18
votes
Accepted
Remove code signature from a Mac binary
There are tools for that, as well as a codesign flag --remove-signature
First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
- 11.7k
11
votes
Accepted
Decrypting IPA Binary on OS X
Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's ...
- 36.4k
11
votes
Accepted
How to read NSCR1000 data files?
It is encrypted with AES so you will need the keys from windows.plist to decode.
The format is (all stored in big-endian):
offset value
0-3 magic ('NSCR' for PersistentUIRecord)
4-7 version ...
- 1,331
8
votes
Accepted
How to find the entry point in LLDB on OS X?
You can make use of the command
(lldb) process launch --stop-at-entry
to start the program. This stops you right at the entry point. From there lldb will tell you the address as well, in case this ...
6
votes
Accepted
In a Mach-O executable, how can I find which function a stub targets?
I wrote a Python script that parses entry points and imports from a Mach-O executable for one of my projects. The trick is to parse the LC_DYLD or LC_DYLD_ONLY loader commands. These two commands ...
- 321
5
votes
Accepted
Why are there absolute jmps in disassembly of position independent code?
As mentioned in your comment, the corresponding opcode to je 0x1000021c0 is 74 D9. Thus, there's no doubt that you are facing a relative JMP. Hopper is translating the relative JMP so it'll be easier ...
- 8,919
5
votes
Accepted
Objective-C disassembling - I dont understand this code
The instructions
mov qword [rbp - 16], rax
mov rax, qword [rbp - 16]
are created by the compiler which is using stack based memory allocation to store the result from the NSString objc call. If ...
- 1,331
4
votes
Are Reverse Debuggers Impossible on OSX?
Honestly, the stock reversible debugging support in gdb is not all that useful. It's really slow (because it records individual instructions), so you generally have to turn it on just for a critical ...
- 2,868
4
votes
Extract non-extractable private key from OS X Keychain
I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here.
In my case, I did the following:
$ pip2 install hexdump pycrypto pyopenssl
$ git clone ...
- 141
4
votes
Accepted
Order of architecture headers in fat (universal) executables
There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections?
The kernel simply loads ...
- 1,257
4
votes
Accepted
Creating a patcher for a mac app
There are several aspects for this:
if the app is not protected with some sort of packaging
you just need to find the place that you want to patch with the help of debugger (when the app is running) ...
- 3,002
3
votes
Reverse engineering the PluginKit MacOS framework
My offers won't be specific for your task, so I will try to answer your second question. I hope these helps to you or anyone having a similar task. Since your task is on a quite specific subject, I ...
- 157
3
votes
lldb - breakpoint not reached when attach do process (but executing when set before app running)
The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the ...
- 1,331
3
votes
Load symbols from __objc_* sections in LLDB
I solved this problem for gdb a few years ago, see Import class-dump info into GDB on Stack Overflow.
I’m not sure if lldb has an add-symbol-file equivalent command. Loading symbols from location in ...
- 131
3
votes
How do I denote and use JMP /5 in byte code
There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes).
Quote from x86asm.net about JMPF:
AMD64 Architecture Programmer's Manual Volume 3: ...
- 2,896
2
votes
Reverse engineering a PXP3 Slimstation
It is unlikely that you will be able to get any information about the device via the USB port. Most likely, that would just provide access to either a memory card or read/write flash memory.
What ...
- 605
2
votes
Accepted
Is there an up to date fork of otx?
The most up to date fork I have found of otx is Cai's. I have tried the CLI interface of his v1.7: Build 566 release on macOS 10.11.6 and it runs fine for basic disassembly, albeit on invoking it ...
- 261
2
votes
Accepted
MacOS: Output to console in non-console app
It really depends what the application you are trying to run is logging to.
If the application uses NSLog() and other associated Cocoa APIs, you're in luck. The output should appear in the Apple ...
- 605
2
votes
Accepted
Changing NSUserDefaults of a mac or iOS binary executable
The values are stored in a plist file under ~/Library/Preferences (or ~/Library/Containers/.../ if sandboxed). You can find more information about it from Apple's documentation.
The easiest way to ...
- 1,331
2
votes
Accepted
whats the purpose of this code snippet?
This is most likely an optimized tail call. The original code probably looked similar to this:
int f1()
{
//some code which was optimized out
return f2();// &f2=0x10002135a
}
Since there is no ...
- 36.4k
2
votes
Remove code signature from a Mac binary
Another blunt way that seemed to work for me on Catalina (note that this strips all attributes):
xattr -cr /path/to/your/program.app
- 21
1
vote
Accepted
How to determine the data type of a register
Short story: you can't without context.
In memory, everything is data, and your registers will always be populated with data.
Sometime, you can guess the data type (a small integer, some characters or ...
- 709
1
vote
Accepted
Attempting to reverse engineer an iOS OTA payload-like archival format
YAA is possibly the signature of yaa archives, so try using the yaa utility on those files.
- 36.4k
1
vote
Why are there absolute jmps in disassembly of position independent code?
well megabeets was faster
here is how to check it in windbg
0:000> ? .
Evaluate expression: 1999570342 = 772f05a6
0:000> EB . 74 D9
0:000> U . L1
ntdll!LdrpDoDebuggerBreak+0x2c:
772f05a6 ...
- 16.3k
1
vote
Extract an image out of a application and customize after edited
Many images in OS X applications live in the bundle. Meaning they are linked with the application, but not compiled into the binary. One exception to this would be if the application is using an ...
- 605
1
vote
Decrypting IPA Binary on OS X
Use dumpdecrypted or clutch:
https://github.com/KJCracks/Clutch
https://github.com/stefanesser/dumpdecrypted.git
You could install Clutch on your OS/X, but not sure if you will need a valid Apple ...
- 41
1
vote
Patching Application on OSX (Memory Protection)
IDA Pro does not allow patching an image by default. When IDA Pro analyzes a binary, it is read into its on format; the original executable from that point forward doesn't need to be around.
You can ...
- 131
1
vote
Load symbols from __objc_* sections in LLDB
Since the Objc data (selectors) has to be available to the Objc code in order for it to run.
LLDB can set breakpoints according to selectors using the breakpoint set -n "[SomeClass someFunction:]" ...
- 1,557
1
vote
Can you decompile Actionscript 3 on a Mac?
I use https://www.free-decompiler.com/flash/ which is the best software I have seen. It has almost all features you can want. It also comes with a java library which can be handy to automate your ...
- 111
Only top scored, non community-wiki answers of a minimum length are eligible