Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [osx]

An Unix-based operating system originally forked from NextSTEP and developed by Apple Inc. MacOS X runs a Darwin kernel together with Apple Inc. utilities.

0
votes
0answers
34 views

IDA Pro debugging on OS X

Is there some trick to getting debugging working on OS X with IDA? I've tried a number of different approaches, and a number of different apps, but no matter what I do, either I get SIGNINTs or ...
0
votes
1answer
35 views

OSX User level application Preferences (plist) are not loaded after binary modification

I am working on a project that requires to modify an existing OSX application's dylib binary (few bytes to correct an obsolete URL). I do not have access to the application source code nor the code ...
2
votes
1answer
139 views

Changing parameters in an OS X executable

very new here so please bear with me. I'm an artist trying to realise an idea for a camera that takes photos every X interval during a month. Everything works, except that the app with which I ...
4
votes
2answers
1k views

Why are there absolute jmps in disassembly of position independent code?

I'm playing around with Hopper and am looking at the disassembly of a binary that otool reports as having the PIE flag. It's my understanding that as a result, the executable base address will be ...
1
vote
1answer
147 views

Objective-C disassembling - I dont understand this code

I assembled a simple objective-c file that prints hello to the screen. this is the code: #import <Foundation/Foundation.h> int main() { NSString* a = [NSString stringWithUTF8String: "hi"]; ...
2
votes
0answers
128 views

POC for appleScript injection method

I am trying to make a POC of code injection using applescript injection technic which is used in GitHub project EasySIMBL. The method also described here. (It's basically a huge article, just search ...
6
votes
1answer
404 views

Reverse engineering the PluginKit MacOS framework

I've been tasked with an assignment requiring a thorough reverse engineering effort on the PluginKit framework in modern Mac operating system, and I'm looking for information to start off, instead of ...
0
votes
1answer
53 views

Changing NSUserDefaults of a mac or iOS binary executable

I have an executable of a mac or ios app. This app uses a value stored for a key in NSUserDefaults to change app's flow. It looks something like below code, If( value set in user details ) ...
0
votes
0answers
166 views

Removing code signature from Mac binary executable using objective c

How to remove code signature from a mac binary executable using objective C. I came across this question here. It shows a way to remove code signature of mac binary executable using terminal but I'm ...
1
vote
0answers
528 views

Calling Swift 4 methods from C

I have earlier been able to call Swift methods using a function pointer from C, and providing the appropriate arguments because the calling convention was the same. Unfortunately this no longer works....
1
vote
1answer
383 views

Creating a patcher for a mac app

I have a signed mac app and I don't have the source code of the app. I know address locations of some assembly instructions which I need to change so as to make this app to work in certain way. So I'm ...
0
votes
1answer
112 views

whats the purpose of this code snippet?

I'm using at&t ordering I came across this a little while ago and while i understand why we want to push a stack frame when we call a new routine I don't see why it was done here: (for the ...
1
vote
1answer
500 views

How do I denote and use JMP /5 in byte code

I'm on the OSX platform working with x86_64. I've worked out how to do near jumps with the E9 byte code directive where my relative addresses have 4 bytes (teamed up with RIP) Now I have an instance ...
0
votes
1answer
754 views

Is there an up to date fork of otx?

otx is a tool used to disassemble Mach-O binaries on OS X 10.0-10.4. It is an enhancement on top of otool to add additional symbol information to its disassembled output. The main site and SVN ...
2
votes
1answer
1k views

MacOS: Output to console in non-console app

I'm working with a program that I can't reasonably run from console; it is started by another program with complex calculated and network-gotten arguments, and that program is complicated as well. To ...
1
vote
1answer
85 views

Extract an image out of a application and customize after edited

I was wondering if you guys could help me.I have an application for OSX it is called Traktor..I want to extract an image of a vinyl and edit it than reassign it back to the application... I want to ...
3
votes
1answer
3k views

Remove code signature from a Mac binary

How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards? Needless to say, I'm not the original creator of the binary, nor I have the ...
0
votes
1answer
93 views

Order of architecture headers in fat (universal) executables

I'm working on a reverse engineering project with fat executables on OS X. So far I have established the structure of the fat_header, fat_arch and macho_header, but am having trouble finding ...
3
votes
0answers
203 views

When I start up a remote thread in an application, why does it always crash when it tries to access data in the thread structure?

I'm on OS X 10.10 64 bit (x86_64) and created a chunk of memory called code with vm_allocate. I allocate a chunk of memory for a stack. I load a library to memory and determine an entry point to ...
8
votes
2answers
10k views

Decrypting IPA Binary on OS X

I've been reading this PDF on reverse-engineering iOS applications and have reached slide 39, decrypting the binary. However, I've been attempting to disassemble and explore the binary in OS X 10.9.5 ...
1
vote
0answers
315 views

Patching Application on OSX (Memory Protection)

I'm patching an executable on OSX. So far I know the patches have been applied successfully. Steps taken (via LLDB): lldb /users/Brandon/Desktop/Test.app/Contents/MacOS/Test b start run br del 1 ...
1
vote
1answer
577 views

Reverse engineering a PXP3 Slimstation

I've been given a PXP3 Slimstation. It's a mysterious undocumented portable games console, running 16bit Sega Genesis games. It has a mini USB connector on it. I'd like to try to find out more about ...
1
vote
2answers
400 views

Load symbols from __objc_* sections in LLDB

When an executable that has been stripped is opened in lldb, lldb doesn't know the names of any functions and breakpoints have to be set manually on hex addresses, which is very annoying. However, ...
5
votes
1answer
671 views

Are Reverse Debuggers Impossible on OSX?

I have been impressed with the reverse debugging (that is stepping back in time through a program) capabilities in GDB and tools like QIRA, but I am a little confused as to why no such program exists ...
3
votes
1answer
813 views

How to find the entry point in LLDB on OS X?

How can I identify the entry point of an executable in LLDB? In GDB, we can use the info file command, but that won't work in LLDB. Can anyone show me how to do that?
1
vote
0answers
449 views

Why darwin kernel crashes on function call via lldb while debugging the process?

I wanted to debug the hanging ruby process, but instead my kernel crashes each time when I'm doing the following steps: I'm re-running my ruby script (vagrant) which hangs: $ vagrant destroy -f &...
1
vote
1answer
365 views

lldb - breakpoint not reached when attach do process (but executing when set before app running)

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all ...
5
votes
1answer
2k views

How to read NSCR1000 data files?

Terminal app on OSX stores the information about its windows and content in its state files in Library/Saved Application State/com.apple.Terminal.savedState. I did the backup of the file before the ...
1
vote
0answers
340 views

Connecting to mac_server with IDA Pro on Windows

I can't get IDA to connect with a debugging server on OS X. This is what keeps happening: $ ll ~/.bin/mac_server* -rwxr-sr-x 1 Ron procmod 657K May 5 22:29 mac_server* -rwxr-sr-x 1 Ron procmod ...
2
votes
1answer
828 views

How could using QEMU be useful in developing a driver for Linux?

Presently, I am trying to analyze a piece of hardware, to be specific the Broadcom 1570 PCI web cam inside a late MBPr 2013. I can pass through the device using QEMU, and have the gusest OS / VM ...
6
votes
2answers
995 views

Unknown Mac OSX 10.10 HFS+ compression

I'm trying to decompress a Mach-O binary which has been compressed using one of the compression algorithms in Mac 10.10's HFS+ implementation. Basically the file has the "com.apple.decmpfs" attribute ...
4
votes
1answer
1k views

What are some methods to reversing a .kext?

I recently discovered there is no native Linux driver for the Web Cam in my computer. However, there is a person who has taking the initiative to start a github project for a driver. That being said,...
6
votes
2answers
3k views

In a Mach-O executable, how can I find which function a stub targets?

Before exposing my problem, here's my understanding of the whole thing, so that you may correct me if I'm saying something wrong. In a Mach-O file (at least on x86), the __TEXT.__stubs section ...
1
vote
3answers
592 views

Can one modify a program by “wrapping” its binary? What tools exist?

(This question is related to How do I add functionality to an existing binary executable?). I too would like to add functionality to an existing application, but I do not want to modify the original ...
3
votes
2answers
1k views

lldb: break at start of actual code, not entrypoint

I want lldb to break at the start of the actual code of an OS X application (which might be called main if symbols are existing). I am currently looking this up by hand, but as I want to script some ...
0
votes
1answer
310 views

Why are there often many 0-bytes in executables?

I disassembled some OS X apps with Hopper and found that all of them contain a lot of zero bytes in a row. What is the use of that? Is this some OS X ABI specific padding I came across here? What is ...
2
votes
1answer
259 views

Generate Mach-O binary from running process

I have a packed executable. To take care of the unpacking, I would like to extract the in-memory version of the process, which would ideally be rolled back into the equivalent Mach-O binary -- such ...
1
vote
0answers
54 views

Basic Concept misunderstood? [duplicate]

First of all, it may be that I am just not getting how things work. Stultus sum. I am using a Mac with OSX (10.9), therefore with x86_64 architecture. I wanted to play around a bit with compilers ...
1
vote
1answer
417 views

OSX where does getconf read its value

I'm not experienced at reverse engineering at all. I hope this basic question is suitable for this site. Basically I want to know where the value DARWIN_USER_CACHE_DIR is read from. I'm trying to ...
10
votes
1answer
2k views

Extract non-extractable private key from OS X Keychain

I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4. Basically, it appears that security import has a -x option to ...
3
votes
0answers
2k views

Unpacking and disassembling mach-o binary

I am trying to reverse an OSX mach-o binary, Disassembling gives me a bullshit, seems its encrypted with some packer. I need to determine the encryption algorithm, and decrypt the binary. Load ...
2
votes
2answers
598 views

osx + IDA + virtualbox, keyboard mapping for “Insert”

I use the free version of IDA and I'm trying to define structs. Unfortunately, I'm using Windows XP as a VM on OSX and am having trouble remapping Insert to something else. I'm hoping someone has ...
2
votes
1answer
805 views

How to set a breakpoint when a method is called using LLDB on OS X?

I'm trying to hit a breakpoint that I set in LLDB (CLI), but for whatever reason I'm not hitting my breakpoint. I am messing around with the stock Calculator.app on OS X, and am trying to call / hit ...
2
votes
1answer
1k views

How to use cycript to investigate a mach-o x86_64 binary?

I recently found out about a tool called cycript that apparently does runtime analysis of binaries written with Objective-C. I have a Mac OS X binary that is compiled as x86_64 and is intended to run ...
4
votes
1answer
790 views

Load dSYM symbols in Hopper

Can I load dSYM symbols into Hopper? (I searched extensively in the menus etc. but couldn't find such an option) Context: I want to see how a program I created using Xcode was compiled into machine ...
7
votes
1answer
1k views

GDB issues: Can't set breakpoint on Obj-C method

I'm a beginner to reverse engineering, I've read through a few tutorials and know my way around some basic GDB and assembly code. After working my way through a few trivial examples I'd like to try ...
2
votes
2answers
852 views

Reversing a Mac OS X binary that appears to be non encrypted, backtrace just shows mach_msg_trap ()

Currently I have a binary that I am investigating. The application is GUI / event driven, so that makes it difficult to set a break point. I would like to set a break point on a certain button click,...
10
votes
3answers
3k views

Hooking functions in Linux and/or OSX?

I want to hook functions in a library (lib.so or lib.dylib) from another process. I know that unlike windows libraries, libraries in linux and mac still have their symbols (function names and ...
3
votes
1answer
413 views

OS X Power PC RE tool (debugger/disassembler)

So I want to know is such tool exist without counting IDA PRO. And is there any GUI version of it if exist - because I really don't want to debugging with terminal. My OS X version is Snow Leopard. I ...
5
votes
1answer
216 views

Strange GDB behavior in OSX

I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...