Hot answers tagged

14

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign produced a corrupt executable). You should use any of them with caution and backup the application before using them.


11

Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's why no "offline" decryption app has been made.


10

It is encrypted with AES so you will need the keys from windows.plist to decode. The format is (all stored in big-endian): offset value 0-3 magic ('NSCR' for PersistentUIRecord) 4-7 version (either '1000' or '0006') 8-11 NSWindowID (used to lookup 128-bit AES key stored in windows.plist) 12-15 record length (including from 0 to xxx) 16-xxx ...


7

You can make use of the command (lldb) process launch --stop-at-entry to start the program. This stops you right at the entry point. From there lldb will tell you the address as well, in case this is what you are interested in. If instead you were interested in the actual main function, and not the entry point, you should have a look at the related ...


7

Answering Your Question Directly: You can reverse Kernal Extensions with IDA Pro, Radare2, GDB or whatever dissasembler you would like. Yes, you will have to learn what C++ structures look like once disassembled. I can't answer the "static analysis or dynamic analysis?" question directly, since often the answer is "both, depending on exactly what you want."...


6

I've arrived at a solution by researching an answer for one of my Keychain subquestions. https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x. According to SecItem.h, this kSecAttrIsExtractable has been introduced with OS X 10.6. http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/...


6

Well, my Mac fu isn't too strong, but I have terminal access to a Mac and will give it a wild shot, hoping to provide you with the insight required to proceed. info sharedlibrary on the GDB prompt will tell you details about the ranges of the shared libraries inside of which those functions reside. But we know that already from the function names. ...


5

OK... it seems to be LZVN compression. Following on from Igor's suggestions I ran kextstat on my Mac, however that only listed: com.apple.AppleFSCompression.AppleFSCompressionTypeZlib com.apple.AppleFSCompression.AppleFSCompressionTypeDataless Looking at the strings inside the 'dataless' compression it turned out to be type 5: ...


5

It's possible since Hopper v3, under File > Read Debug Symbols File...


5

The instructions mov qword [rbp - 16], rax mov rax, qword [rbp - 16] are created by the compiler which is using stack based memory allocation to store the result from the NSString objc call. If you compile with optimizations, the compiler should eliminate the need to store the value in stack altogether. The mov al, 0 is set as an input to the NSLog ...


5

As mentioned in your comment, the corresponding opcode to je 0x1000021c0 is 74 D9. Thus, there's no doubt that you are facing a relative JMP. Hopper is translating the relative JMP so it'll be easier for a reverse engineer to understand the flow of the code without having to calculate addresses. I'll demonstrate what Hopper does with a simple example using ...


4

The Calculator app is stripped as can be seen by running nm. You will need to find the address of the method using class-dump: $ class-dump -A /Applications/Calculator.app | grep showAbout - (void)showAbout:(id)arg1; // IMP=0x0000000100009939 However as the Calculator application is already running, the address has been slided because of ASLR. To find the ...


4

I wrote a Python script that parses entry points and imports from a Mach-O executable for one of my projects. The trick is to parse the LC_DYLD or LC_DYLD_ONLY loader commands. These two commands encode three import tables: bound symbols, weak symbols, and lazy symbols. struct dyld_info_command { uint32_t cmd; uint32_t cmdsize; uint32_t rebase_off; ...


4

the numeric argument is is an offset into the "compressed dyld info" stream of bytecodes. see https://stackoverflow.com/a/8836580 (iOS/arm but still applies)


4

There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections? The kernel simply loads the Universal Binary at execution time, parses the fat_arch structure(s) and selects a matching architecture type. So in my understanding there is no need for ...


3

I solved this problem for gdb a few years ago, see Import class-dump info into GDB on Stack Overflow. I’m not sure if lldb has an add-symbol-file equivalent command. Loading symbols from location in memory from the lldb-dev mailing list suggests that you may have to create your own .dSYM file instead of a .stabs file.


3

To develop a driver, there's basically 3 steps you have to do: Learn about Linux driver programming in general. This is independent of your specifi hardware, and involves things like "How do i convert virtual memory addresses to physical and back? How do i read bytes / write bytes to hardware registers? How do i yield the CPU while waiting for the hardware ...


3

according to this post, you can use afscexpand tool to decompress such files.if you prefer the hard way, xnu source code may be of help.


3

The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the application in lldb, no slide is applied so the addresses are the same. Here is an example of it in action from two different Calculator apps running 0x00000200 ...


3

Honestly, the stock reversible debugging support in gdb is not all that useful. It's really slow (because it records individual instructions), so you generally have to turn it on just for a critical piece of the program. I don't know of very many people that use it, which may explain why it hasn't been ported widely. I'm not familiar with QIRA's ...


3

Dynamic instrumentation tools like Frida or DynomoRIO are probably your best bet. Traditional code injection approaches like mach_inject on os x or detours on windows are things you could look into as well.


3

Note: I don't know much about OSX, and wouldn't have answered if there had been another answer after 24 hours. According to Apple, getconf uses sysconf and confstr to find these configuration values, with confstr handling DARWIN_USER_CACHE_DIR. The confstr library function might well hard-code these values - if you check the glibc source, you see the glibc ...


3

I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here. In my case, I did the following: $ pip2 install hexdump pycrypto pyopenssl $ git clone https://github.com/gremwell/chainbreaker.git && cd chainbreaker $ python2 chainbreaker.py -f ~/Library/Keychains/login.keychain-db -p <PASS> $ ...


3

UIApp is a shorthand for [UIApplication sharedApplication]. As this is not an iOS app, but an OS X app you need to use [NSApplication sharedApplication] instead.


3

There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes). Quote from x86asm.net about JMPF: AMD64 Architecture Programmer's Manual Volume 3: If the operand-size is 32 or 64 bits, the operand is a 16-bit selector followed by a 32-bit offset. (On AMD64 architecture, 64-bit offset is not supported) ...


3

There are several aspects for this: if the app is not protected with some sort of packaging you just need to find the place that you want to patch with the help of debugger (when the app is running) or static disassembler (otool, hopper disassembler, ida disassembler) understand how many bytes your patch takes (for example with online tool) understand how ...


2

Objective-C works a bit different than most languages. You have selectors in the _ObjC section which are used as arguments to obj_msgSend (which is how just about everything is invoked). There are no direct calls between functions. I suggest starting off with the Cameron Hotchkies slides on this topic from REcon 2008.


2

Try this: (lldb) break set -n main (lldb) r (lldb) thread backtrace frame #0: 0x0000000000405696 app`main(argc=1, argv=...) + 22 at app.cpp:11 frame #1: 0x00007ffff7216ec5 libc.so.6`__libc_start_main + 245 frame #2: 0x0000000000401f79 app The frame below (before) main is the one you want, and it's showing the library and function name. You can set a ...


2

You can get some ideas from the dumpdecrypted tool by Stefan Esser. It's for iPhone but shouldn't be too difficult to port to OS X.


2

It is unlikely that you will be able to get any information about the device via the USB port. Most likely, that would just provide access to either a memory card or read/write flash memory. What you probably want to do is open up the device and look for any ROM of flash memory soldered directly to the board. You may have some luck with something like an ...


Only top voted, non community-wiki answers of a minimum length are eligible