Reverse Engineering

The MBA is over and I’m enjoying my vacations to clear stuff from the Todo list, to read books, to play some games and to do other stuff.

Hi!

I had this one working for a long time but I hadn’t released it because I was trying to hijack fork and vfork calls.

Hello, I have just added a page to collect crackmes for OS X.

I was bored and decided to fix gdbinit to support 64 bit binaries.

I have been thinking about this and how to get this blog back to life.

I just finished my brief analysis on this protection and I have a very macro view about it and how to break it.

For a long time I have been annoyed by the information displayed by otool -l because it mixes hexadecimal with decimal information.

November was a pretty busy month with exams and assignments to be delivered.

Some folks were complaining about problems with otx and Snow Leopard so I decided to boot my Snow Leopard install and give it a try… Well they were right since Snow Leopard compiles 64 bit binaries by default. otx v0.16b seems to have problems so you will…

Things have been very quiet since the beginning of September… Well my MBA has started and my free time until now has been ZERO!

Here you have the patches I did for GDB: To fix problem with gdbinit To display raw bytes in x/i and disassemble commands To warn about possible number of sections anti-debug trick You can download a single patch for all changes or one for each individual…

After having found the source of the GDB anti-debug trick, I started modifying GDB to work around the problem and fix the number of sections on the fly (it’s simple to calculate the real number of sections).

Today I bring you something from the old projects trunk.

Well, it seems this is the GDB post season!

It’s not a breakthrough post but I finally found where the bug that messed up gdbinit is located.

I had unconsciously found the workaround a few months ago while hacking around Little Snitch with kernel debugging.

Greetings !

Since otool and otx can’t disassemble the packed binary, Andreas Gumundsson wrote a quick tool to do that job, using Udis86, a disassembler library for x86 and AMD64.

Someone at macserialjunkie board posted a problem with the mpress packer.

Here it is, another example of my super l33t lame coding skills!

From the department of useless stuff comes a simple trick… A few days ago, a reader sent me an email asking about obfuscated code, in what appeared to be Apple’s binary protection.

A few months ago while discussing with some user about code signing (PTHPasteboard project), I had the idea to “revirgin” the code signed binary by removing the Mach-O LC_CODE_SIGNATURE command.

There are days I “hate” my obsessive and curious mind!

While cleaning my hard disk I have found a zip file with a few old Mac OS X cracking tuts.

I have managed to bypass Little Snitch 3 hour limit with a one or two bytes patch (can’t remember and too lazy to check it now) three days after I had access to kernel debugging.

Version 0.3 is here.

I made a mistake in this tutorial!

Just look at this: I just got Little Snitch to keep working even with network filter being off (that should be equivalent to expired 3 hour trial).

I love VMware (used it since its first releases) and I love it even more now 😄.

Hey, today is a slow day and I got a suggestion to write about serial phishing.

Things are a bit slow around here.

It seems there is a trojan or botnet binary for OS X in the wild.

While searching the web for some GDB patches I stumbled upon this fix to assemble function from gdbinit by Tavis Ormandy (good work!).

I wanted to recompile GDB so I can modify its source and add some custom patches to enhance its output… Easier said than done!

I forgot to mention this previously but there is a mailing list available at http://0x90.org/mailman/listinfo/xso and an IRC channel at irc.freenode.net, #osxre.

End of the year is slow and I was a bit inspired so I decided to hack around another features I was missing from gdbinit!

While I was messing with gdbinit three weeks ago, I added a small feature that displays the messages being sent to objc_msgSend.

I was trying to add some features to gdbinit and I needed global variables.

While browsing around http://www.apple.com/downloads to check for any interesting software (I really like the Featured 3rd party and latest software sections) I found this well designed CD burning app, Disco (http://www.discoapp.com).

There is a new version of original +mammon gdbinit, 7.0 (available at http://truthix.dump.cz/files/.gdbinit).

Here it is with support for Leopard and extended attributes.

I started working on Remote Buddy (http://www.iospirit.com) to test my module Onyx The Black Cat.

Here it is my crazy idea to create an anti anti-debug kernel module so reversing efforts get a little easier and faster against “hostile” code.

Excellent book!

Hello, If you want to have some fun and maybe improve your security/reversing skills, you might try this site http://www.dareyourmind.net.

Beowulf pointed out to PTHPasteboard application protection looked very similar to You Control Desktops.

A peak of work and vacations results in no reversing for the past weeks :-(.

Little Snitch is an awesome target to learn tons of stuff about Mac OS X.

Landon Fuller http://landonf.bikemonkey.org/code/macosx created a kernel module to bypass the PTRACE_DENY_ATTACH “anti-debug” feature of Mac OS X.