Questions tagged [osx]

An Unix-based operating system originally forked from NextSTEP and developed by Apple Inc. MacOS X runs a Darwin kernel together with Apple Inc. utilities.

Filter by
Sorted by
Tagged with
4 votes
0 answers
508 views

Decoding the Apple vendor tag in the 802.11 beacon

Background Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a ...
thewade's user avatar
  • 41
0 votes
1 answer
122 views

How to determine the data type of a register

I'm learning reverse engineering and I'm trying to understand what process people use to identify a variable type. For example, I'm looking at an argument being passed to a function and I'm trying to ...
user3632719's user avatar
2 votes
2 answers
789 views

Attempting to reverse engineer an iOS OTA payload-like archival format

Apple's announcement of macOS Big Sur had meant the release of the developer beta. In an attempt to create the appbundle from Apple's softwarecatalog, I attempted to study the contents of ...
Kittywhiskers Van Gogh's user avatar
3 votes
0 answers
156 views

How to see what has changed in a patched binary?

I am exploring MacOS Deckset app. It has a trial version available on the official website. But there's a cracked version available on torrent trackers. I want to know what was changed by the people ...
Revengo Engineros's user avatar
1 vote
1 answer
119 views

OSX User level application Preferences (plist) are not loaded after binary modification

I am working on a project that requires to modify an existing OSX application's dylib binary (few bytes to correct an obsolete URL). I do not have access to the application source code nor the code ...
Tamas Foldi's user avatar
2 votes
1 answer
256 views

Changing parameters in an OS X executable

very new here so please bear with me. I'm an artist trying to realise an idea for a camera that takes photos every X interval during a month. Everything works, except that the app with which I ...
user1092247's user avatar
4 votes
2 answers
2k views

Why are there absolute jmps in disassembly of position independent code?

I'm playing around with Hopper and am looking at the disassembly of a binary that otool reports as having the PIE flag. It's my understanding that as a result, the executable base address will be ...
1110101001's user avatar
2 votes
1 answer
688 views

Objective-C disassembling - I dont understand this code

I assembled a simple objective-c file that prints hello to the screen. this is the code: #import <Foundation/Foundation.h> int main() { NSString* a = [NSString stringWithUTF8String: "hi"]; ...
Camden's user avatar
  • 123
2 votes
0 answers
312 views

POC for appleScript injection method

I am trying to make a POC of code injection using applescript injection technic which is used in GitHub project EasySIMBL. The method also described here. (It's basically a huge article, just search ...
Zohar81's user avatar
  • 293
8 votes
1 answer
1k views

Reverse engineering the PluginKit MacOS framework

I've been tasked with an assignment requiring a thorough reverse engineering effort on the PluginKit framework in modern Mac operating system, and I'm looking for information to start off, instead of ...
NirIzr's user avatar
  • 11.8k
1 vote
1 answer
664 views

Changing NSUserDefaults of a mac or iOS binary executable

I have an executable of a mac or ios app. This app uses a value stored for a key in NSUserDefaults to change app's flow. It looks something like below code, If( value set in user details ) ...
Jaffer Sheriff's user avatar
3 votes
1 answer
1k views

Calling Swift 4 methods from C

I have earlier been able to call Swift methods using a function pointer from C, and providing the appropriate arguments because the calling convention was the same. Unfortunately this no longer works....
sdsykes's user avatar
  • 131
1 vote
1 answer
1k views

Creating a patcher for a mac app

I have a signed mac app and I don't have the source code of the app. I know address locations of some assembly instructions which I need to change so as to make this app to work in certain way. So I'm ...
Jaffer Sheriff's user avatar
0 votes
1 answer
154 views

whats the purpose of this code snippet?

I'm using at&t ordering I came across this a little while ago and while i understand why we want to push a stack frame when we call a new routine I don't see why it was done here: (for the ...
Div's user avatar
  • 93
2 votes
2 answers
2k views

How do I denote and use JMP /5 in byte code

I'm on the OSX platform working with x86_64. I've worked out how to do near jumps with the E9 byte code directive where my relative addresses have 4 bytes (teamed up with RIP) Now I have an instance ...
Div's user avatar
  • 93
1 vote
1 answer
1k views

Is there an up to date fork of otx?

otx is a tool used to disassemble Mach-O binaries on OS X 10.0-10.4. It is an enhancement on top of otool to add additional symbol information to its disassembled output. The main site and SVN ...
JAL's user avatar
  • 605
4 votes
1 answer
4k views

MacOS: Output to console in non-console app

I'm working with a program that I can't reasonably run from console; it is started by another program with complex calculated and network-gotten arguments, and that program is complicated as well. To ...
Lupe's user avatar
  • 185
1 vote
1 answer
138 views

Extract an image out of a application and customize after edited

I was wondering if you guys could help me.I have an application for OSX it is called Traktor..I want to extract an image of a vinyl and edit it than reassign it back to the application... I want to ...
Eduardo Tavares's user avatar
13 votes
3 answers
24k views

Remove code signature from a Mac binary

How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards? Needless to say, I'm not the original creator of the binary, nor I have the ...
alexandernst's user avatar
0 votes
1 answer
110 views

Order of architecture headers in fat (universal) executables

I'm working on a reverse engineering project with fat executables on OS X. So far I have established the structure of the fat_header, fat_arch and macho_header, but am having trouble finding ...
ScottWe's user avatar
3 votes
0 answers
436 views

When I start up a remote thread in an application, why does it always crash when it tries to access data in the thread structure?

I'm on OS X 10.10 64 bit (x86_64) and created a chunk of memory called code with vm_allocate. I allocate a chunk of memory for a stack. I load a library to memory and determine an entry point to ...
Div's user avatar
  • 93
11 votes
2 answers
21k views

Decrypting IPA Binary on OS X

I've been reading this PDF on reverse-engineering iOS applications and have reached slide 39, decrypting the binary. However, I've been attempting to disassemble and explore the binary in OS X 10.9.5 ...
Patrick Roberts's user avatar
1 vote
1 answer
884 views

Patching Application on OSX (Memory Protection)

I'm patching an executable on OSX. So far I know the patches have been applied successfully. Steps taken (via LLDB): lldb /users/Brandon/Desktop/Test.app/Contents/MacOS/Test b start run br del 1 ...
Brandon's user avatar
  • 111
2 votes
1 answer
979 views

Reverse engineering a PXP3 Slimstation

I've been given a PXP3 Slimstation. It's a mysterious undocumented portable games console, running 16bit Sega Genesis games. It has a mini USB connector on it. I'd like to try to find out more about ...
tomh's user avatar
  • 121
1 vote
2 answers
868 views

Load symbols from __objc_* sections in LLDB

When an executable that has been stripped is opened in lldb, lldb doesn't know the names of any functions and breakpoints have to be set manually on hex addresses, which is very annoying. However, ...
Brennan Vincent's user avatar
6 votes
1 answer
1k views

Are Reverse Debuggers Impossible on OSX?

I have been impressed with the reverse debugging (that is stepping back in time through a program) capabilities in GDB and tools like QIRA, but I am a little confused as to why no such program exists ...
MrSynAckSter's user avatar
  • 1,256
5 votes
1 answer
2k views

How to find the entry point in LLDB on OS X?

How can I identify the entry point of an executable in LLDB? In GDB, we can use the info file command, but that won't work in LLDB. Can anyone show me how to do that?
PSN's user avatar
  • 153
1 vote
0 answers
586 views

Why darwin kernel crashes on function call via lldb while debugging the process?

I wanted to debug the hanging ruby process, but instead my kernel crashes each time when I'm doing the following steps: I'm re-running my ruby script (vagrant) which hangs: $ vagrant destroy -f &...
kenorb's user avatar
  • 485
2 votes
1 answer
554 views

lldb - breakpoint not reached when attach do process (but executing when set before app running)

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all ...
Michal Zaborowski's user avatar
12 votes
1 answer
5k views

How to read NSCR1000 data files?

Terminal app on OSX stores the information about its windows and content in its state files in Library/Saved Application State/com.apple.Terminal.savedState. I did the backup of the file before the ...
kenorb's user avatar
  • 485
1 vote
0 answers
692 views

Connecting to mac_server with IDA Pro on Windows

I can't get IDA to connect with a debugging server on OS X. This is what keeps happening: $ ll ~/.bin/mac_server* -rwxr-sr-x 1 Ron procmod 657K May 5 22:29 mac_server* -rwxr-sr-x 1 Ron procmod ...
Ron's user avatar
  • 111
2 votes
1 answer
2k views

How could using QEMU be useful in developing a driver for Linux?

Presently, I am trying to analyze a piece of hardware, to be specific the Broadcom 1570 PCI web cam inside a late MBPr 2013. I can pass through the device using QEMU, and have the gusest OS / VM ...
ipatch's user avatar
  • 331
6 votes
2 answers
2k views

Unknown Mac OSX 10.10 HFS+ compression

I'm trying to decompress a Mach-O binary which has been compressed using one of the compression algorithms in Mac 10.10's HFS+ implementation. Basically the file has the "com.apple.decmpfs" ...
Luke Quinane's user avatar
4 votes
1 answer
3k views

What are some methods to reversing a .kext?

I recently discovered there is no native Linux driver for the Web Cam in my computer. However, there is a person who has taking the initiative to start a github project for a driver. That being said,...
ipatch's user avatar
  • 331
16 votes
2 answers
6k views

In a Mach-O executable, how can I find which function a stub targets?

Before exposing my problem, here's my understanding of the whole thing, so that you may correct me if I'm saying something wrong. In a Mach-O file (at least on x86), the __TEXT.__stubs section ...
zneak's user avatar
  • 321
2 votes
2 answers
1k views

Can one modify a program by "wrapping" its binary? What tools exist?

(This question is related to How do I add functionality to an existing binary executable?). I too would like to add functionality to an existing application, but I do not want to modify the original ...
eggyal's user avatar
  • 146
3 votes
2 answers
5k views

lldb: break at start of actual code, not entrypoint

I want lldb to break at the start of the actual code of an OS X application (which might be called main if symbols are existing). I am currently looking this up by hand, but as I want to script some ...
muffel's user avatar
  • 165
0 votes
1 answer
487 views

Why are there often many 0-bytes in executables?

I disassembled some OS X apps with Hopper and found that all of them contain a lot of zero bytes in a row. What is the use of that? Is this some OS X ABI specific padding I came across here? What is ...
Joseppe's user avatar
2 votes
1 answer
467 views

Generate Mach-O binary from running process

I have a packed executable. To take care of the unpacking, I would like to extract the in-memory version of the process, which would ideally be rolled back into the equivalent Mach-O binary -- such ...
NMRN's user avatar
  • 21
1 vote
0 answers
60 views

Basic Concept misunderstood? [duplicate]

First of all, it may be that I am just not getting how things work. Stultus sum. I am using a Mac with OSX (10.9), therefore with x86_64 architecture. I wanted to play around a bit with compilers ...
vackermann's user avatar
1 vote
1 answer
784 views

OSX where does getconf read its value

I'm not experienced at reverse engineering at all. I hope this basic question is suitable for this site. Basically I want to know where the value DARWIN_USER_CACHE_DIR is read from. I'm trying to ...
Newbie's user avatar
  • 11
12 votes
2 answers
5k views

Extract non-extractable private key from OS X Keychain

I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4. Basically, it appears that security import has a -x option to ...
cnst's user avatar
  • 299
2 votes
0 answers
3k views

Unpacking and disassembling mach-o binary

I am trying to reverse an OSX mach-o binary, Disassembling gives me a bullshit, seems its encrypted with some packer. I need to determine the encryption algorithm, and decrypt the binary. Load ...
l0gg3r's user avatar
  • 129
2 votes
2 answers
906 views

osx + IDA + virtualbox, keyboard mapping for "Insert"

I use the free version of IDA and I'm trying to define structs. Unfortunately, I'm using Windows XP as a VM on OSX and am having trouble remapping Insert to something else. I'm hoping someone has ...
user avatar
2 votes
1 answer
1k views

How to set a breakpoint when a method is called using LLDB on OS X?

I'm trying to hit a breakpoint that I set in LLDB (CLI), but for whatever reason I'm not hitting my breakpoint. I am messing around with the stock Calculator.app on OS X, and am trying to call / hit ...
ipatch's user avatar
  • 331
2 votes
1 answer
1k views

How to use cycript to investigate a mach-o x86_64 binary?

I recently found out about a tool called cycript that apparently does runtime analysis of binaries written with Objective-C. I have a Mac OS X binary that is compiled as x86_64 and is intended to run ...
ipatch's user avatar
  • 331
6 votes
1 answer
2k views

Load dSYM symbols in Hopper

Can I load dSYM symbols into Hopper? (I searched extensively in the menus etc. but couldn't find such an option) Context: I want to see how a program I created using Xcode was compiled into machine ...
yairchu's user avatar
  • 167
8 votes
1 answer
1k views

GDB issues: Can't set breakpoint on Obj-C method

I'm a beginner to reverse engineering, I've read through a few tutorials and know my way around some basic GDB and assembly code. After working my way through a few trivial examples I'd like to try ...
SlEePlEs5's user avatar
3 votes
2 answers
1k views

Reversing a Mac OS X binary that appears to be non encrypted, backtrace just shows mach_msg_trap ()

Currently I have a binary that I am investigating. The application is GUI / event driven, so that makes it difficult to set a break point. I would like to set a break point on a certain button click,...
ipatch's user avatar
  • 331
12 votes
3 answers
4k views

Hooking functions in Linux and/or OSX?

I want to hook functions in a library (lib.so or lib.dylib) from another process. I know that unlike windows libraries, libraries in Linux and Mac still have their symbols (function names and ...
TerryW's user avatar
  • 121