbling against the fact that some network messages do not appear on the network tab of the web developer tool of the browser. For ...
- 111
2
votes
1
answer
965
views
How to fix an extracted dyld from dyld_shared_cache_x86_64?
As part of challenging my self I was trying to run a program that doesn't exist on Catlina taken from Big Sur.
I had to extract the dylibs from the shared cache by using this tool.
The library called ...
- 120
3
votes
2
answers
357
views
Extract closed format metadata from audio file
I am writing an app to analyze .wav audio files and extract metadata. The way the metadata works for RIFF based files is shown in this picture:
You need to have "format" and "data&...
- 33
-2
votes
1
answer
863
views
How to fix Mach-O segment section to deobfuscate the binary
When reversing a Mach-O crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments.
Loading file 'target' into database...
...
- 47
5
votes
3
answers
12k
views
GDB hangs when I try to run and debug a binary
When I type gdb a.out and then run inside the gdb itself I get stuck on the empty line:
jericho-laptop:exploit.education jericho$ gdb a.out
GNU gdb (GDB) 9.1
...
Reading symbols from a.out...
(No ...
- 321
1
vote
1
answer
564
views
Not able to find Hard coded strings in the mac executable file
I know that there is a string called "Activate your subscription" used in this particular app. But Im not able to find this string from its executable. I tried strings myapp and also searched for same ...
- 145
9
votes
2
answers
15k
views
OTOOL alternative for linux
I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine.
Currently on Mac, ...
- 243
3
votes
2
answers
3k
views
(MacOS) disable codesign check / run codesign on multiple files
so I have two questions, I'll try to keep it short (also, im a noob):
I run logic pro x and other software to make music, and some third party plugins make program crash if they get a:
Exception ...
- 41
5
votes
1
answer
767
views
Import symbols containing strange characters
I am analyzing a macOS app with radare2, and the app depends on a number of Qt frameworks. When I printed out the import symbols of the app's main executable, the names of the frameworks' functions ...
- 161
4
votes
2
answers
3k
views
How to use Hopper Debugger Server
I am assuming that Hopper Debugger Server is meant to allow you to remotely debug an potentially malicious app. For example, I would like to debug an app that is running on a VM or on a separate ...
- 183
5
votes
2
answers
662
views
IDA Pro: "File is apple protected"
I'm trying to disassemble Dock.app on macOS Sierra, and IDA is giving me this error message:
What does this mean?
- 223
1
vote
1
answer
123
views
OSX User level application Preferences (plist) are not loaded after binary modification
I am working on a project that requires to modify an existing OSX application's dylib binary (few bytes to correct an obsolete URL). I do not have access to the application source code nor the code ...
- 133
4
votes
2
answers
2k
views
Why are there absolute jmps in disassembly of position independent code?
I'm playing around with Hopper and am looking at the disassembly of a binary that otool reports as having the PIE flag.
It's my understanding that as a result, the executable base address will be ...
- 143
2
votes
0
answers
521
views
IDA Pro macOS kernel debugging and lldb support
I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can ...
0
votes
1
answer
198
views
What does the M68k $FBE6 instruction do on a classic Mac?
I have a classic Mac OS executable where control is given to an instruction whose hex encoding is $FBE6. I have been unable to find documentation for this F-line instruction, and it doesn't appear to ...
- 1,080
1
vote
1
answer
124
views
Is there a static address to a pointer on Mac OS?
Given the sample code below:
#include <iostream>
struct Data {
int a;
int b;
int c;
};
int main() {
Data *d = new Data;
d->a = 1337;
d->b = 1338;
d->c = ...
8
votes
1
answer
1k
views
Reverse engineering the PluginKit MacOS framework
I've been tasked with an assignment requiring a thorough reverse engineering effort on the PluginKit framework in modern Mac operating system, and I'm looking for information to start off, instead of ...
- 11.8k
19
votes
6
answers
26k
views
What is a free & open source alternative to IDA Pro for MacOS?
I am looking for a free & open source alternative to IDA Pro runs on MacOS - the suggestions should have as close to the features of IDA as possible. I should also be able to edit an executable ...
user20964