Hot answers tagged

16 votes
Accepted

Remove code signature from a Mac binary

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
  • 11.4k
11 votes
Accepted

Decrypting IPA Binary on OS X

Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's ...
  • 35.1k
11 votes
Accepted

How to read NSCR1000 data files?

It is encrypted with AES so you will need the keys from windows.plist to decode. The format is (all stored in big-endian): offset value 0-3 magic ('NSCR' for PersistentUIRecord) 4-7 version ...
  • 1,331
8 votes
Accepted

How to find the entry point in LLDB on OS X?

You can make use of the command (lldb) process launch --stop-at-entry to start the program. This stops you right at the entry point. From there lldb will tell you the address as well, in case this ...
7 votes
Accepted

What are some methods to reversing a .kext?

Answering Your Question Directly: You can reverse Kernal Extensions with IDA Pro, Radare2, GDB or whatever dissasembler you would like. Yes, you will have to learn what C++ structures look like once ...
  • 1,216
6 votes

Extract non-extractable private key from OS X Keychain

I've arrived at a solution by researching an answer for one of my Keychain subquestions. https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x. According to ...
  • 299
5 votes
Accepted

Unknown Mac OSX 10.10 HFS+ compression

OK... it seems to be LZVN compression. Following on from Igor's suggestions I ran kextstat on my Mac, however that only listed: com.apple.AppleFSCompression.AppleFSCompressionTypeZlib com.apple....
5 votes
Accepted

Objective-C disassembling - I dont understand this code

The instructions mov qword [rbp - 16], rax mov rax, qword [rbp - 16] are created by the compiler which is using stack based memory allocation to store the result from the NSString objc call. If ...
  • 1,331
5 votes
Accepted

Why are there absolute jmps in disassembly of position independent code?

As mentioned in your comment, the corresponding opcode to je 0x1000021c0 is 74 D9. Thus, there's no doubt that you are facing a relative JMP. Hopper is translating the relative JMP so it'll be easier ...
  • 8,679
4 votes
Accepted

In a Mach-O executable, how can I find which function a stub targets?

I wrote a Python script that parses entry points and imports from a Mach-O executable for one of my projects. The trick is to parse the LC_DYLD or LC_DYLD_ONLY loader commands. These two commands ...
  • 281
4 votes

In a Mach-O executable, how can I find which function a stub targets?

the numeric argument is is an offset into the "compressed dyld info" stream of bytecodes. see https://stackoverflow.com/a/8836580 (iOS/arm but still applies)
  • 35.1k
4 votes

Extract non-extractable private key from OS X Keychain

I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here. In my case, I did the following: $ pip2 install hexdump pycrypto pyopenssl $ git clone ...
  • 141
4 votes
Accepted

Order of architecture headers in fat (universal) executables

There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections? The kernel simply loads ...
  • 1,227
4 votes
Accepted

Creating a patcher for a mac app

There are several aspects for this: if the app is not protected with some sort of packaging you just need to find the place that you want to patch with the help of debugger (when the app is running) ...
  • 2,862
3 votes

Load symbols from __objc_* sections in LLDB

I solved this problem for gdb a few years ago, see Import class-dump info into GDB on Stack Overflow. I’m not sure if lldb has an add-symbol-file equivalent command. Loading symbols from location in ...
  • 131
3 votes

Are Reverse Debuggers Impossible on OSX?

Honestly, the stock reversible debugging support in gdb is not all that useful. It's really slow (because it records individual instructions), so you generally have to turn it on just for a critical ...
3 votes

OSX where does getconf read its value

Note: I don't know much about OSX, and wouldn't have answered if there had been another answer after 24 hours. According to Apple, getconf uses sysconf and confstr to find these configuration values, ...
3 votes

Can one modify a program by "wrapping" its binary? What tools exist?

Dynamic instrumentation tools like Frida or DynomoRIO are probably your best bet. Traditional code injection approaches like mach_inject on os x or detours on windows are things you could look into as ...
  • 1,561
3 votes

lldb - breakpoint not reached when attach do process (but executing when set before app running)

The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the ...
  • 1,331
3 votes
Accepted

How could using QEMU be useful in developing a driver for Linux?

To develop a driver, there's basically 3 steps you have to do: Learn about Linux driver programming in general. This is independent of your specifi hardware, and involves things like "How do i ...
3 votes

Unknown Mac OSX 10.10 HFS+ compression

according to this post, you can use afscexpand tool to decompress such files.if you prefer the hard way, xnu source code may be of help.
  • 35.1k
3 votes

How do I denote and use JMP /5 in byte code

There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes). Quote from x86asm.net about JMPF: AMD64 Architecture Programmer's Manual Volume 3: ...
  • 2,836
3 votes

Reverse engineering the PluginKit MacOS framework

My offers won't be specific for your task, so I will try to answer your second question. I hope these helps to you or anyone having a similar task. Since your task is on a quite specific subject, I ...
  • 157
2 votes
Accepted

lldb: break at start of actual code, not entrypoint

Try this: (lldb) break set -n main (lldb) r (lldb) thread backtrace frame #0: 0x0000000000405696 app`main(argc=1, argv=...) + 22 at app.cpp:11 frame #1: 0x00007ffff7216ec5 libc.so.6`...
2 votes

Generate Mach-O binary from running process

You can get some ideas from the dumpdecrypted tool by Stefan Esser. It's for iPhone but shouldn't be too difficult to port to OS X.
  • 35.1k
2 votes

Remove code signature from a Mac binary

Another blunt way that seemed to work for me on Catalina (note that this strips all attributes): xattr -cr /path/to/your/program.app
2 votes

Reverse engineering a PXP3 Slimstation

It is unlikely that you will be able to get any information about the device via the USB port. Most likely, that would just provide access to either a memory card or read/write flash memory. What ...
  • 605
2 votes
Accepted

MacOS: Output to console in non-console app

It really depends what the application you are trying to run is logging to. If the application uses NSLog() and other associated Cocoa APIs, you're in luck. The output should appear in the Apple ...
  • 605
2 votes
Accepted

Is there an up to date fork of otx?

The most up to date fork I have found of otx is Cai's. I have tried the CLI interface of his v1.7: Build 566 release on macOS 10.11.6 and it runs fine for basic disassembly, albeit on invoking it ...
  • 261
2 votes
Accepted

whats the purpose of this code snippet?

This is most likely an optimized tail call. The original code probably looked similar to this: int f1() { //some code which was optimized out return f2();// &f2=0x10002135a } Since there is no ...
  • 35.1k

Only top scored, non community-wiki answers of a minimum length are eligible