Hot answers tagged

11

Admittedly, I don't know much about OSX, or even Linux. But I would suggest looking at the GDB source code. GDB somehow is able to attach to running processes in order to debug them. I would imagine this would, at least, provide similar functionality that you're looking for and prove a decent place to start. If you're looking for a system call, it ...


11

When single-stepping through code, the T flag is set so that the CPU can break after the instruction completes execution. When an interrupt occurs, the state of the T flag is placed on the stack, and used when the iret instruction is executed by the handler. However, the iret instruction is one of a few instructions that causes a one-instruction delay in ...


11

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign produced a corrupt executable). You should use any of them with caution and backup the application before using them.


10

Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's why no "offline" decryption app has been made.


9

You can simply export the environment variable LD_PRELOAD (on Linux) or DYLD_INSERT_LIBRARIES (on OS X) pointing to (the full path of) your library before running your target, like in this example: https://stackoverflow.com/questions/6083337/overriding-malloc-using-the-ld-preload-mechanism This is for hooking functions to do whatever you want (not to spy ...


9

It is encrypted with AES so you will need the keys from windows.plist to decode. The format is (all stored in big-endian): offset value 0-3 magic ('NSCR' for PersistentUIRecord) 4-7 version (either '1000' or '0006') 8-11 NSWindowID (used to lookup 128-bit AES key stored in windows.plist) 12-15 record length (including from 0 to xxx) 16-xxx ...


8

It's the Mach-O header magic. From mach-o/loader.h: /* Constant for the magic field of the mach_header (32-bit architectures) */ #define MH_MAGIC 0xfeedface /* the mach magic number */ #define MH_CIGAM 0xcefaedfe /* NXSwapInt(MH_MAGIC) */ In OS X, the Mach-O header is often included as part of the __TEXT segment so it's mapped into ...


8

Check the trace family: ltrace: a library tracer strace: a kernel call (syscall) tracer ptrace: a programmable tracer and also: radare's itrace


7

Answering Your Question Directly: You can reverse Kernal Extensions with IDA Pro, Radare2, GDB or whatever dissasembler you would like. Yes, you will have to learn what C++ structures look like once disassembled. I can't answer the "static analysis or dynamic analysis?" question directly, since often the answer is "both, depending on exactly what you want."...


6

I've arrived at a solution by researching an answer for one of my Keychain subquestions. https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x. According to SecItem.h, this kSecAttrIsExtractable has been introduced with OS X 10.6. http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/...


6

Well, my Mac fu isn't too strong, but I have terminal access to a Mac and will give it a wild shot, hoping to provide you with the insight required to proceed. info sharedlibrary on the GDB prompt will tell you details about the ranges of the shared libraries inside of which those functions reside. But we know that already from the function names. ...


6

For OS X, dtrace should do the trick. dtrace is supposed to exist for Linux as well, though I don’t know how well it is supported, and I believe there are other equivalent tools there.


6

Here is a blog URL that lists free SWF Decompilers available. It includes programs for decompiling AS2 & AS3. Some of the tools listed there include: ActionScript Extractor SWFWire Decompiler JPEXS Free Flash Decompiler JP ActionScript decompiler (ASDec) HP SWFScan, etc. If you want to disassemble AS3, then I highly recommend SWFDump. swfdump (part ...


6

You can make use of the command (lldb) process launch --stop-at-entry to start the program. This stops you right at the entry point. From there lldb will tell you the address as well, in case this is what you are interested in. If instead you were interested in the actual main function, and not the entry point, you should have a look at the related ...


5

Commercial: If you're alright with commercial tools, Sothink's SWF decompiler for Mac should be capable of decompiling AS3 on Mac. I've only used the Windows version but I believe their features should be mostly similar. They have a feature to export FLA from a SWF file which works very well for most cases. Their product page mentions Support Flash CS3/...


5

Yes, pintool works on os x as well (Snow Leopard or newer for the current tech preview ver). http://software.intel.com/en-us/articles/pintool-downloads


5

It's possible since Hopper v3, under File > Read Debug Symbols File...


5

OK... it seems to be LZVN compression. Following on from Igor's suggestions I ran kextstat on my Mac, however that only listed: com.apple.AppleFSCompression.AppleFSCompressionTypeZlib com.apple.AppleFSCompression.AppleFSCompressionTypeDataless Looking at the strings inside the 'dataless' compression it turned out to be type 5: ...


5

As mentioned in your comment, the corresponding opcode to je 0x1000021c0 is 74 D9. Thus, there's no doubt that you are facing a relative JMP. Hopper is translating the relative JMP so it'll be easier for a reverse engineer to understand the flow of the code without having to calculate addresses. I'll demonstrate what Hopper does with a simple example using ...


4

Yes, they work as @broadway already pointed out. However, PIN under OSX have many-many restrictions, some of them documented and others not. The most noticeable feature it lacks is support for creating threads in a PIN tool.


4

The Calculator app is stripped as can be seen by running nm. You will need to find the address of the method using class-dump: $ class-dump -A /Applications/Calculator.app | grep showAbout - (void)showAbout:(id)arg1; // IMP=0x0000000100009939 However as the Calculator application is already running, the address has been slided because of ASLR. To find the ...


4

For OS X injection, I would look at the mach_star projects (mach_override and mach_inject) https://github.com/rentzsch/mach_star Also, Pin now has os x support http://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-downloads


4

If you think the encoding is wrong then you can try these 2 things: Try using x/hs as described here Each time you specify a unit size with x, that size becomes the default unit the next time you use x ... Use x /hs to display 16-bit char strings set the character set in gdb as described here gdb has no way to automatically recognize which ...


4

the numeric argument is is an offset into the "compressed dyld info" stream of bytecodes. see https://stackoverflow.com/a/8836580 (iOS/arm but still applies)


4

I wrote a Python script that parses entry points and imports from a Mach-O executable for one of my projects. The trick is to parse the LC_DYLD or LC_DYLD_ONLY loader commands. These two commands encode three import tables: bound symbols, weak symbols, and lazy symbols. struct dyld_info_command { uint32_t cmd; uint32_t cmdsize; uint32_t rebase_off; ...


4

There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections? The kernel simply loads the Universal Binary at execution time, parses the fat_arch structure(s) and selects a matching architecture type. So in my understanding there is no need for ...


4

The instructions mov qword [rbp - 16], rax mov rax, qword [rbp - 16] are created by the compiler which is using stack based memory allocation to store the result from the NSString objc call. If you compile with optimizations, the compiler should eliminate the need to store the value in stack altogether. The mov al, 0 is set as an input to the NSLog ...


3

Tools like Qemu or Bochs are IMO pretty similar to DBI frameworks conceptually and they work on the entire system, including the kernel. Research efforts like BitBlaze and S2E have used modified versions of Qemu to trace kernel mode components for bug finding. The key difference, I think, is that Qemu/Bochs as whole system emulators do not present a by ...


3

According to fG!'s blog entry on OSX-Crisis (recommended read), the true EntryPoint is located in the segment __INIT_STUB, with code execution permission.


3

Crisis is trying to locate dyld location in that piece of code: 32bits dyld is usually located at 8FE00000 - it uses that to solve symbols, if I'm not mistaken. Check my Crisis analysis if you haven't already.


Only top voted, non community-wiki answers of a minimum length are eligible