18
votes
Accepted
Remove code signature from a Mac binary
There are tools for that, as well as a codesign flag --remove-signature
First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
- 11.8k
7
votes
Accepted
In a Mach-O executable, how can I find which function a stub targets?
I wrote a Python script that parses entry points and imports from a Mach-O executable for one of my projects. The trick is to parse the LC_DYLD or LC_DYLD_ONLY loader commands. These two commands ...
- 331
5
votes
Accepted
Creating a patcher for a mac app
There are several aspects for this:
if the app is not protected with some sort of packaging
you just need to find the place that you want to patch with the help of debugger (when the app is running) ...
- 3,062
5
votes
Accepted
Why are there absolute jmps in disassembly of position independent code?
As mentioned in your comment, the corresponding opcode to je 0x1000021c0 is 74 D9. Thus, there's no doubt that you are facing a relative JMP. Hopper is translating the relative JMP so it'll be easier ...
- 9,009
5
votes
Accepted
Objective-C disassembling - I dont understand this code
The instructions
mov qword [rbp - 16], rax
mov rax, qword [rbp - 16]
are created by the compiler which is using stack based memory allocation to store the result from the NSString objc call. If ...
- 1,341
4
votes
Extract non-extractable private key from OS X Keychain
I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here.
In my case, I did the following:
$ pip2 install hexdump pycrypto pyopenssl
$ git clone ...
- 141
4
votes
Accepted
Order of architecture headers in fat (universal) executables
There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections?
The kernel simply loads ...
- 1,257
3
votes
How do I denote and use JMP /5 in byte code
There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes).
Quote from x86asm.net about JMPF:
AMD64 Architecture Programmer's Manual Volume 3: ...
- 2,906
3
votes
Reverse engineering the PluginKit MacOS framework
My offers won't be specific for your task, so I will try to answer your second question. I hope these helps to you or anyone having a similar task. Since your task is on a quite specific subject, I ...
- 157
2
votes
Accepted
Changing NSUserDefaults of a mac or iOS binary executable
The values are stored in a plist file under ~/Library/Preferences (or ~/Library/Containers/.../ if sandboxed). You can find more information about it from Apple's documentation.
The easiest way to ...
- 1,341
2
votes
Accepted
whats the purpose of this code snippet?
This is most likely an optimized tail call. The original code probably looked similar to this:
int f1()
{
//some code which was optimized out
return f2();// &f2=0x10002135a
}
Since there is no ...
- 36.9k
2
votes
Remove code signature from a Mac binary
Another blunt way that seemed to work for me on Catalina (note that this strips all attributes):
xattr -cr /path/to/your/program.app
- 21
2
votes
Reverse engineering a PXP3 Slimstation
It is unlikely that you will be able to get any information about the device via the USB port. Most likely, that would just provide access to either a memory card or read/write flash memory.
What ...
- 615
2
votes
Accepted
Is there an up to date fork of otx?
The most up to date fork I have found of otx is Cai's. I have tried the CLI interface of his v1.7: Build 566 release on macOS 10.11.6 and it runs fine for basic disassembly, albeit on invoking it ...
- 261
2
votes
Accepted
MacOS: Output to console in non-console app
It really depends what the application you are trying to run is logging to.
If the application uses NSLog() and other associated Cocoa APIs, you're in luck. The output should appear in the Apple ...
- 615
1
vote
Accepted
How to determine the data type of a register
Short story: you can't without context.
In memory, everything is data, and your registers will always be populated with data.
Sometime, you can guess the data type (a small integer, some characters or ...
- 709
1
vote
Accepted
Attempting to reverse engineer an iOS OTA payload-like archival format
YAA is possibly the signature of yaa archives, so try using the yaa utility on those files.
- 36.9k
1
vote
Why are there absolute jmps in disassembly of position independent code?
well megabeets was faster
here is how to check it in windbg
0:000> ? .
Evaluate expression: 1999570342 = 772f05a6
0:000> EB . 74 D9
0:000> U . L1
ntdll!LdrpDoDebuggerBreak+0x2c:
772f05a6 ...
- 16.5k
1
vote
Extract an image out of a application and customize after edited
Many images in OS X applications live in the bundle. Meaning they are linked with the application, but not compiled into the binary. One exception to this would be if the application is using an ...
- 615
1
vote
Patching Application on OSX (Memory Protection)
IDA Pro does not allow patching an image by default. When IDA Pro analyzes a binary, it is read into its on format; the original executable from that point forward doesn't need to be around.
You can ...
- 131
1
vote
Can you decompile Actionscript 3 on a Mac?
I use https://www.free-decompiler.com/flash/ which is the best software I have seen. It has almost all features you can want. It also comes with a java library which can be handy to automate your ...
- 111
Only top scored, non community-wiki answers of a minimum length are eligible