New answers tagged

2

otool uses 0-based indexing for load commands and section numbers so it's probably the next section which is problematic. Note that the OS loader only uses segments for mapping the image to the memory so even if the file offsets of the sections are off it should not affect runnability of the program. Some sections may be used by the runtime components like ...


0

You can use VMMap by SysInternals to inspect the memory layout of the process and determine what exactly the mysterious memory is. If it is heap memory, most likely there is a pointer to it somewhere in the process' data section, so you may be able to track it from there. Note that there can be multiple levels of indirections for a specific memory block. You ...


0

Basically you need to find the Mach-O header of the module in memory and dump the segments referred by it. Here’s a tool which is not specifically for macOS, but should not be too difficult to modify since it already has the code to handle the Mach-O format: https://github.com/stefanesser/dumpdecrypted


Top 50 recent answers are included