<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Reverse Engineering Mac OS X &#187; Mac Reversing</title>
	<atom:link href="http://reverse.put.as/category/mac-reversing/feed/" rel="self" type="application/rss+xml" />
	<link>http://reverse.put.as</link>
	<description>Reverse Engineering Mac OS X for fun and NO profit</description>
	<lastBuildDate>Tue, 27 Jul 2010 21:01:51 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0</generator>
		<item>
		<title>OS X Crackmes</title>
		<link>http://reverse.put.as/2010/05/21/os-x-crackmes/</link>
		<comments>http://reverse.put.as/2010/05/21/os-x-crackmes/#comments</comments>
		<pubDate>Thu, 20 May 2010 23:55:07 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=637</guid>
		<description><![CDATA[Hello, I have just added a page to collect crackmes for OS X. I have added the ones that I already had and some recommended from user comments. Since corruptfire.com seems down I cannot retrieve the other ones they had. If you have more crackmes please mail them to me so I can add them [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/05/21/os-x-crackmes/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>reverse.put.as is back in a new format&#8230;</title>
		<link>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/</link>
		<comments>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/#comments</comments>
		<pubDate>Fri, 09 Apr 2010 18:34:25 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=571</guid>
		<description><![CDATA[I have been thinking about this and how to get this blog back to life. My free time has been almost zero but I miss the motivation to put my brain to tinker and create new things to publish, because reversing and everything around it sometimes is a great relaxing activity for me. The last [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Snow Leopard Impact into reverse engineering world&#8230;</title>
		<link>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/</link>
		<comments>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/#comments</comments>
		<pubDate>Wed, 28 Oct 2009 23:04:26 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=461</guid>
		<description><![CDATA[Some folks were complaining about problems with OTX and Snow Leopard so I decided to boot my Snow Leopard install and give it a try&#8230; Well they were right since Snow Leopard compiles 64 bit binaries by default. OTX v0.16b seems to have problems so you will need to download from the SVN and compile [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Anatomy of a gdb anti-debug trick part II: GDB isn&#8217;t alone !</title>
		<link>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/</link>
		<comments>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/#comments</comments>
		<pubDate>Wed, 26 Aug 2009 00:20:41 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=419</guid>
		<description><![CDATA[After having found the source of the gdb anti-debug trick, I started modifying gdb to work around the problem and fix the number of sections on the fly (it&#8217;s damn simple to calculate the real number of sections !!!). I was coding on a long train trip and everything was going great&#8230; My hack worked [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Reversing Pokerstars online poker client (I hope they aren&#8217;t from Vegas !!!)</title>
		<link>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/</link>
		<comments>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/#comments</comments>
		<pubDate>Thu, 20 Aug 2009 15:47:35 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=410</guid>
		<description><![CDATA[Today I bring you something from the old projects trunk ! Like many other millions of people I enjoy playing online Texas Hold&#8217;em. I started with Pokerstars three years ago, and after a while, diabolical ideas came to my head about reversing the client to have a peek into their communication protocol (what else were [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Anatomy of a gdb anti-debug trick</title>
		<link>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/</link>
		<comments>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/#comments</comments>
		<pubDate>Thu, 13 Aug 2009 16:38:52 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=391</guid>
		<description><![CDATA[Well, it seems this is the GDB post season ! The past days have been dedicated to mess around with gdb source code and today I have what I think it&#8217;s a nice story to tell. After hacking off my old wish of having the disassembly raw bytes to be printed (like Ollydbg, Softice, IDA, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>How to dump a MPress packed binary&#8230;</title>
		<link>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/</link>
		<comments>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/#comments</comments>
		<pubDate>Wed, 22 Jul 2009 22:15:21 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=355</guid>
		<description><![CDATA[Someone at macserialjunkie board posted a problem with the mpress packer. Since packers are a pretty rare thing at OS X and I was bored, I decided to give it a quick look. The result is another tutorial about manually unpacking this kind of binary. It&#8217;s not hard and the packer isn&#8217;t that great. Objective-C [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>How to dump an Apple protected binary</title>
		<link>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/</link>
		<comments>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/#comments</comments>
		<pubDate>Mon, 29 Jun 2009 23:04:43 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=330</guid>
		<description><![CDATA[From the department of useless stuff comes a simple trick&#8230; A few days ago, a reader sent me an email asking about obfuscated code, in what appeared to be Apple&#8217;s binary protection. I already knew this Amit Singh article, but never played with it. Since I&#8217;m very curious (I love cats but Onyx still doesn&#8217;t [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Mac OS X Kernel debugging with VMware</title>
		<link>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/</link>
		<comments>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/#comments</comments>
		<pubDate>Thu, 05 Mar 2009 12:19:37 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=178</guid>
		<description><![CDATA[I love VMware (used it since it&#8217;s first releases) and I love it even more now Yesterday I had the not so crazy idea (and not original) to use VMware for Mac OS X kernel debugging because newest Little Snitch version seems to have a new anti-debug trick and I don&#8217;t have another Mac at [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Onyx The Black Cat v0.2</title>
		<link>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/</link>
		<comments>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/#comments</comments>
		<pubDate>Sun, 16 Nov 2008 18:40:24 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=96</guid>
		<description><![CDATA[Here it is with support for Leopard and extended attributes. All calls related to extended attributes are traced and dumped to /var/log/system.log (I find it more useful than fs_usage for this specific calls). Check the .c file for options related to this. For Leopard support you need to edit the .c file and change the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Onyx The Black Cat v0.1 &#8211; Anti Anti-debug kernel module</title>
		<link>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/</link>
		<comments>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/#comments</comments>
		<pubDate>Thu, 30 Oct 2008 11:56:18 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=70</guid>
		<description><![CDATA[Here it is, my crazy idea to create an anti anti-debug kernel module so reversing efforts get a little easier and faster against &#8220;hostile&#8221; code. This module will protect you against the classic PT_DENY_ATTACH trick and the sysctl debugger detection trick (http://developer.apple.com/qa/qa2004/qa1361.html). For now it&#8217;s only compatible with Mac OS X Tiger v10.4.11. Soon I [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/feed/</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>Mac OS X Code injection</title>
		<link>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/</link>
		<comments>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/#comments</comments>
		<pubDate>Thu, 03 Jul 2008 14:32:29 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=17</guid>
		<description><![CDATA[While trying to reverse Little Snitch I needed to understand the concept of Mach Ports (since I suspect it&#8217;s used for communication between the userland programs and the kernel extension) and found some nice articles/code about code injection in Mac OS X. They are: Mach Star (old but interesting): http://rentzsch.com/mach_star/ Mach Inject and Mach Override [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
