Skip to main content
18 votes
Accepted

Remove code signature from a Mac binary

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
NirIzr's user avatar
  • 11.8k
7 votes
Accepted

In a Mach-O executable, how can I find which function a stub targets?

I wrote a Python script that parses entry points and imports from a Mach-O executable for one of my projects. The trick is to parse the LC_DYLD or LC_DYLD_ONLY loader commands. These two commands ...
zneak's user avatar
  • 331
5 votes
Accepted

Why are there absolute jmps in disassembly of position independent code?

As mentioned in your comment, the corresponding opcode to je 0x1000021c0 is 74 D9. Thus, there's no doubt that you are facing a relative JMP. Hopper is translating the relative JMP so it'll be easier ...
Megabeets's user avatar
  • 8,999
5 votes
Accepted

Objective-C disassembling - I dont understand this code

The instructions mov qword [rbp - 16], rax mov rax, qword [rbp - 16] are created by the compiler which is using stack based memory allocation to store the result from the NSString objc call. If ...
cimarron's user avatar
  • 1,341
5 votes
Accepted

Creating a patcher for a mac app

There are several aspects for this: if the app is not protected with some sort of packaging you just need to find the place that you want to patch with the help of debugger (when the app is running) ...
PhoeniX's user avatar
  • 3,062
4 votes

Extract non-extractable private key from OS X Keychain

I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here. In my case, I did the following: $ pip2 install hexdump pycrypto pyopenssl $ git clone ...
standy's user avatar
  • 141
4 votes
Accepted

Order of architecture headers in fat (universal) executables

There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections? The kernel simply loads ...
knx's user avatar
  • 1,257
3 votes

Reverse engineering the PluginKit MacOS framework

My offers won't be specific for your task, so I will try to answer your second question. I hope these helps to you or anyone having a similar task. Since your task is on a quite specific subject, I ...
qwerty's user avatar
  • 157
3 votes

How do I denote and use JMP /5 in byte code

There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes). Quote from x86asm.net about JMPF: AMD64 Architecture Programmer's Manual Volume 3: ...
Nordwald's user avatar
  • 2,906
3 votes

Load symbols from __objc_* sections in LLDB

I solved this problem for gdb a few years ago, see Import class-dump info into GDB on Stack Overflow. I’m not sure if lldb has an add-symbol-file equivalent command. Loading symbols from location in ...
0xced's user avatar
  • 131
2 votes

Reverse engineering a PXP3 Slimstation

It is unlikely that you will be able to get any information about the device via the USB port. Most likely, that would just provide access to either a memory card or read/write flash memory. What ...
JAL's user avatar
  • 605
2 votes
Accepted

Is there an up to date fork of otx?

The most up to date fork I have found of otx is Cai's. I have tried the CLI interface of his v1.7: Build 566 release on macOS 10.11.6 and it runs fine for basic disassembly, albeit on invoking it ...
ikaerom's user avatar
  • 261
2 votes
Accepted

MacOS: Output to console in non-console app

It really depends what the application you are trying to run is logging to. If the application uses NSLog() and other associated Cocoa APIs, you're in luck. The output should appear in the Apple ...
JAL's user avatar
  • 605
2 votes
Accepted

Changing NSUserDefaults of a mac or iOS binary executable

The values are stored in a plist file under ~/Library/Preferences (or ~/Library/Containers/.../ if sandboxed). You can find more information about it from Apple's documentation. The easiest way to ...
cimarron's user avatar
  • 1,341
2 votes
Accepted

whats the purpose of this code snippet?

This is most likely an optimized tail call. The original code probably looked similar to this: int f1() { //some code which was optimized out return f2();// &f2=0x10002135a } Since there is no ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

Remove code signature from a Mac binary

Another blunt way that seemed to work for me on Catalina (note that this strips all attributes): xattr -cr /path/to/your/program.app
user31463's user avatar
1 vote
Accepted

How to determine the data type of a register

Short story: you can't without context. In memory, everything is data, and your registers will always be populated with data. Sometime, you can guess the data type (a small integer, some characters or ...
Guillaume's user avatar
  • 709
1 vote
Accepted

Attempting to reverse engineer an iOS OTA payload-like archival format

YAA is possibly the signature of yaa archives, so try using the yaa utility on those files.
Igor Skochinsky's user avatar
  • 36.7k
1 vote

Why are there absolute jmps in disassembly of position independent code?

well megabeets was faster here is how to check it in windbg 0:000> ? . Evaluate expression: 1999570342 = 772f05a6 0:000> EB . 74 D9 0:000> U . L1 ntdll!LdrpDoDebuggerBreak+0x2c: 772f05a6 ...
blabb's user avatar
  • 16.4k
1 vote

Patching Application on OSX (Memory Protection)

IDA Pro does not allow patching an image by default. When IDA Pro analyzes a binary, it is read into its on format; the original executable from that point forward doesn't need to be around. You can ...
in70x's user avatar
  • 131
1 vote

Extract an image out of a application and customize after edited

Many images in OS X applications live in the bundle. Meaning they are linked with the application, but not compiled into the binary. One exception to this would be if the application is using an ...
JAL's user avatar
  • 605
1 vote

Can you decompile Actionscript 3 on a Mac?

I use https://www.free-decompiler.com/flash/ which is the best software I have seen. It has almost all features you can want. It also comes with a java library which can be handy to automate your ...
Labo's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible