Hot answers tagged

14

I highly recommend radare2 which seems to suit you the best: radare2 is an open source framework for reverse engineering and binary analysis which implements a rich command line interface for disassembling, analyzing data, patching binaries, comparing data, searching, replacing, visualizing and more. It has great scripting capabilities, it runs on ...


10

These "weird" names are produced by the compiler and are called Name Mangling or Name Decoration. These names are shown by radare2 but are not produced or generated by it. To quote from MSDN: Functions, data, and objects in C and C++ programs are represented internally by their decorated names. A decorated name is an encoded string created by the ...


6

Open up the binary in IDA Pro. Search for 0x534D4544, which is the 32-bit encoding for the SMED tag. There are five results; three of them are mov instructions, two of them are cmp instructions. The latter two are the interesting ones; this is where it's comparing the subchunk ID tags. They are both in a function called -[SMMDScanner getSMMetadata:signature:]...


5

If you look in macho.cfg you find: // Key used to decrypt apple-protected binaries. // Due to copyright reasons we cannot publish the key, // but we can give you clues... // http://www.takwing.idv.hk/tech/virtual/faq/no_more_fakesmc.html SMC_DEVICE_KEY = ""; The link mentioned no longer works, but there are many other places on the internet where the ...


5

As mentioned in your comment, the corresponding opcode to je 0x1000021c0 is 74 D9. Thus, there's no doubt that you are facing a relative JMP. Hopper is translating the relative JMP so it'll be easier for a reverse engineer to understand the flow of the code without having to calculate addresses. I'll demonstrate what Hopper does with a simple example using ...


5

This is not free and open source but Hopper Disassembler is $99US for personal use which compared to IDA Pro is super cheap. There is a free trial version if you would like to check it out. https://www.hopperapp.com/


4

As of 2020, Ghidra should be considered as a major contender. It is challenging IDA Pro in many areas. The integrated decompiler is one of its greatest assets. The support for debugging was added recently on the official repository. It will be added to the next official build. Ref


4

Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can find this types of techniques on them. For example instead of do this const char *msg = "Good morning"; You can do const char *msg = "R29vZCBtb3JtaW5nCg==";...


4

Here you have more details about Apple Binary Protection: Creating undetected malware for OS X Setting SMC_DEVICE_KEY value in ~/.idapro/macho.cfg works fine. Hopper Disassembler out of the box can decrypt those binaries too. At last, you can also run deprotect from class-dump to decrypt those binaries (__TEXT,__text) section.


3

It looks like the problem is partially fixed by running set startup-with-shell off inside the gdb. Why? I don't know, no clue, I just read it somewhere. If anyone has a different solution or know why this works, please, tell us here.


2

There aren't any. Radare is the only open source disassembler (that works on OSX) worth mentioning, and its capabilities are still far away from what you're looking for. https://github.com/radare/radare2 or brew install radare2


2

My offers won't be specific for your task, so I will try to answer your second question. I hope these helps to you or anyone having a similar task. Since your task is on a quite specific subject, I will offer you searching for something similar, and solve the puzzle by combining these details. I don't know if you have previous MacOS/iOS reversing experience....


2

The officially supported debugging package for Mac OS X is lldb. You can always try GDB which is the legendary GNU Debugger. It is not in any way as fancy as IDA buy you can always spice it up with GDB-Dashboard or gdbgui.


2

I figured out how to make it work. Here's the procedure that needs to be followed: Open a copy of the executable to be analyzed in Hopper on the host Mac Put a copy of the executable to be analyzed on the VM Install Hopper Debugger Server on the VM and launch it In Hopper on the host Mac, choose Debug > Select Debugger Select the VM Change the path to the ...


2

I think you're not doing anything wrong, you're experiencing this bug: https://sourceware.org/bugzilla/show_bug.cgi?id=24069 Usually if you retry several times you might get it to work eventually; it looks like a race condition. The patch proposed in the bug report kind of works for me on macOS 10.15.5: instead of just hanging, GDB errors out upon run with: ...


2

If you've only opened the program in GDB and used run, then your program will start without stopping to let you debug it. GDB will typically only begin prompting you for input on an exception, signal, or breakpoint. What you most likely need to do is to set a breakpoint on main, or some other function of interest, and then use run. This will make gdb stop ...


2

Since you have access to the program that produces the data, you can use it as an oracle: Make a file with empty description strings Make another with one letter description Dump the two files and look for differences. Then start adding longer descriptions and check how it affects the output. Keep going until you figured out the format for all variations ...


2

So there is an answer in the original post, but what i was missing is the interface where i'll be attaching the debugger at in the boot-args so I have to add kdp_match_name=en24, where en24 is the physical interface the machines are communicating at Just adding here the answer as well, as it might help someone in the future


1

On ARM macOS, like on iOS, most of the common dylibs are no longer shipped as separate files, but are bundled into the dyld shared cache. You can usually find the caches in /System/Library/dyld/.


1

Network sniffing tools such as Wireshark are your best bet. That will let you see all the traffic going across a network interface. You can use Statistics > Conversations to help narrow in on the specific network traffic you are interested in. If you post a PCAP, we can help.


1

Executable Mach-O files use segment load commands to represent loadable/mappable memory areas. They can be further split into sections. IDA’s Mach-O loader does not use the file offset field in the section headers. The data from file is loaded into database only using segment headers and then split into sections based on the address fields of the section ...


1

after some trial and error i managed to solve it easily with the following command in terminal find . -name "*.bundle" -execdir sudo codesign -f -s - {} \; find . -name "*.EXTENSION" is responsible for finding the certain file extension in a directory -execdir YOUR COMMAND {} \; is responsible to executing the command. using -execdir -> on the ...


1

Maybe this would be a good reference (Just install and run Hopper Debugger Server app then back to hopper Debug > Select Debugger)


1

well megabeets was faster here is how to check it in windbg 0:000> ? . Evaluate expression: 1999570342 = 772f05a6 0:000> EB . 74 D9 0:000> U . L1 ntdll!LdrpDoDebuggerBreak+0x2c: 772f05a6 74d9 je ntdll!LdrpDoDebuggerBreak+0x7 (772f0581) 0:000> ? 772F0581 - . Evaluate expression: -37 = ffffffdb 0:000> ? 21E5-21C0 Evaluate ...


1

By declaring d inside main() it is a local scope variable, which exists on the stack and is therefore dynamic. If you declare this pointer outside of main, it will be a global variable and it will have the same address every time, as long as there is know memory randomization provided as security measure of the OS.


1

Although they are not free, you can try either Hopper Disassembler and Binary Ninja. Both can be bought starting from $99.


Only top voted, non community-wiki answers of a minimum length are eligible