Reverse Engineering

Load command 9 cmd LC_UNIXTHREAD cmdsize 80 flavor i386_THREAD_STATE count i386_THREAD_STATE_COUNT eax 0x00000000 ebx 0x00000000 ecx 0x00000000 edx 0x00000000 edi 0x00000000 esi 0x00000000 ebp 0x00000000 esp 0x00000000 ss 0x00000000 eflags 0x00000000 eip…

The fun with Mach-O headers continues, this time with a “simple” trick to inject a new constructor and “spoofing” its location.

I smile when I think about this “feature”!

I developed this funny trick while trying to find a solution for a problem in a project.

This Sunday I received a valid keygen solution for my crackme.

My first OS X crackme is finally ready, after a long wait and some unnecessary teasing.

This is a OS X port of kad’s checkidt utility featured at Phrack #59.

Here is a small update to gdbinit with a new command, skip.

It sucks, sort of!

Merry Christmas or whatever applies or not to your particular case, and much more important, Happy New Year!

Let me start this with some sort of disclaimer.

A small update to gdbinit.

This is a simple plugin to display Mach-O headers inside IDA, something I miss from time to time.

This is just a simple post about using Xcode to create IDA C/C++ plugins.

And here we are with a few spare minutes!

I am a sucker for all OS X anti-debug promises I can find.

Dongles always had something mistique about them.

I like things well done and the healthy discussion with snare about this topic remembered me this PoC was a bit incomplete.

While poking around OS X implementation of TrustedBSD to write the sandbox guide I had the idea of trying to abuse it for backdooring purposes.

This blog is more or less 4 years old (the first draft post is from 2007/09/25)… Uau, time passed by quickly!

Here it is a version I consider good enough to come out of draft status.

After quite a few hours typing and testing stuff, here it is a very early draft of my attempt to document Apple’s sandbox implementation.

I was just messing with Apple’s sandbox implementation to see if it was possible to close a “vulnerability” in iTunes (more on that later after Apple answers my email) and decided to experiment with something that has been in my mind for a long time and n…

I just discovered that iTunes 10.4 finally introduced support to load m3u files.

One known problem with Apple’s fork of open source software is their slowness in fixing vulnerabilities and bugs.

This isn’t a rocket science post but more like some notes for future reference 😄.

Hello, It seems like things are very quiet and I only push gdbinit updates.

Hello, Just posting a small update to gdbinit.

I have added a new page called Papers that contains papers & presentations related to OS X and iOS (reversing, hacking, exploitation) that I have floating around in my harddisks.

MacHeist released a great puzzle game called The Heist, promising a prize when you managed to open the safe.

These last days I must be set on a Apple devices destruction mode.

I just found a nice interview with CrackZ here.

This will be a story in development, which is kinda of funny taking in account the target in question.

Let me start this post with a little rant.

I decided to mess around with this blog template style sheets and use a better font and change some minor things.

I was messing around with SoftwarePassport and Amit Singh’s tiny executable to find out why GDB doesn’t breakpoint in those two executables.

A reader sent me the link for a new software protection package called Software Passport (here).

I just saw the following at MSJ and the reaction there is simply childish, to not digress much about it.

I have decided to re-release my beginners tutorial, this time based on a crackme, so it deserves the upgrade to Universe instead of World.

I have fixed some of the missing stuff in gdbinit for iOS.

Well this one is driving me crazy so better ask for some help before I fire the big guns and go commando mode with this.

I just finished porting gdbinit to iOS.

These days I’ve been messing around with DTrace and the mach side of OS X kernel.

I shouldn’t be posting this because the guy doesn’t deserve any traffic he might get by writing this.

This will be a working in progress so this post might be updated a few times.

I have just finished reading the legal papers served against Geohot regarding the PS3 jailbreaking/cracking/private keys/etc.

The Mac App Store opened yesterday and a few hours after the web is already full of news about the hacking/cracking/defeat/whatever of the store.

The original method to hijack sysent table was described by Landon Fuller and then Braden Thomas updated it to Snow Leopard due to new location and lack of nsysent symbol.

Hi, There is a new GDB Cocoa frontend in town courtesy of Kurt.

Today I decided to give a look at Challenge #3 since it promised nasty tricks.