Reverse Engineering

The iOS 8 security update bulletin has many fixed bugs, one of which is this one: A double free issue existed in the handling of Mach ports.

Aloha, Shakacon number 6 is over, it was a blast and I must confess it beat my expectations.

At BlackHat Asia 2014, Ming-chieh Pan and Sung-ting Tsai presented about Mac OS X Rootkits (paper and slides).

Enjoy it at Phrack.

After surviving the five shots at SyScan’s WhiskeyCon I am finally back home and you get a chance to see the slides and code for the TrustedBSD module I presented there.

Rex the Wonder Dog (here and here) is a proof of concept that uses TrustedBSD framework to install kernel level backdoors.

Our lovely GDB has been declared dead with Xcode 5 release.

There is no such thing as malware in OS X but last week another sample was spotted and made the “news”.

Oh this one has been into my head for so long that I finally decided to try and create the code for it.

New version available at the github repo, compatible with Mavericks and with a Cocoa app to control its features.

Disclaimer: This malware sample is not in any way related to Hacking Team (as far as I know) other than me making some jokes about them related to a future presentation about their OS X malware product.

For some reason Apple wants to change external kernel extensions location from /System/Library/Extensions to /Library/Extensions and introduced in Mavericks a code signing requirement for all extensions and/or drivers located in that folder.

One thing that really bothered me for a long time while debugging is the need to calculate the libraries loaded addresses versus the addresses at disk if you want to follow and comment library code in IDA.

Last week ESET released a Rootkit Detector tool for OS X.

Eight days and 10 flights later I am back from SyScan360 in Beijing.

Taipei is definitely one of my favourite cities in the world!

There’s a new attempt at jailbreak detection available at http://appminder.nesolabs.de.

A reader was asking me some questions related to some stuff I used in my crackme and I decided to release its source code.

I was lucky enough to get my hands on an updated version of interesting multiplatform virus and decided to reverse the OS X part.

One of the changes introduced by Mountain Lion was the removal of the old procmod convention for applications that want to access the task port of a process (aka for reversers, debuggers).

Suffering from post-conference boredom I decided to redo Onyx The Black Cat kernel extension to kickstart again my brain and get back to serious work.

NoSuchCon is over and I am finally back home.

Let me give you a small gift before moving my ass to Paris to attend and present at NoSuchCon.

Today I discovered that my slides contain a (stupid) error!

SyScan 2013, 10th anniversary edition is over!

This is an up-to-date version of the old original post about recompiling GDB and other open source packages available at opensource.apple.com.

More than half a year as passed since HITCON'12 and as far as I know no one cared much about implementing some sort of detection/protection against this type of attack (correct me if I’m wrong).

Another day, another lame malware attacking and spying on OS X users, and still using the same old lame Daemons and Agents approach to gain persistence at victims machine.

And 2012 (Gregorian calendar version) is almost over so it’s time to look back and ahead.

The question that most people want to be answered is if this is the book to replace the venerable Mac OS X Internals by Amit Singh.

It’s the lazy post season so I present you otool-ng.

Welcome back!

Happy birthday to this blog!

I really like my non-unibody Macbook Pro (awesome keyboard!)

I did yesterday a presentation about OS X Malware at Confraria SI in Lisbon, a monthly meeting between IT sec professionals and enthusiasts.

This chapter was supposed to be about additional methods to detect OS.X/Crisis but I had the evil idea of taking full control of Crisis, and played with this idea for the last couple of days.

I always had some strange attraction to rootkits and was thrilled to hear that Crisis had one.

Let’s continue our cute story about OS.X/Crisis, this time with the startup flow of the main backdoor module.

Mac malware is back to news spotlight, this time with Crisis (insert one of the other thousand names here _____).

This is an IDA plugin to extract Mach-O binaries located in IDA disassembly, either code or data segments.

After more than 30h inside planes and airports, I’m finally back home!

After 27h flying around the world and hanging at airports I’m finally back home.

I will be presenting in Taiwan at HiTCON, and in Seoul at Secuinside.

This is a cracking and keygen tutorial by the reader qwertyoruiop.

I have a passion for the Human brain and Human behavior and I love to experiment with anything.

One obstacle that I faced long time ago and came again into spotlight is how to recompile GDB for iOS.

Here it is, a merge between the x86 and ARM versions of gdbinit.

The title of this post is a partial rip-off of Dynamic Code Encryption as an Anti Dump and Anti Reverse Engineering measure blogpost.

I love to read about the Human brain and yesterday I was feeling weird about this thing.

Welcome to another “silly” evil idea that abuses bad design decisions, bad implementations and lazyness.