<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Reverse Engineering Mac OS X &#187; fG!</title>
	<atom:link href="http://reverse.put.as/author/admin/feed/" rel="self" type="application/rss+xml" />
	<link>http://reverse.put.as</link>
	<description>Reverse Engineering for fun and pleasure!</description>
	<lastBuildDate>Sun, 05 Feb 2012 01:08:42 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>Anti-disassembly &amp; obfuscation #1: Apple doesn&#8217;t follow their own Mach-O specifications?</title>
		<link>http://reverse.put.as/2012/02/02/anti-disassembly-obfuscation-1-apple-doesnt-follow-their-own-mach-o-specifications/</link>
		<comments>http://reverse.put.as/2012/02/02/anti-disassembly-obfuscation-1-apple-doesnt-follow-their-own-mach-o-specifications/#comments</comments>
		<pubDate>Wed, 01 Feb 2012 23:13:53 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1284</guid>
		<description><![CDATA[I smile when I think about this &#8220;feature&#8221;! I liked it so much that things got out of control and I wrote a crackme to show it. It happens because Apple doesn&#8217;t follow their own documentation/specification and the reversing tools of the trade do. The result is that IDA terminates, disassemblers output the wrong disassembly, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/02/02/anti-disassembly-obfuscation-1-apple-doesnt-follow-their-own-mach-o-specifications/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Anti-debug trick #1: Abusing Mach-O to crash GDB</title>
		<link>http://reverse.put.as/2012/01/31/anti-debug-trick-1-abusing-mach-o-to-crash-gdb/</link>
		<comments>http://reverse.put.as/2012/01/31/anti-debug-trick-1-abusing-mach-o-to-crash-gdb/#comments</comments>
		<pubDate>Tue, 31 Jan 2012 21:28:22 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[anti-debug]]></category>
		<category><![CDATA[gdb]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1271</guid>
		<description><![CDATA[I developed this funny trick while trying to find a solution for a problem in a freelance project. It is pretty easy to implement and fun The trick consists in abusing the offset field in the dylib_command and pointing it to somewhere else. From the Mach-O File Format Reference, the command structures are: struct dylib_command [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/01/31/anti-debug-trick-1-abusing-mach-o-to-crash-gdb/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>We have a crackme winner!!!</title>
		<link>http://reverse.put.as/2012/01/31/we-have-a-crackme-winner/</link>
		<comments>http://reverse.put.as/2012/01/31/we-have-a-crackme-winner/#comments</comments>
		<pubDate>Tue, 31 Jan 2012 16:09:41 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1267</guid>
		<description><![CDATA[This Sunday I received a valid keygen solution for my crackme. Congratulations to the reverser who wishes to remain anonymous. When the solution is available our brain stops thinking and goes into lazy mode. So, my question is when do you want to have me starting to explain some of the tricks used in that [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/01/31/we-have-a-crackme-winner/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>My first crackme&#8230; from hell, I hope :-)</title>
		<link>http://reverse.put.as/2012/01/24/my-first-crackme-from-hell-i-hope/</link>
		<comments>http://reverse.put.as/2012/01/24/my-first-crackme-from-hell-i-hope/#comments</comments>
		<pubDate>Tue, 24 Jan 2012 02:20:58 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1255</guid>
		<description><![CDATA[My first OS X crackme is finally &#8220;ready&#8221;, after a long wait and some unnecessary teasing. &#8220;Ready&#8221; means that it is good enough to be released and hopefully give you some trouble to reverse and crack it. I still have many more ideas to implement and some areas could be more polished &#8211; it was [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/01/24/my-first-crackme-from-hell-i-hope/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>A Mac OS X port of Phrack&#8217;s CheckIDT util by kad, or another way to retrieve sysent address</title>
		<link>http://reverse.put.as/2012/01/10/a-mac-os-x-port-of-phracks-checkidt-util-by-kad-or-another-way-to-retrieve-sysent-address/</link>
		<comments>http://reverse.put.as/2012/01/10/a-mac-os-x-port-of-phracks-checkidt-util-by-kad-or-another-way-to-retrieve-sysent-address/#comments</comments>
		<pubDate>Tue, 10 Jan 2012 18:40:52 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1243</guid>
		<description><![CDATA[This is a OS X port of kad&#8217;s checkidt utility featured at Phrack #59. It requires /dev/kmem to be active since task_for_pid on kernel task is prohibited since Snow Leopard. I have added an option to calculate the sysent address via the IDT. The code is not very fail proof because it uses the opcode [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/01/10/a-mac-os-x-port-of-phracks-checkidt-util-by-kad-or-another-way-to-retrieve-sysent-address/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Gdbinit v7.4.4 &#8211; the skip command</title>
		<link>http://reverse.put.as/2012/01/10/gdbinit-v7-4-4-the-skip-command/</link>
		<comments>http://reverse.put.as/2012/01/10/gdbinit-v7-4-4-the-skip-command/#comments</comments>
		<pubDate>Tue, 10 Jan 2012 00:07:07 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>
		<category><![CDATA[gdb]]></category>
		<category><![CDATA[gdbinit]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1227</guid>
		<description><![CDATA[Here is a small update to gdbinit with a new command, &#8220;skip&#8221;. This command will skip over the current instruction, without executing it. Usually I do it manually by set $pc=newvalue but this involves copy&#38;paste and mouse movements and gets boring after a while. It&#8217;s great to skip over calls while you are trying some [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/01/10/gdbinit-v7-4-4-the-skip-command/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Some comments about plugin-alliance.com protection&#8230;</title>
		<link>http://reverse.put.as/2012/01/09/some-comments-about-plugin-alliance-com-protection/</link>
		<comments>http://reverse.put.as/2012/01/09/some-comments-about-plugin-alliance-com-protection/#comments</comments>
		<pubDate>Mon, 09 Jan 2012 21:43:43 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1215</guid>
		<description><![CDATA[It sucks, sort of! Let me rewind to the beginning I was very curious about this one because it was announced with great fanfare. I interpreted it as something more robust than it really is &#8211; maybe I was over enthusiastic with the &#8220;we know this will be cracked someday&#8221; sentence. Some brief comments: - [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/01/09/some-comments-about-plugin-alliance-com-protection/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Merry Christmas, Happy New Year and some notes&#8230;</title>
		<link>http://reverse.put.as/2011/12/18/merry-christmas-happy-new-year-and-some-notes/</link>
		<comments>http://reverse.put.as/2011/12/18/merry-christmas-happy-new-year-and-some-notes/#comments</comments>
		<pubDate>Sun, 18 Dec 2011 04:16:25 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1188</guid>
		<description><![CDATA[Merry Christmas or whatever applies or not to your particular case, and much more important, Happy New Year! The world is messed up and it will probably get worse in 2012. Cheer up and be positive! Let me write some quick notes about some stuff: - Take a look at Snare&#8217;s presentation about OS X [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/12/18/merry-christmas-happy-new-year-and-some-notes/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Evil iTunes Plugins from Hell</title>
		<link>http://reverse.put.as/2011/11/22/evil-itunes-plugins-from-hell/</link>
		<comments>http://reverse.put.as/2011/11/22/evil-itunes-plugins-from-hell/#comments</comments>
		<pubDate>Tue, 22 Nov 2011 04:46:25 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1127</guid>
		<description><![CDATA[Let me start this with some sort of disclaimer. I do not support/condone stealing credit card information, logins, and other personal information. Disclosing security issues is always a double edge sword and a tricky problem with some politics in the mix. This problem was reported almost 3 months ago to Apple. It&#8217;s still not fixed [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/11/22/evil-itunes-plugins-from-hell/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Gdbinit v7.4.3</title>
		<link>http://reverse.put.as/2011/11/04/gdbinit-v7-4-3/</link>
		<comments>http://reverse.put.as/2011/11/04/gdbinit-v7-4-3/#comments</comments>
		<pubDate>Fri, 04 Nov 2011 21:19:23 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1101</guid>
		<description><![CDATA[A small update to gdbinit. Many thanks to snare and Plouj for their reports Here is the changelog: Version 7.4.3 (04/11/2011) - Modified &#8220;hexdump&#8221; command to support a variable number of lines (optional parameter). - Removed restrictions on type of addresses used in the &#8220;dd&#8221; command. - Modified the assemble command to support 64bits &#8211; [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/11/04/gdbinit-v7-4-3/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Display Mach-O headers plugin for IDA</title>
		<link>http://reverse.put.as/2011/11/03/display-mach-o-headers-plugin-for-ida/</link>
		<comments>http://reverse.put.as/2011/11/03/display-mach-o-headers-plugin-for-ida/#comments</comments>
		<pubDate>Thu, 03 Nov 2011 03:54:40 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1090</guid>
		<description><![CDATA[This is a simple plugin to display mach-o headers inside IDA, something I miss from time to time. It was a good excuse to mess a little with IDA SDK. It&#8217;s not quite what I had initially in mind but it does the job. I was thinking about something more sophisticated such as allow to [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/11/03/display-mach-o-headers-plugin-for-ida/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>How to create IDA C/C++ plugins with XCode</title>
		<link>http://reverse.put.as/2011/10/31/how-to-create-ida-cc-plugins-with-xcode/</link>
		<comments>http://reverse.put.as/2011/10/31/how-to-create-ida-cc-plugins-with-xcode/#comments</comments>
		<pubDate>Mon, 31 Oct 2011 02:22:27 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1078</guid>
		<description><![CDATA[This is just a simple post about using XCode to create IDA C/C++ plugins. Nothing fancy here For great references about IDA SDK plugin writing check out The IDA Pro Book by Chris Eagle and binarypool.com tutorial. XCode 3.2.6 is the reference. The resulting project loads and compiles without any issues into XCode 4. Why [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/10/31/how-to-create-ida-cc-plugins-with-xcode/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Using OS X TrustedBSD framework to protect critical files</title>
		<link>http://reverse.put.as/2011/10/27/using-os-x-trustedbsd-framework-to-protect-critical-files/</link>
		<comments>http://reverse.put.as/2011/10/27/using-os-x-trustedbsd-framework-to-protect-critical-files/#comments</comments>
		<pubDate>Thu, 27 Oct 2011 00:20:59 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1070</guid>
		<description><![CDATA[And here we are with a few spare minutes! My baby girl is a little cute devil who, like me, isn&#8217;t very found of sleeping all the time. She&#8217;s taking a lot of my attention so mom can rest. Well, it&#8217;s time well spent while I still have lots of it Let&#8217;s get back to [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/10/27/using-os-x-trustedbsd-framework-to-protect-critical-files/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Poking around Sentinel HASP Envelope for Mac OS X :-)</title>
		<link>http://reverse.put.as/2011/10/13/poking-around-sentinel-hasp-envelope-for-mac-os-x/</link>
		<comments>http://reverse.put.as/2011/10/13/poking-around-sentinel-hasp-envelope-for-mac-os-x/#comments</comments>
		<pubDate>Wed, 12 Oct 2011 23:12:10 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[dongle]]></category>
		<category><![CDATA[hasp]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1065</guid>
		<description><![CDATA[I am a sucker for all OS X anti-debug promises I  can find. There are so few tricks available that I am always curious to see if there is something new in town. So I started poking around Sentinel HASP Envelope for OS X to see what they use to fool my dear debuggers. Well, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/10/13/poking-around-sentinel-hasp-envelope-for-mac-os-x/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>A small rant about dongles: the developer who can&#8217;t correctly implement a HASP!</title>
		<link>http://reverse.put.as/2011/10/11/a-small-rant-about-dongles-the-developer-who-cant-correctly-implement-a-hasp/</link>
		<comments>http://reverse.put.as/2011/10/11/a-small-rant-about-dongles-the-developer-who-cant-correctly-implement-a-hasp/#comments</comments>
		<pubDate>Tue, 11 Oct 2011 22:30:17 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1058</guid>
		<description><![CDATA[Dongles always had something mistique about them. Before this new age of packers, cryptors, etc, they were the top target to beat. In practice, that fame was only real in a reduced set of applications that correctly implemented the dongle. Most dongle-protected software features bad implementations. Developers don&#8217;t spend enough time in this area or [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/10/11/a-small-rant-about-dongles-the-developer-who-cant-correctly-implement-a-hasp/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Fixes for the TrustedBSD backdoor &#8211; Rex the wonder dog v0.2</title>
		<link>http://reverse.put.as/2011/09/26/fixes-for-the-trustedbsd-backdoor-rex-the-wonder-dog-v0-2/</link>
		<comments>http://reverse.put.as/2011/09/26/fixes-for-the-trustedbsd-backdoor-rex-the-wonder-dog-v0-2/#comments</comments>
		<pubDate>Mon, 26 Sep 2011 22:45:53 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>
		<category><![CDATA[backdoor]]></category>
		<category><![CDATA[rootkit]]></category>
		<category><![CDATA[sandbox]]></category>
		<category><![CDATA[trustedbsd]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1048</guid>
		<description><![CDATA[I like things well done and the healthy discussion with snare about this topic remembered me this PoC was a bit incomplete. So I decided to close the missing gaps. The fix is pretty simple. Retrieve a new kauth credential with uid and gid equal to 0 and replace the old one (the code seems [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/09/26/fixes-for-the-trustedbsd-backdoor-rex-the-wonder-dog-v0-2/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Abusing OS X TrustedBSD framework to install r00t backdoors&#8230;</title>
		<link>http://reverse.put.as/2011/09/18/abusing-os-x-trustedbsd-framework-to-install-r00t-backdoors/</link>
		<comments>http://reverse.put.as/2011/09/18/abusing-os-x-trustedbsd-framework-to-install-r00t-backdoors/#comments</comments>
		<pubDate>Sun, 18 Sep 2011 16:03:56 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>
		<category><![CDATA[backdoor]]></category>
		<category><![CDATA[rootkit]]></category>
		<category><![CDATA[sandbox]]></category>
		<category><![CDATA[trustedbsd]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1036</guid>
		<description><![CDATA[While poking around OS X implementation of TrustedBSD to write the sandbox guide I had the idea of trying to abuse it for backdooring purposes. It&#8217;s kind of funny that something designed to protect can be so &#8220;easily&#8221; abused to install backdoors. This is not rocket science or a big breakthru post &#8211; I was [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/09/18/abusing-os-x-trustedbsd-framework-to-install-r00t-backdoors/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>4th anniversary&#8230;</title>
		<link>http://reverse.put.as/2011/09/14/4th-anniversary/</link>
		<comments>http://reverse.put.as/2011/09/14/4th-anniversary/#comments</comments>
		<pubDate>Wed, 14 Sep 2011 01:40:11 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1032</guid>
		<description><![CDATA[This blog is more or less 4 years old (the first draft post is from 2007/09/25) &#8230; Uau, time passed by quickly! Mistakes were made, valuable lessons were learnt, new tricks developed, knowledge improved, and most important, fun! I created this blog because there was so little public information about reversing in OS X. The [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/09/14/4th-anniversary/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Apple Sandbox Guide v1.0</title>
		<link>http://reverse.put.as/2011/09/14/apple-sandbox-guide-v1-0/</link>
		<comments>http://reverse.put.as/2011/09/14/apple-sandbox-guide-v1-0/#comments</comments>
		<pubDate>Wed, 14 Sep 2011 01:18:08 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>
		<category><![CDATA[guide]]></category>
		<category><![CDATA[sandbox]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1025</guid>
		<description><![CDATA[Here it is a version I consider good enough  to come out of draft status. I have added more information &#8211; one thing I was especially interested was to match the available operations in the SBPL syntax with the system/kernel functions that they control. This helps to better understand what is the impact of each [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/09/14/apple-sandbox-guide-v1-0/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Apple&#8217;s Sandbox Guide v0.1 &#8211; early draft release</title>
		<link>http://reverse.put.as/2011/09/03/apples-sandbox-guide-v0-1-early-draft-release/</link>
		<comments>http://reverse.put.as/2011/09/03/apples-sandbox-guide-v0-1-early-draft-release/#comments</comments>
		<pubDate>Sat, 03 Sep 2011 01:31:30 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>
		<category><![CDATA[guide]]></category>
		<category><![CDATA[sandbox]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1008</guid>
		<description><![CDATA[After quite a few hours typing and testing stuff, here it is a very early draft of my attempt to document Apple&#8217;s sandbox implementation. The most difficult part in writing technical documentation or business plans is to get the first draft more or less ready. It&#8217;s even worse when there&#8217;s not much information about the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/09/03/apples-sandbox-guide-v0-1-early-draft-release/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Using Apple&#8217;s sandbox feature for reversing purposes :-)</title>
		<link>http://reverse.put.as/2011/08/30/using-apples-sandbox-feature-for-reversing-purposes/</link>
		<comments>http://reverse.put.as/2011/08/30/using-apples-sandbox-feature-for-reversing-purposes/#comments</comments>
		<pubDate>Tue, 30 Aug 2011 22:41:56 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1000</guid>
		<description><![CDATA[I was just messing with Apple&#8217;s sandbox implementation to see if it was possible to close a &#8220;vulnerability&#8221; in iTunes (more on that later after Apple answers my email) and decided to experiment with something that has been in my mind for a long time and never bothered to try. The idea is to use [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/08/30/using-apples-sandbox-feature-for-reversing-purposes/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Removing iTunes 10.4 m3u processing feature with a small loader</title>
		<link>http://reverse.put.as/2011/08/25/removing-itunes-10-4-m3u-processing-feature-with-a-small-loader/</link>
		<comments>http://reverse.put.as/2011/08/25/removing-itunes-10-4-m3u-processing-feature-with-a-small-loader/#comments</comments>
		<pubDate>Thu, 25 Aug 2011 21:42:58 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=985</guid>
		<description><![CDATA[I just discovered that iTunes 10.4 finally introduced support to load m3u files. If you are importing large quantities of mp3 archives like me then you probably will be very annoyed by the mess that iTunes 10.4 will make out of this &#8211; playlists will be created and a ugly mess will emerge (and takes [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/08/25/removing-itunes-10-4-m3u-processing-feature-with-a-small-loader/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Another patch for Apple&#8217;s gdb: the define/commands problem</title>
		<link>http://reverse.put.as/2011/08/20/another-patch-for-apples-gdb-the-definecommands-problem/</link>
		<comments>http://reverse.put.as/2011/08/20/another-patch-for-apples-gdb-the-definecommands-problem/#comments</comments>
		<pubDate>Sat, 20 Aug 2011 02:33:02 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=965</guid>
		<description><![CDATA[One known problem with Apple&#8217;s fork of open source software is their slowness in fixing vulnerabilities and bugs. Gdb fork isn&#8217;t immune to this; it was forked around release 6.6 or something like that and lots of stuff isn&#8217;t kept in sync with GNU&#8217;s gdb version. The short story for this bug is that you [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/08/20/another-patch-for-apples-gdb-the-definecommands-problem/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How gdb disables ASLR in Mac OS X Lion</title>
		<link>http://reverse.put.as/2011/08/11/how-gdb-disables-aslr-in-mac-os-x-lion/</link>
		<comments>http://reverse.put.as/2011/08/11/how-gdb-disables-aslr-in-mac-os-x-lion/#comments</comments>
		<pubDate>Thu, 11 Aug 2011 21:45:17 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[aslr]]></category>
		<category><![CDATA[gdb]]></category>
		<category><![CDATA[kernel]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=953</guid>
		<description><![CDATA[This isn&#8217;t a rocket science post but more like some notes for future reference Lion finally introduces full ASLR and gdb has the possibility to disable that feature when analyzing target binaries. A new gdb setting was added, &#8220;disable-aslr&#8221;, which allows to enable or disable this feature. By default this feature appears to be enabled [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/08/11/how-gdb-disables-aslr-in-mac-os-x-lion/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>Gdbinit v7.4.2, Github and Twitter</title>
		<link>http://reverse.put.as/2011/08/11/gdbinit-v7-4-2-github-and-twitter/</link>
		<comments>http://reverse.put.as/2011/08/11/gdbinit-v7-4-2-github-and-twitter/#comments</comments>
		<pubDate>Thu, 11 Aug 2011 13:52:06 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>
		<category><![CDATA[gdb]]></category>
		<category><![CDATA[gdbinit]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=942</guid>
		<description><![CDATA[Hello, It seems like things are very quiet and I only push gdbinit updates. Well, I have been very busy with very interesting projects, most of which can&#8217;t see yet the &#8220;light of the day&#8221;. Need to find some time to fool around with some new stuff. It seems that vmprotect is coming to OS [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/08/11/gdbinit-v7-4-2-github-and-twitter/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Gdb init v7.4</title>
		<link>http://reverse.put.as/2011/06/20/gdb-init-v7-4/</link>
		<comments>http://reverse.put.as/2011/06/20/gdb-init-v7-4/#comments</comments>
		<pubDate>Mon, 20 Jun 2011 02:32:44 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>
		<category><![CDATA[gdbinit]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=926</guid>
		<description><![CDATA[Hello, Just posting a small update to gdbinit. A friend asked for colouring the registers changes as it happens in Ollydbg. I have enabled it by default (modify variable  SHOWREGCHANGES if you don&#8217;t like it). I have also added a colour patch that Phillipe sent me &#8211; it will colour the 1st line of the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/06/20/gdb-init-v7-4/feed/</wfw:commentRss>
		<slash:comments>9</slash:comments>
		</item>
		<item>
		<title>Added a new page, Papers &amp; Presentations</title>
		<link>http://reverse.put.as/2011/06/01/added-a-new-page-papers-presentations/</link>
		<comments>http://reverse.put.as/2011/06/01/added-a-new-page-papers-presentations/#comments</comments>
		<pubDate>Wed, 01 Jun 2011 16:05:22 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Papers]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=920</guid>
		<description><![CDATA[I have added a new page called Papers that contains papers &#38; presentations related to OS X and iOS (reversing, hacking, exploitation) that I have floating around in my harddisks. It&#8217;s a work in progress since I have stuff spreaded everywhere! Please be gentle with any mirroring efforts Enjoy, fG!]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/06/01/added-a-new-page-papers-presentations/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>A little vulnerability in The Heist iOS game or how to get (more) free Steam codes for Eets game!</title>
		<link>http://reverse.put.as/2011/05/25/a-little-vulnerability-in-the-heist-ios-game-or-how-to-get-more-free-steam-codes-for-eets-game/</link>
		<comments>http://reverse.put.as/2011/05/25/a-little-vulnerability-in-the-heist-ios-game-or-how-to-get-more-free-steam-codes-for-eets-game/#comments</comments>
		<pubDate>Wed, 25 May 2011 21:28:09 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[iPad Reversing]]></category>
		<category><![CDATA[free game]]></category>
		<category><![CDATA[gdbinit]]></category>
		<category><![CDATA[ios]]></category>
		<category><![CDATA[vulnerability]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=896</guid>
		<description><![CDATA[MacHeist released a great puzzle game called The Heist, promising a prize when you managed to open the safe. Since I am a sucker for puzzle games I bought it and gave a brief check on its code. There is a single url in the program and some references to sha256, this being a good [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/05/25/a-little-vulnerability-in-the-heist-ios-game-or-how-to-get-more-free-steam-codes-for-eets-game/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>How-to remove iPad/iPhone/iPod Touch encrypted backups password if you forgot it</title>
		<link>http://reverse.put.as/2011/05/09/how-to-remove-ipadiphoneipod-touch-encrypted-backups-password-if-you-forgot-it/</link>
		<comments>http://reverse.put.as/2011/05/09/how-to-remove-ipadiphoneipod-touch-encrypted-backups-password-if-you-forgot-it/#comments</comments>
		<pubDate>Mon, 09 May 2011 01:59:44 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>
		<category><![CDATA[backups]]></category>
		<category><![CDATA[encrypted]]></category>
		<category><![CDATA[ipad]]></category>
		<category><![CDATA[iphone]]></category>
		<category><![CDATA[ipod touch]]></category>
		<category><![CDATA[passwords]]></category>
		<category><![CDATA[remove]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=891</guid>
		<description><![CDATA[These last days I must be set on a Apple devices destruction mode. First I lost access to my MacBook while trying to increase its physical security &#8211; I configured it to boot from network and I lost all access to boot sequence commands. I think my model has an EFI bug because the security-mode [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/05/09/how-to-remove-ipadiphoneipod-touch-encrypted-backups-password-if-you-forgot-it/feed/</wfw:commentRss>
		<slash:comments>34</slash:comments>
		</item>
		<item>
		<title>An interview with CrackZ and (incomplete) source code to Contract Killer &#8220;trainer&#8221;</title>
		<link>http://reverse.put.as/2011/04/24/an-interview-with-crackz-and-incomplete-source-code-to-contract-killer-trainer/</link>
		<comments>http://reverse.put.as/2011/04/24/an-interview-with-crackz-and-incomplete-source-code-to-contract-killer-trainer/#comments</comments>
		<pubDate>Sun, 24 Apr 2011 13:42:02 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[iPad Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=877</guid>
		<description><![CDATA[I just found a nice interview with CrackZ here. He nails the point that curiosity and intellectual challenge trumps above everything else but also demonstrates the process from not caring about the impact of his acts to something more &#8220;ethical&#8221;. His site is still one of the best resources for Windows reversing, especially regarding dongles. [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/04/24/an-interview-with-crackz-and-incomplete-source-code-to-contract-killer-trainer/feed/</wfw:commentRss>
		<slash:comments>9</slash:comments>
		</item>
		<item>
		<title>Newsflash: How to fuck up 40 million USD &#8211; The New York Times paywall and its iPad app</title>
		<link>http://reverse.put.as/2011/04/01/newsflash-how-to-fuck-up-40-million-usd-the-new-york-times-paywall-and-its-ipad-app/</link>
		<comments>http://reverse.put.as/2011/04/01/newsflash-how-to-fuck-up-40-million-usd-the-new-york-times-paywall-and-its-ipad-app/#comments</comments>
		<pubDate>Fri, 01 Apr 2011 13:59:05 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[iPad Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=869</guid>
		<description><![CDATA[This will be a story in development, which is kinda of funny taking in account the target in question. I might be wrong on all this but my instinct is hinting me that I&#8217;m not. After the Contract Killer post I got very much interested in verifying these kind of implementations in other apps. This [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/04/01/newsflash-how-to-fuck-up-40-million-usd-the-new-york-times-paywall-and-its-ipad-app/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Hacking a freemium iOS app: Contract Killer &#8230; or unlimited play without spending a dime (or any other currency)</title>
		<link>http://reverse.put.as/2011/03/29/hacking-a-freemium-ios-app-contract-killer-or-unlimited-play-without-spending-a-dime-or-any-other-currency/</link>
		<comments>http://reverse.put.as/2011/03/29/hacking-a-freemium-ios-app-contract-killer-or-unlimited-play-without-spending-a-dime-or-any-other-currency/#comments</comments>
		<pubDate>Tue, 29 Mar 2011 02:25:56 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[iPad Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=857</guid>
		<description><![CDATA[Let me start this post with a little rant. The iPad is a great product but it&#8217;s full of spyware and that sucks big time. One might argue that it&#8217;s not spyware, it&#8217;s just sending bits of information. Well, for me it&#8217;s damn spyware because I&#8217;m not authorizing the apps to send any information, much [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/03/29/hacking-a-freemium-ios-app-contract-killer-or-unlimited-play-without-spending-a-dime-or-any-other-currency/feed/</wfw:commentRss>
		<slash:comments>13</slash:comments>
		</item>
		<item>
		<title>Small update to gdbinit and to the website</title>
		<link>http://reverse.put.as/2011/03/07/small-update-to-gdbinit-and-to-the-website/</link>
		<comments>http://reverse.put.as/2011/03/07/small-update-to-gdbinit-and-to-the-website/#comments</comments>
		<pubDate>Mon, 07 Mar 2011 03:11:48 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>
		<category><![CDATA[gdbinit]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=843</guid>
		<description><![CDATA[I decided to mess around with this blog template style sheets and use a better font and change some minor things. I added three new pages at the navigation bar &#8211; one with all available gdbinit files in this site, another for my gdb patches and a tag cloud (still have to tag old posts). [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/03/07/small-update-to-gdbinit-and-to-the-website/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Update to gdb patches &#8211; fix for a &#8220;new&#8221; bug</title>
		<link>http://reverse.put.as/2011/02/21/update-to-gdb-patches-fix-a-new-bug/</link>
		<comments>http://reverse.put.as/2011/02/21/update-to-gdb-patches-fix-a-new-bug/#comments</comments>
		<pubDate>Mon, 21 Feb 2011 16:12:02 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>
		<category><![CDATA[bugs]]></category>
		<category><![CDATA[gdb]]></category>
		<category><![CDATA[patches]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=796</guid>
		<description><![CDATA[I was messing around with SoftwarePassport and Amit Singh&#8217;s tiny executable to find out why gdb doesn&#8217;t breakpoint in those two executables. I thought it was due to incomplete headers, but gdb can&#8217;t also breakpoint into nicertiny, which has the segment/section added (otool/otx SoftwarePassport problems can be fixed by manually adding the missing section &#8211; [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/02/21/update-to-gdb-patches-fix-a-new-bug/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>There&#8217;s a new protection in town, Software Passport, from the developers of Armadillo :-)</title>
		<link>http://reverse.put.as/2011/02/16/theres-a-new-protection-in-town-software-passport-from-the-developers-of-armadillo/</link>
		<comments>http://reverse.put.as/2011/02/16/theres-a-new-protection-in-town-software-passport-from-the-developers-of-armadillo/#comments</comments>
		<pubDate>Tue, 15 Feb 2011 23:46:22 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=787</guid>
		<description><![CDATA[A reader sent me the link for a new software protection package called Software Passport (here). This is from The Silicons Realms, the makers of Armadillo for Windows. Since I&#8217;m as curious as cats, I started giving a quick look on it, to see if it has any interesting things related to anti-debugging and anti-disassembly. [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/02/16/theres-a-new-protection-in-town-software-passport-from-the-developers-of-armadillo/feed/</wfw:commentRss>
		<slash:comments>23</slash:comments>
		</item>
		<item>
		<title>It&#8217;s not my war but&#8230;</title>
		<link>http://reverse.put.as/2011/02/15/its-not-my-war-but/</link>
		<comments>http://reverse.put.as/2011/02/15/its-not-my-war-but/#comments</comments>
		<pubDate>Tue, 15 Feb 2011 19:42:20 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=782</guid>
		<description><![CDATA[I just saw the following at MSJ and the reaction of the one byte fag and other idiots is simply childish, to not digress much about it.  The author of Remote Buddy leaves the post below, asking for them to stop distributing cracks on his software. As a response, tons of links with the crack [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/02/15/its-not-my-war-but/feed/</wfw:commentRss>
		<slash:comments>16</slash:comments>
		</item>
		<item>
		<title>Universe&#8217;s best and legal Mac OS X reversing tutorial for newbies (or maybe not!)</title>
		<link>http://reverse.put.as/2011/02/12/universes-best-and-legal-mac-os-x-reversing-tutorial-for-newbies-or-maybe-not/</link>
		<comments>http://reverse.put.as/2011/02/12/universes-best-and-legal-mac-os-x-reversing-tutorial-for-newbies-or-maybe-not/#comments</comments>
		<pubDate>Sat, 12 Feb 2011 03:01:22 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=775</guid>
		<description><![CDATA[I have decided to re-release my beginners tutorial, this time based on a crackme, so it deserves the upgrade to Universe instead of World. It includes patching, serial fishing and a keygen. I have updated some errors that I found in the original tutorial. Reversing and breaking protections is a great hobby and fantastic knowledge [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/02/12/universes-best-and-legal-mac-os-x-reversing-tutorial-for-newbies-or-maybe-not/feed/</wfw:commentRss>
		<slash:comments>19</slash:comments>
		</item>
		<item>
		<title>Another update to gdbinit for iOS and ARM support to ptool.pl and offset.pl</title>
		<link>http://reverse.put.as/2011/02/03/another-update-to-gdbinit-for-ios-and-arm-support-to-ptool-pl-and-offset-pl/</link>
		<comments>http://reverse.put.as/2011/02/03/another-update-to-gdbinit-for-ios-and-arm-support-to-ptool-pl-and-offset-pl/#comments</comments>
		<pubDate>Thu, 03 Feb 2011 03:14:16 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[iPad Reversing]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[gdbinit]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=762</guid>
		<description><![CDATA[I have fixed some of the missing stuff in gdbinit for iOS. Now the jump conditions are displayed for ARM and Thumb modes and the &#8220;stepo&#8221; command is working for ARM and semi-working for Thumb (to be fixed in the next release). Also implemented minor cosmetic changes The tools to show Mach header information and [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/02/03/another-update-to-gdbinit-for-ios-and-arm-support-to-ptool-pl-and-offset-pl/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Need help with code signing in iOS!</title>
		<link>http://reverse.put.as/2011/01/28/need-help-with-code-signing-in-ios/</link>
		<comments>http://reverse.put.as/2011/01/28/need-help-with-code-signing-in-ios/#comments</comments>
		<pubDate>Fri, 28 Jan 2011 00:16:19 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[iPad Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=755</guid>
		<description><![CDATA[Well this one is driving me crazy so better ask for some help before I fire the big guns and go commando mode with this I&#8217;m trying to patch iOS apps so I can remove &#8220;spyware&#8221; and other stuff. Newest iOS versions require all code to be signed. This article by Saurik talks about 3 [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/01/28/need-help-with-code-signing-in-ios/feed/</wfw:commentRss>
		<slash:comments>11</slash:comments>
		</item>
		<item>
		<title>Gdbinit v0.1 for iOS (iPad at least :-))</title>
		<link>http://reverse.put.as/2011/01/27/gdbinit-v0-1-for-ios-ipad-at-least/</link>
		<comments>http://reverse.put.as/2011/01/27/gdbinit-v0-1-for-ios-ipad-at-least/#comments</comments>
		<pubDate>Thu, 27 Jan 2011 22:42:13 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[iPad Reversing]]></category>
		<category><![CDATA[gdbinit]]></category>
		<category><![CDATA[ios]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=747</guid>
		<description><![CDATA[I just finished porting gdbinit into iOS. The basic stuff is working except the stepo command (one of my favourites!), the objective-c selector and showing what will happen with conditional branches (I have to see how to implement this since ARM instructions can be conditional). I have tested it on my iPad with gdb available [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/01/27/gdbinit-v0-1-for-ios-ipad-at-least/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>How-to make an iPad connect thru a ssh SOCKS proxy + iOS &#8220;spyware&#8221;</title>
		<link>http://reverse.put.as/2011/01/22/how-to-make-an-ipad-connect-thru-a-ssh-socks-proxy-ios-spyware/</link>
		<comments>http://reverse.put.as/2011/01/22/how-to-make-an-ipad-connect-thru-a-ssh-socks-proxy-ios-spyware/#comments</comments>
		<pubDate>Fri, 21 Jan 2011 23:46:16 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[iPad Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=743</guid>
		<description><![CDATA[These days I&#8217;ve been messing around with Dtrace and the mach side of OS X kernel. I still have to figure out how to make Dtrace helpful in reversing protections and other stuff &#8211; I&#8217;m talking about efficiency in finding the right spots and gathering information. It&#8217;s a very powerful tool for system administration but [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/01/22/how-to-make-an-ipad-connect-thru-a-ssh-socks-proxy-ios-spyware/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Why cracking the vast majority of Mac apps isn&#8217;t that sexy&#8230;</title>
		<link>http://reverse.put.as/2011/01/17/why-cracking-the-vast-majority-of-mac-apps-isnt-that-sexy/</link>
		<comments>http://reverse.put.as/2011/01/17/why-cracking-the-vast-majority-of-mac-apps-isnt-that-sexy/#comments</comments>
		<pubDate>Mon, 17 Jan 2011 22:50:07 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=739</guid>
		<description><![CDATA[I shouldn&#8217;t be posting this because the guy doesn&#8217;t deserve any traffic he might get by writing this. But it&#8217;s so funny that I cannot resist (yes, I&#8217;m weak!!!). The blog post is called &#8220;I Can Crack Your App With Just A Shell (And How To Stop Me)&#8221; and it&#8217;s available here. I especially like [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/01/17/why-cracking-the-vast-majority-of-mac-apps-isnt-that-sexy/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Reversing the exit(173) from the Mac App Store</title>
		<link>http://reverse.put.as/2011/01/15/reversing-the-exit173-from-the-mac-app-store/</link>
		<comments>http://reverse.put.as/2011/01/15/reversing-the-exit173-from-the-mac-app-store/#comments</comments>
		<pubDate>Sat, 15 Jan 2011 03:33:23 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=733</guid>
		<description><![CDATA[This will be a working in progress so this post might be updated a few times. As promised, a reader sent me the Mac App Store (MAS) validation guidelines (thank you again!) and I got curious about one detail, the exit(173). This guides states if application fails to validate the receipt because it&#8217;s not present, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/01/15/reversing-the-exit173-from-the-mac-app-store/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>The sad state of reverse engineering software/hardware protections</title>
		<link>http://reverse.put.as/2011/01/12/the-sad-state-of-reverse-engineering-softwarehardware-protections/</link>
		<comments>http://reverse.put.as/2011/01/12/the-sad-state-of-reverse-engineering-softwarehardware-protections/#comments</comments>
		<pubDate>Wed, 12 Jan 2011 04:07:25 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=729</guid>
		<description><![CDATA[I have just finished reading the legal papers served against Geohot regarding the PS3 jailbreaking/cracking/private keys/etc. It shows the sad state that we have reached into reverse engineering and society as a whole. It&#8217;s a fight between knowledge and profit, and in the middle there is a grey area called piracy. My passion for knowledge [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/01/12/the-sad-state-of-reverse-engineering-softwarehardware-protections/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>The Mac App Store&#8230; Security broken by design?</title>
		<link>http://reverse.put.as/2011/01/07/the-mac-app-store-security-broken-by-design/</link>
		<comments>http://reverse.put.as/2011/01/07/the-mac-app-store-security-broken-by-design/#comments</comments>
		<pubDate>Fri, 07 Jan 2011 15:55:50 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=713</guid>
		<description><![CDATA[The Mac App Store opened yesterday and a few hours after the web is already full of news about the hacking/cracking/defeat/whatever of the store. When I heard about the Mac App Store, I became curious about how it would handle the serial and other protections of normal applications. I had read an article/news that talked [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/01/07/the-mac-app-store-security-broken-by-design/feed/</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>A semi-automated way to find sysent</title>
		<link>http://reverse.put.as/2010/11/27/a-semi-automated-way-to-find-sysent/</link>
		<comments>http://reverse.put.as/2010/11/27/a-semi-automated-way-to-find-sysent/#comments</comments>
		<pubDate>Fri, 26 Nov 2010 23:05:42 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=701</guid>
		<description><![CDATA[The original method to hijack sysent table was described by Landon Fuller and then Braeden Thomas updated it to Snow Leopard due to new location and lack of nsysent symbol. Charlie Miller and Dino Dai Zovi at The Mac Hacker&#8217;s Handbook, have some code to try to automate this search for sysent. I never tried [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/11/27/a-semi-automated-way-to-find-sysent/feed/</wfw:commentRss>
		<slash:comments>10</slash:comments>
		</item>
		<item>
		<title>A new gdb frontend and some pics from the past&#8230;</title>
		<link>http://reverse.put.as/2010/10/11/a-new-gdb-frontend-and-some-pics-from-the-past/</link>
		<comments>http://reverse.put.as/2010/10/11/a-new-gdb-frontend-and-some-pics-from-the-past/#comments</comments>
		<pubDate>Sun, 10 Oct 2010 23:55:16 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=687</guid>
		<description><![CDATA[Hi, There is a new gdb Cocoa frontend in town courtesy of Kurt. It&#8217;s still in early stages but it&#8217;s always interesting to have people developing tools for OS X. Congrats to Kurt. You can contact him at kurt a@t osxdbg.co.cc for bug reporting! I also bring you two pics from an old HardLock dongle [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/10/11/a-new-gdb-frontend-and-some-pics-from-the-past/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>GDB anti-debug, Otool/otx anti-disassembly&#8230; It&#8217;s Challenge number 3 !!!</title>
		<link>http://reverse.put.as/2010/08/18/gdb-anti-debug-otoolotx-anti-disassembly-its-challenge-number-3/</link>
		<comments>http://reverse.put.as/2010/08/18/gdb-anti-debug-otoolotx-anti-disassembly-its-challenge-number-3/#comments</comments>
		<pubDate>Wed, 18 Aug 2010 02:15:06 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=673</guid>
		<description><![CDATA[Today I decided to give a look at Challenge #3 since it promised nasty tricks. Now that looks like a challenge and I love challenges! If you think this is a spoiler then stop reading and come back in a week or so. There is no solution for the challenge; I&#8217;m more interested in the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/08/18/gdb-anti-debug-otoolotx-anti-disassembly-its-challenge-number-3/feed/</wfw:commentRss>
		<slash:comments>20</slash:comments>
		</item>
		<item>
		<title>How to Keygen MSJ Kracking Challenge &#8217;10 &#8211; Challenge #1</title>
		<link>http://reverse.put.as/2010/08/02/how-to-keygen-msj-kracking-challenge-10-challenge-1/</link>
		<comments>http://reverse.put.as/2010/08/02/how-to-keygen-msj-kracking-challenge-10-challenge-1/#comments</comments>
		<pubDate>Mon, 02 Aug 2010 19:18:53 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=661</guid>
		<description><![CDATA[The MBA is over and I&#8217;m enjoying my vacations to clear stuff from the Todo list, to read books, to play some games and to do other stuff. Today the MacSerialJunkies contest started and I decided to give it a go. It&#8217;s a very simple crackme with a small twist where you have to bruteforce [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/08/02/how-to-keygen-msj-kracking-challenge-10-challenge-1/feed/</wfw:commentRss>
		<slash:comments>27</slash:comments>
		</item>
		<item>
		<title>Very small update&#8230;</title>
		<link>http://reverse.put.as/2010/06/08/very-small-update/</link>
		<comments>http://reverse.put.as/2010/06/08/very-small-update/#comments</comments>
		<pubDate>Mon, 07 Jun 2010 23:14:02 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=652</guid>
		<description><![CDATA[Hi! I just updated the crackmes with #5 from MSJ challenge and added a new tool for encrypting/decrypting apple encrypted binaries. I had planned to do this tool but it&#8217;s great that someone did it first! It&#8217;s good to see people developing tools for OS X, even if they are very simple. Thank you to [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/06/08/very-small-update/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Onyx the Black Cat v0.4 for Snow Leopard</title>
		<link>http://reverse.put.as/2010/05/24/onyx-the-black-cat-v0-4-for-snow-leopard/</link>
		<comments>http://reverse.put.as/2010/05/24/onyx-the-black-cat-v0-4-for-snow-leopard/#comments</comments>
		<pubDate>Sun, 23 May 2010 23:23:36 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=643</guid>
		<description><![CDATA[I had this one working for a long time but I hadn&#8217;t released it because I was trying to hijack fork and vfork calls. My objective was to introduce an int3 so I could attach the debugger to a selected process. At that time I suspected that VLOK was forking and I couldn&#8217;t debug the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/05/24/onyx-the-black-cat-v0-4-for-snow-leopard/feed/</wfw:commentRss>
		<slash:comments>27</slash:comments>
		</item>
		<item>
		<title>OS X Crackmes</title>
		<link>http://reverse.put.as/2010/05/21/os-x-crackmes/</link>
		<comments>http://reverse.put.as/2010/05/21/os-x-crackmes/#comments</comments>
		<pubDate>Thu, 20 May 2010 23:55:07 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=637</guid>
		<description><![CDATA[Hello, I have just added a page to collect crackmes for OS X. I have added the ones that I already had and some recommended from user comments. Since corruptfire.com seems down I cannot retrieve the other ones they had. If you have more crackmes please mail them to me so I can add them [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/05/21/os-x-crackmes/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Gdbinit v7.3</title>
		<link>http://reverse.put.as/2010/04/16/gdbinit-v7-3/</link>
		<comments>http://reverse.put.as/2010/04/16/gdbinit-v7-3/#comments</comments>
		<pubDate>Fri, 16 Apr 2010 10:28:36 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>
		<category><![CDATA[gdbinit]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=615</guid>
		<description><![CDATA[I was bored and decided to fix gdbinit to support 64bits binaries. I had tried it before but the solution was a piece of crap (not that this one is much better). I was testing the registers to see if the binary was 32 or 64bits. Now there is a default setting to 32bits (change [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/04/16/gdbinit-v7-3/feed/</wfw:commentRss>
		<slash:comments>25</slash:comments>
		</item>
		<item>
		<title>reverse.put.as is back in a new format&#8230;</title>
		<link>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/</link>
		<comments>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/#comments</comments>
		<pubDate>Fri, 09 Apr 2010 18:34:25 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=571</guid>
		<description><![CDATA[I have been thinking about this and how to get this blog back to life. My free time has been almost zero but I miss the motivation to put my brain to tinker and create new things to publish, because reversing and everything around it sometimes is a great relaxing activity for me. The last [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>A new util to process Mach-O binaries information (or a replacement to otool -l)</title>
		<link>http://reverse.put.as/2010/01/05/a-new-util-to-process-mach-o-binaries-information-or-a-replacement-to-otool-l/</link>
		<comments>http://reverse.put.as/2010/01/05/a-new-util-to-process-mach-o-binaries-information-or-a-replacement-to-otool-l/#comments</comments>
		<pubDate>Tue, 05 Jan 2010 02:15:22 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=474</guid>
		<description><![CDATA[For a long time I have been annoyed by the information displayed by otool -l because it mixes hexadecimal with decimal information. For example, offsets are displayed in decimal and relative to the cpu architecture in the fat binary. So I had to convert and calculate things by hand everytime I wanted to peek or [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/01/05/a-new-util-to-process-mach-o-binaries-information-or-a-replacement-to-otool-l/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Happy new year and a small christmas gift!</title>
		<link>http://reverse.put.as/2009/12/26/happy-new-year-and-a-small-christmas-gift/</link>
		<comments>http://reverse.put.as/2009/12/26/happy-new-year-and-a-small-christmas-gift/#comments</comments>
		<pubDate>Sat, 26 Dec 2009 01:45:19 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=469</guid>
		<description><![CDATA[November was a pretty busy month with exams and assignments to be delivered. I have been having a lot of fun with the MBA since analysing financial statements is some kind of reverse engineering and I missed Economics stuff (I do have a undergraduate degree in Economics). I really like to go outside the box [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/12/26/happy-new-year-and-a-small-christmas-gift/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Snow Leopard Impact into reverse engineering world&#8230;</title>
		<link>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/</link>
		<comments>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/#comments</comments>
		<pubDate>Wed, 28 Oct 2009 23:04:26 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=461</guid>
		<description><![CDATA[Some folks were complaining about problems with OTX and Snow Leopard so I decided to boot my Snow Leopard install and give it a try&#8230; Well they were right since Snow Leopard compiles 64 bit binaries by default. OTX v0.16b seems to have problems so you will need to download from the SVN and compile [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Small gdbinit update&#8230;</title>
		<link>http://reverse.put.as/2009/10/11/small-gdbinit-update/</link>
		<comments>http://reverse.put.as/2009/10/11/small-gdbinit-update/#comments</comments>
		<pubDate>Sun, 11 Oct 2009 19:06:48 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=455</guid>
		<description><![CDATA[Things have been very quiet since the beginning of September&#8230; Well my MBA has started and my free time until now has been ZERO ! It has been a fun but very busy ride and comeback to the world of economics. The first weeks are recruit like, pretty intensive with many assignments to be delivered. [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/10/11/small-gdbinit-update/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Gdb patches</title>
		<link>http://reverse.put.as/2009/08/26/gdb-patches/</link>
		<comments>http://reverse.put.as/2009/08/26/gdb-patches/#comments</comments>
		<pubDate>Wed, 26 Aug 2009 15:16:54 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=442</guid>
		<description><![CDATA[Here you have the patches I did for gdb: To fix problem with gdbinit To display raw bytes in x/i and disassemble commands To warn about possible number of sections anti-debug trick You can download a single patch for all changes or one for each individual change. A patched gdb binary for Intel only is [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/26/gdb-patches/feed/</wfw:commentRss>
		<slash:comments>30</slash:comments>
		</item>
		<item>
		<title>Anatomy of a gdb anti-debug trick part II: GDB isn&#8217;t alone !</title>
		<link>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/</link>
		<comments>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/#comments</comments>
		<pubDate>Wed, 26 Aug 2009 00:20:41 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=419</guid>
		<description><![CDATA[After having found the source of the gdb anti-debug trick, I started modifying gdb to work around the problem and fix the number of sections on the fly (it&#8217;s damn simple to calculate the real number of sections !!!). I was coding on a long train trip and everything was going great&#8230; My hack worked [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Reversing Pokerstars online poker client (I hope they aren&#8217;t from Vegas !!!)</title>
		<link>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/</link>
		<comments>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/#comments</comments>
		<pubDate>Thu, 20 Aug 2009 15:47:35 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=410</guid>
		<description><![CDATA[Today I bring you something from the old projects trunk ! Like many other millions of people I enjoy playing online Texas Hold&#8217;em. I started with Pokerstars three years ago, and after a while, diabolical ideas came to my head about reversing the client to have a peek into their communication protocol (what else were [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Anatomy of a gdb anti-debug trick</title>
		<link>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/</link>
		<comments>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/#comments</comments>
		<pubDate>Thu, 13 Aug 2009 16:38:52 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=391</guid>
		<description><![CDATA[Well, it seems this is the GDB post season ! The past days have been dedicated to mess around with gdb source code and today I have what I think it&#8217;s a nice story to tell. After hacking off my old wish of having the disassembly raw bytes to be printed (like Ollydbg, Softice, IDA, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Fix for Apple&#8217;s GDB bug or why Apple forks are bad&#8230;</title>
		<link>http://reverse.put.as/2009/08/10/fix-for-apples-gdb-bug-or-why-apple-forks-are-bad/</link>
		<comments>http://reverse.put.as/2009/08/10/fix-for-apples-gdb-bug-or-why-apple-forks-are-bad/#comments</comments>
		<pubDate>Mon, 10 Aug 2009 16:19:29 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=378</guid>
		<description><![CDATA[It&#8217;s not a breakthrough post but I finally found where the bug that messed up gdbinit is located. I got obsessed into this problem and started browsing gdb source code. I knew that the problem ocurred when the &#8220;file&#8221; or &#8220;add-symbol&#8221; commands were used. The difference from &#8220;file&#8221; to &#8220;exec-file&#8221; is that symbols are loaded [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/10/fix-for-apples-gdb-bug-or-why-apple-forks-are-bad/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Workaround for Apple&#8217;s GDB bug&#8230;</title>
		<link>http://reverse.put.as/2009/08/06/workaround-for-apples-gdb-bug/</link>
		<comments>http://reverse.put.as/2009/08/06/workaround-for-apples-gdb-bug/#comments</comments>
		<pubDate>Thu, 06 Aug 2009 09:56:38 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=373</guid>
		<description><![CDATA[I had unconsciously found the workaround a few months ago while hacking around Little Snitch with kernel debugging. To make things easier I had a small gdb script to call the debug kit macros and set all the variables that are the source of the problem with gdbinit. This was something I never thought about, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/06/workaround-for-apples-gdb-bug/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Gdbinit 7.1.7 and some bla bla bla&#8230;</title>
		<link>http://reverse.put.as/2009/08/05/gdbinit-7-1-7-and-some-bla-bla-bla/</link>
		<comments>http://reverse.put.as/2009/08/05/gdbinit-7-1-7-and-some-bla-bla-bla/#comments</comments>
		<pubDate>Wed, 05 Aug 2009 19:51:19 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=368</guid>
		<description><![CDATA[Greetings ! For the past weeks I have been pretty much bored with any kind of reversing so all my projects are stopped. Today I decided to fix some bugs at gdbinit and the result is version 7.1.7. The assemble command is finally fixed, added some semi useful commands and changed some colours. Nothing big [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/05/gdbinit-7-1-7-and-some-bla-bla-bla/feed/</wfw:commentRss>
		<slash:comments>9</slash:comments>
		</item>
		<item>
		<title>A little disassembler for MPress packer&#8230;</title>
		<link>http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/</link>
		<comments>http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/#comments</comments>
		<pubDate>Thu, 23 Jul 2009 10:49:57 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=360</guid>
		<description><![CDATA[Since otool and otx can&#8217;t disassemble the packed binary, Andreas Gumundsson wrote a quick tool to do that job, using Udis86, a disassembler library for x86 and AMD64. Check the source to see the required compiler options. Example usage: $ ./disas -f mmpress.i386 -t macho &#124; head -10 Found entrypoint inmemory address 0xd6b0 NCMDS 2 [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>How to dump a MPress packed binary&#8230;</title>
		<link>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/</link>
		<comments>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/#comments</comments>
		<pubDate>Wed, 22 Jul 2009 22:15:21 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=355</guid>
		<description><![CDATA[Someone at macserialjunkie board posted a problem with the mpress packer. Since packers are a pretty rare thing at OS X and I was bored, I decided to give it a quick look. The result is another tutorial about manually unpacking this kind of binary. It&#8217;s not hard and the packer isn&#8217;t that great. Objective-C [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>A memory dumper for Apple crypted binaries ! Hurray !!!</title>
		<link>http://reverse.put.as/2009/07/08/a-memory-dumper-for-apple-crypted-binaries-hurray/</link>
		<comments>http://reverse.put.as/2009/07/08/a-memory-dumper-for-apple-crypted-binaries-hurray/#comments</comments>
		<pubDate>Wed, 08 Jul 2009 22:34:00 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=341</guid>
		<description><![CDATA[Here it is, another example of my super l33t lame coding skills ! This wonder code will decrypt an Apple crypted binary via memory dumping. Maybe direct decryption (based on Amit Singh code) would be easier and nicer, but I wanted to do it this way as a test and an exercise. The code has [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/07/08/a-memory-dumper-for-apple-crypted-binaries-hurray/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>How to dump an Apple protected binary</title>
		<link>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/</link>
		<comments>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/#comments</comments>
		<pubDate>Mon, 29 Jun 2009 23:04:43 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=330</guid>
		<description><![CDATA[From the department of useless stuff comes a simple trick&#8230; A few days ago, a reader sent me an email asking about obfuscated code, in what appeared to be Apple&#8217;s binary protection. I already knew this Amit Singh article, but never played with it. Since I&#8217;m very curious (I love cats but Onyx still doesn&#8217;t [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>A bunch of old tutorials&#8230;</title>
		<link>http://reverse.put.as/2009/04/07/a-bunch-of-old-tutorials/</link>
		<comments>http://reverse.put.as/2009/04/07/a-bunch-of-old-tutorials/#comments</comments>
		<pubDate>Tue, 07 Apr 2009 09:51:51 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=231</guid>
		<description><![CDATA[While cleaning my hard disk I have found a zip file with a few old Mac OS X cracking tuts. Most are for PPC but they are still useful for learning reversing techniques. Grab it here: tuts.zip (SHA1(tuts.zip)= 3a0e1729e811deb7b7e8e19e0d6a61c9e3831b84) My free time is almost zero since GMAT study is taking every second I have (well, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/04/07/a-bunch-of-old-tutorials/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Defeating Little Snitch and thinking about piracy&#8230;</title>
		<link>http://reverse.put.as/2009/03/27/defeating-little-snitch-and-thinking-about-piracy/</link>
		<comments>http://reverse.put.as/2009/03/27/defeating-little-snitch-and-thinking-about-piracy/#comments</comments>
		<pubDate>Fri, 27 Mar 2009 12:45:22 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=222</guid>
		<description><![CDATA[I have managed to bypass Little Snitch 3 hour limit with a one or two bytes patch (can&#8217;t remember and too lazy to check it now) three days after I had access to kernel debugging. A very well designed protection (at least it&#8217;s a pain to analyse) was defeated because there was a weak element [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/03/27/defeating-little-snitch-and-thinking-about-piracy/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Onyx The Black Cat v0.3</title>
		<link>http://reverse.put.as/2009/03/25/onyx-the-black-cat-v03/</link>
		<comments>http://reverse.put.as/2009/03/25/onyx-the-black-cat-v03/#comments</comments>
		<pubDate>Wed, 25 Mar 2009 16:01:17 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=214</guid>
		<description><![CDATA[Version 0.3 is here. A couple small bugs are fixed, module features can be controled via sysctl variables (enable or disable features) and code is split into different source files (it was a mess in a single file!). Tiger support is removed so it&#8217;s ready to work with Leopard 10.5.6. Check the README file for [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/03/25/onyx-the-black-cat-v03/feed/</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>Mach-O binary offset calculator</title>
		<link>http://reverse.put.as/2009/03/13/mach-o-binary-offset-calculator/</link>
		<comments>http://reverse.put.as/2009/03/13/mach-o-binary-offset-calculator/#comments</comments>
		<pubDate>Fri, 13 Mar 2009 12:47:40 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=201</guid>
		<description><![CDATA[I made a mistake in this tutorial ! The way to calculate offsets to patch is wrong because I commited an inference error (analysed only a few binaries and assumed it to be correct). Found this while creating a program to calculate everything automatically. Check the code if you are interested in understanding how it&#8217;s [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/03/13/mach-o-binary-offset-calculator/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Mac OS X Kernel debugging with VMware</title>
		<link>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/</link>
		<comments>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/#comments</comments>
		<pubDate>Thu, 05 Mar 2009 12:19:37 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=178</guid>
		<description><![CDATA[I love VMware (used it since it&#8217;s first releases) and I love it even more now Yesterday I had the not so crazy idea (and not original) to use VMware for Mac OS X kernel debugging because newest Little Snitch version seems to have a new anti-debug trick and I don&#8217;t have another Mac at [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>iWork/Photoshop Trojan or Botnet Binary found</title>
		<link>http://reverse.put.as/2009/01/22/iwork-trojan-or-botnet-binary-found/</link>
		<comments>http://reverse.put.as/2009/01/22/iwork-trojan-or-botnet-binary-found/#comments</comments>
		<pubDate>Thu, 22 Jan 2009 11:00:13 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=150</guid>
		<description><![CDATA[It seems there is a trojan or botnet binary for OS X in the wild. Some details available at http://ithreats.wordpress.com/2009/01/22/latest-os-x-threat-iworkservices/ . The iWorkservices binary is available here: iWorkServices-trojan.zip A very quick and dirty strings dump and disassembly seems to show a trojan with botnet capabilities. There are references to p2p and that can be the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/01/22/iwork-trojan-or-botnet-binary-found/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Gdbinit v7.1.6</title>
		<link>http://reverse.put.as/2009/01/21/gdbinit-v716/</link>
		<comments>http://reverse.put.as/2009/01/21/gdbinit-v716/#comments</comments>
		<pubDate>Wed, 21 Jan 2009 00:19:47 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=146</guid>
		<description><![CDATA[While searching the web for some gdb patches I stumbled upon this fix to &#8216;assemble&#8217; function from gdbinit by Tavis Ormandy (good work!). I modified it a little bit to work with Mac OS X. This function allows you to assemble directly (using nasm, Intel format) to running program or just output the correspondent opcodes [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/01/21/gdbinit-v716/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>How to compile GDB and other Apple open source packages in Mac OS X</title>
		<link>http://reverse.put.as/2009/01/14/how-to-compile-gdb-and-other-apple-open-source-packages-in-mac-os-x/</link>
		<comments>http://reverse.put.as/2009/01/14/how-to-compile-gdb-and-other-apple-open-source-packages-in-mac-os-x/#comments</comments>
		<pubDate>Tue, 13 Jan 2009 23:29:05 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=141</guid>
		<description><![CDATA[I wanted to recompile so I can modify it&#8217;s source and add some custom patches to enhance it&#8217;s output&#8230; Easier said than done !!!! There&#8217;s no much information around about this and my first attempt was by downloading gdb source package from Apple and trying to compile it. Didn&#8217;t compiled out of the box so [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/01/14/how-to-compile-gdb-and-other-apple-open-source-packages-in-mac-os-x/feed/</wfw:commentRss>
		<slash:comments>16</slash:comments>
		</item>
		<item>
		<title>Mailing list and IRC channel</title>
		<link>http://reverse.put.as/2009/01/05/mailing-list-and-irc-channel/</link>
		<comments>http://reverse.put.as/2009/01/05/mailing-list-and-irc-channel/#comments</comments>
		<pubDate>Mon, 05 Jan 2009 12:23:08 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=139</guid>
		<description><![CDATA[I forgot to mention this previously but there is a mailing list available at http://0&#215;90.org/mailman/listinfo/xso and an IRC channel at irc.freenode.net, #osxre ! It&#8217;s still a small community but more people are showing up and IRC is always a good communication tool. I&#8217;m not administrator of both, but YOU are invited to join fG!]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/01/05/mailing-list-and-irc-channel/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>More gdbinit addons!</title>
		<link>http://reverse.put.as/2008/12/31/more-gdbinit-addons/</link>
		<comments>http://reverse.put.as/2008/12/31/more-gdbinit-addons/#comments</comments>
		<pubDate>Wed, 31 Dec 2008 15:02:36 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=130</guid>
		<description><![CDATA[End of the year is slow and I was a bit inspired so I decided to hack around another features I was missing from gdbinit ! First one is about conditional jump display. Original gdbinit doesn&#8217;t tell you what will be the decision that will be taken on a conditional jump. You must look at [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/12/31/more-gdbinit-addons/feed/</wfw:commentRss>
		<slash:comments>22</slash:comments>
		</item>
		<item>
		<title>A lazy xmas gift or a lazy addon to gdbinit</title>
		<link>http://reverse.put.as/2008/12/29/a-lazy-xmas-gift-or-a-lazy-addon-to-gdbinit/</link>
		<comments>http://reverse.put.as/2008/12/29/a-lazy-xmas-gift-or-a-lazy-addon-to-gdbinit/#comments</comments>
		<pubDate>Mon, 29 Dec 2008 15:39:00 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=125</guid>
		<description><![CDATA[While I was messing with gdbinit three weeks ago, I added a small feature that displays the messages being sent to objc_msgSend. Usually I follow the otool or IDA dump and see what&#8217;s being sent, but that it&#8217;s not very practical! So I made a dirty hack with gdbinit so that information appears automatically into [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/12/29/a-lazy-xmas-gift-or-a-lazy-addon-to-gdbinit/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Apple&#8217;s GDB Bug ?</title>
		<link>http://reverse.put.as/2008/11/28/apples-gdb-bug/</link>
		<comments>http://reverse.put.as/2008/11/28/apples-gdb-bug/#comments</comments>
		<pubDate>Fri, 28 Nov 2008 11:17:16 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=119</guid>
		<description><![CDATA[I was trying to add some features to gdbinit and I needed global variables. I already knew that feature wasn&#8217;t working on Mac OS X gdb and I was puzzled why it didn&#8217;t work. Some quick tests on a Linux box couldn&#8217;t reproduce the same behaviour so something is wrong with Apple&#8217;s gdb version. I [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/11/28/apples-gdb-bug/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>gdbinit version 7.0 (and 7.1)</title>
		<link>http://reverse.put.as/2008/11/19/gdbinit-version-70/</link>
		<comments>http://reverse.put.as/2008/11/19/gdbinit-version-70/#comments</comments>
		<pubDate>Wed, 19 Nov 2008 17:36:09 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=99</guid>
		<description><![CDATA[There is a new version of original +mammon gdbinit, 7.0 (available at http://truthix.dump.cz/files/.gdbinit). GDB version used by Apple has some problems with it (doesn&#8217;t recognize global variables outside each function) so it needed some fixes to work. I have changed the colors and removed the data window display (personally I don&#8217;t think it&#8217;s useful, edit [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/11/19/gdbinit-version-70/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Onyx The Black Cat v0.2</title>
		<link>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/</link>
		<comments>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/#comments</comments>
		<pubDate>Sun, 16 Nov 2008 18:40:24 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=96</guid>
		<description><![CDATA[Here it is with support for Leopard and extended attributes. All calls related to extended attributes are traced and dumped to /var/log/system.log (I find it more useful than fs_usage for this specific calls). Check the .c file for options related to this. For Leopard support you need to edit the .c file and change the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Onyx The Black Cat v0.1 &#8211; Anti Anti-debug kernel module</title>
		<link>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/</link>
		<comments>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/#comments</comments>
		<pubDate>Thu, 30 Oct 2008 11:56:18 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=70</guid>
		<description><![CDATA[Here it is, my crazy idea to create an anti anti-debug kernel module so reversing efforts get a little easier and faster against &#8220;hostile&#8221; code. This module will protect you against the classic PT_DENY_ATTACH trick and the sysctl debugger detection trick (http://developer.apple.com/qa/qa2004/qa1361.html). For now it&#8217;s only compatible with Mac OS X Tiger v10.4.11. Soon I [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/feed/</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>The IDA Pro Book: The Unofficial Guide to the World&#8217;s Most Popular Disassembler</title>
		<link>http://reverse.put.as/2008/10/17/the-ida-pro-book-the-unofficial-guide-to-the-worlds-most-popular-disassembler/</link>
		<comments>http://reverse.put.as/2008/10/17/the-ida-pro-book-the-unofficial-guide-to-the-worlds-most-popular-disassembler/#comments</comments>
		<pubDate>Fri, 17 Oct 2008 21:53:10 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=68</guid>
		<description><![CDATA[Excellent book ! Recommended if you are into Reverse Engineering and not only specific for IDA. Well written with lots of examples. Really enjoyed it. Well worth the money (and even cheaper if you use Amazon Market Place). I&#8217;m back with huge amounts of work so my reversing efforts are on a halt. Let&#8217;s see [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/10/17/the-ida-pro-book-the-unofficial-guide-to-the-worlds-most-popular-disassembler/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>&#8220;Hacker&#8221; Challenge</title>
		<link>http://reverse.put.as/2008/09/25/hacker-challenge/</link>
		<comments>http://reverse.put.as/2008/09/25/hacker-challenge/#comments</comments>
		<pubDate>Thu, 25 Sep 2008 10:15:40 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=66</guid>
		<description><![CDATA[Hello, If you want to have some fun and maybe improve your security/reversing skills, you might try this site http://www.dareyourmind.net ! It has some nice challenges in different fields (reversing is only for Windows, but hey you must be able to reverse for anything!). Have fun !]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/09/25/hacker-challenge/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>News&#8230;</title>
		<link>http://reverse.put.as/2008/09/08/news/</link>
		<comments>http://reverse.put.as/2008/09/08/news/#comments</comments>
		<pubDate>Mon, 08 Sep 2008 20:01:31 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Papers]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=45</guid>
		<description><![CDATA[A peak of work and vacations results in no reversing for the past weeks I had some advances on Little Snitch and I will publish them soon. Blackhat USA 2008 had some interesting stuff related to Mac OS X. And older paper related to DTrace (I really need to install Leopard to start messing around [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/09/08/news/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Kernel module for syscall interception and fixing ptrace</title>
		<link>http://reverse.put.as/2008/08/06/kernel-module-for-syscall-interception-and-fixing-ptrace/</link>
		<comments>http://reverse.put.as/2008/08/06/kernel-module-for-syscall-interception-and-fixing-ptrace/#comments</comments>
		<pubDate>Wed, 06 Aug 2008 11:13:09 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=22</guid>
		<description><![CDATA[Landon Fuller (http://landonf.bikemonkey.org/code/macosx) created a kernel module to bypass the PTRACE_DENY_ATTACH &#8220;anti-debug&#8221; feature of Mac OS X. For the Tiger version he used a deprecated API, removed on Leopard. For Leopard he re-routes the ptrace syscall to his own version by patching the syscall table. Since the Leopard version is much more interesting because we [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/08/06/kernel-module-for-syscall-interception-and-fixing-ptrace/feed/</wfw:commentRss>
		<slash:comments>11</slash:comments>
		</item>
		<item>
		<title>Mac OS X Code injection</title>
		<link>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/</link>
		<comments>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/#comments</comments>
		<pubDate>Thu, 03 Jul 2008 14:32:29 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=17</guid>
		<description><![CDATA[While trying to reverse Little Snitch I needed to understand the concept of Mach Ports (since I suspect it&#8217;s used for communication between the userland programs and the kernel extension) and found some nice articles/code about code injection in Mac OS X. They are: Mach Star (old but interesting): http://rentzsch.com/mach_star/ Mach Inject and Mach Override [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How to change /etc/hosts</title>
		<link>http://reverse.put.as/2008/02/02/how-to-change-etchosts/</link>
		<comments>http://reverse.put.as/2008/02/02/how-to-change-etchosts/#comments</comments>
		<pubDate>Sat, 02 Feb 2008 18:54:07 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/archives/6</guid>
		<description><![CDATA[It&#8217;s useful to change /etc/hosts, specially with protections requesting online keys. After editing /etc/hosts, you need to refresh OS X NetInfo Database. Just run the following command: sudo niload -v -m hosts . &#38;lt; /etc/hosts And then flush cache with: lookupd -flushcache For Snow Leopard the command has changed. It is now: dscacheutil -flushcache And [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/02/02/how-to-change-etchosts/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Change network card mac address</title>
		<link>http://reverse.put.as/2007/12/28/change-network-card-mac-address/</link>
		<comments>http://reverse.put.as/2007/12/28/change-network-card-mac-address/#comments</comments>
		<pubDate>Fri, 28 Dec 2007 20:27:28 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/archives/5</guid>
		<description><![CDATA[Since there are programs with serial numbers tied to network card mac address it might be useful to change it. There are some fancy GUI programs for this but it&#8217;s faster from terminal: ifconfig en0 lladdr X:XX:XX:XX:XX:XX And that&#8217;s it&#8230;]]></description>
		<wfw:commentRss>http://reverse.put.as/2007/12/28/change-network-card-mac-address/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>GDB input-radix option</title>
		<link>http://reverse.put.as/2007/10/18/gdb-input-radix-option/</link>
		<comments>http://reverse.put.as/2007/10/18/gdb-input-radix-option/#comments</comments>
		<pubDate>Thu, 18 Oct 2007 11:14:43 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/2007/10/18/gdb-input-radix-option/</guid>
		<description><![CDATA[You can see code like this in GDB: 0x3001ce2b : movzx edx,BYTE PTR &#91;ebp-80&#93; &#60;- 80 is decimal &#160; 0x3001ce2f : mov eax,DWORD PTR &#91;ebx+0x206c2&#93; &#60;- 0x206c2 is hexa &#40;0x is the key!&#41; If you try to do a x/x $ebp-80, you will get the wrong address because the default input radix is hexadecimal and [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2007/10/18/gdb-input-radix-option/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Must have tools&#8230;</title>
		<link>http://reverse.put.as/2007/10/10/must-have-tools/</link>
		<comments>http://reverse.put.as/2007/10/10/must-have-tools/#comments</comments>
		<pubDate>Wed, 10 Oct 2007 11:32:57 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/2007/10/10/must-have-tools/</guid>
		<description><![CDATA[A work in progress list&#8230; Otx &#8211; Graphical frontend for otool, the disassembler. http://otx.osxninja.com/ Burp Suite, Paros, Webscarab &#8211; web application assessment tools, including proxies (useful to sniff those online updates and registration schemes). http://research.corsaire.com/tools/ HexFiend &#8211; Hex Editor. http://ridiculousfish.com/hexfiend/]]></description>
		<wfw:commentRss>http://reverse.put.as/2007/10/10/must-have-tools/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

