<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Reverse Engineering Mac OS X &#187; Mac Reversing</title>
	<atom:link href="http://reverse.put.as/category/mac-reversing/feed/" rel="self" type="application/rss+xml" />
	<link>http://reverse.put.as</link>
	<description>Reverse Engineering for fun and pleasure!</description>
	<lastBuildDate>Sun, 05 Feb 2012 01:08:42 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>Anti-disassembly &amp; obfuscation #1: Apple doesn&#8217;t follow their own Mach-O specifications?</title>
		<link>http://reverse.put.as/2012/02/02/anti-disassembly-obfuscation-1-apple-doesnt-follow-their-own-mach-o-specifications/</link>
		<comments>http://reverse.put.as/2012/02/02/anti-disassembly-obfuscation-1-apple-doesnt-follow-their-own-mach-o-specifications/#comments</comments>
		<pubDate>Wed, 01 Feb 2012 23:13:53 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1284</guid>
		<description><![CDATA[I smile when I think about this &#8220;feature&#8221;! I liked it so much that things got out of control and I wrote a crackme to show it. It happens because Apple doesn&#8217;t follow their own documentation/specification and the reversing tools of the trade do. The result is that IDA terminates, disassemblers output the wrong disassembly, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/02/02/anti-disassembly-obfuscation-1-apple-doesnt-follow-their-own-mach-o-specifications/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Anti-debug trick #1: Abusing Mach-O to crash GDB</title>
		<link>http://reverse.put.as/2012/01/31/anti-debug-trick-1-abusing-mach-o-to-crash-gdb/</link>
		<comments>http://reverse.put.as/2012/01/31/anti-debug-trick-1-abusing-mach-o-to-crash-gdb/#comments</comments>
		<pubDate>Tue, 31 Jan 2012 21:28:22 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[anti-debug]]></category>
		<category><![CDATA[gdb]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1271</guid>
		<description><![CDATA[I developed this funny trick while trying to find a solution for a problem in a freelance project. It is pretty easy to implement and fun The trick consists in abusing the offset field in the dylib_command and pointing it to somewhere else. From the Mach-O File Format Reference, the command structures are: struct dylib_command [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/01/31/anti-debug-trick-1-abusing-mach-o-to-crash-gdb/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>We have a crackme winner!!!</title>
		<link>http://reverse.put.as/2012/01/31/we-have-a-crackme-winner/</link>
		<comments>http://reverse.put.as/2012/01/31/we-have-a-crackme-winner/#comments</comments>
		<pubDate>Tue, 31 Jan 2012 16:09:41 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1267</guid>
		<description><![CDATA[This Sunday I received a valid keygen solution for my crackme. Congratulations to the reverser who wishes to remain anonymous. When the solution is available our brain stops thinking and goes into lazy mode. So, my question is when do you want to have me starting to explain some of the tricks used in that [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/01/31/we-have-a-crackme-winner/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>My first crackme&#8230; from hell, I hope :-)</title>
		<link>http://reverse.put.as/2012/01/24/my-first-crackme-from-hell-i-hope/</link>
		<comments>http://reverse.put.as/2012/01/24/my-first-crackme-from-hell-i-hope/#comments</comments>
		<pubDate>Tue, 24 Jan 2012 02:20:58 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1255</guid>
		<description><![CDATA[My first OS X crackme is finally &#8220;ready&#8221;, after a long wait and some unnecessary teasing. &#8220;Ready&#8221; means that it is good enough to be released and hopefully give you some trouble to reverse and crack it. I still have many more ideas to implement and some areas could be more polished &#8211; it was [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/01/24/my-first-crackme-from-hell-i-hope/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>Some comments about plugin-alliance.com protection&#8230;</title>
		<link>http://reverse.put.as/2012/01/09/some-comments-about-plugin-alliance-com-protection/</link>
		<comments>http://reverse.put.as/2012/01/09/some-comments-about-plugin-alliance-com-protection/#comments</comments>
		<pubDate>Mon, 09 Jan 2012 21:43:43 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1215</guid>
		<description><![CDATA[It sucks, sort of! Let me rewind to the beginning I was very curious about this one because it was announced with great fanfare. I interpreted it as something more robust than it really is &#8211; maybe I was over enthusiastic with the &#8220;we know this will be cracked someday&#8221; sentence. Some brief comments: - [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2012/01/09/some-comments-about-plugin-alliance-com-protection/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Evil iTunes Plugins from Hell</title>
		<link>http://reverse.put.as/2011/11/22/evil-itunes-plugins-from-hell/</link>
		<comments>http://reverse.put.as/2011/11/22/evil-itunes-plugins-from-hell/#comments</comments>
		<pubDate>Tue, 22 Nov 2011 04:46:25 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1127</guid>
		<description><![CDATA[Let me start this with some sort of disclaimer. I do not support/condone stealing credit card information, logins, and other personal information. Disclosing security issues is always a double edge sword and a tricky problem with some politics in the mix. This problem was reported almost 3 months ago to Apple. It&#8217;s still not fixed [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/11/22/evil-itunes-plugins-from-hell/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Poking around Sentinel HASP Envelope for Mac OS X :-)</title>
		<link>http://reverse.put.as/2011/10/13/poking-around-sentinel-hasp-envelope-for-mac-os-x/</link>
		<comments>http://reverse.put.as/2011/10/13/poking-around-sentinel-hasp-envelope-for-mac-os-x/#comments</comments>
		<pubDate>Wed, 12 Oct 2011 23:12:10 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[dongle]]></category>
		<category><![CDATA[hasp]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1065</guid>
		<description><![CDATA[I am a sucker for all OS X anti-debug promises I  can find. There are so few tricks available that I am always curious to see if there is something new in town. So I started poking around Sentinel HASP Envelope for OS X to see what they use to fool my dear debuggers. Well, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/10/13/poking-around-sentinel-hasp-envelope-for-mac-os-x/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>A small rant about dongles: the developer who can&#8217;t correctly implement a HASP!</title>
		<link>http://reverse.put.as/2011/10/11/a-small-rant-about-dongles-the-developer-who-cant-correctly-implement-a-hasp/</link>
		<comments>http://reverse.put.as/2011/10/11/a-small-rant-about-dongles-the-developer-who-cant-correctly-implement-a-hasp/#comments</comments>
		<pubDate>Tue, 11 Oct 2011 22:30:17 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1058</guid>
		<description><![CDATA[Dongles always had something mistique about them. Before this new age of packers, cryptors, etc, they were the top target to beat. In practice, that fame was only real in a reduced set of applications that correctly implemented the dongle. Most dongle-protected software features bad implementations. Developers don&#8217;t spend enough time in this area or [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/10/11/a-small-rant-about-dongles-the-developer-who-cant-correctly-implement-a-hasp/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Using Apple&#8217;s sandbox feature for reversing purposes :-)</title>
		<link>http://reverse.put.as/2011/08/30/using-apples-sandbox-feature-for-reversing-purposes/</link>
		<comments>http://reverse.put.as/2011/08/30/using-apples-sandbox-feature-for-reversing-purposes/#comments</comments>
		<pubDate>Tue, 30 Aug 2011 22:41:56 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=1000</guid>
		<description><![CDATA[I was just messing with Apple&#8217;s sandbox implementation to see if it was possible to close a &#8220;vulnerability&#8221; in iTunes (more on that later after Apple answers my email) and decided to experiment with something that has been in my mind for a long time and never bothered to try. The idea is to use [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/08/30/using-apples-sandbox-feature-for-reversing-purposes/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Removing iTunes 10.4 m3u processing feature with a small loader</title>
		<link>http://reverse.put.as/2011/08/25/removing-itunes-10-4-m3u-processing-feature-with-a-small-loader/</link>
		<comments>http://reverse.put.as/2011/08/25/removing-itunes-10-4-m3u-processing-feature-with-a-small-loader/#comments</comments>
		<pubDate>Thu, 25 Aug 2011 21:42:58 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=985</guid>
		<description><![CDATA[I just discovered that iTunes 10.4 finally introduced support to load m3u files. If you are importing large quantities of mp3 archives like me then you probably will be very annoyed by the mess that iTunes 10.4 will make out of this &#8211; playlists will be created and a ugly mess will emerge (and takes [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/08/25/removing-itunes-10-4-m3u-processing-feature-with-a-small-loader/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>How gdb disables ASLR in Mac OS X Lion</title>
		<link>http://reverse.put.as/2011/08/11/how-gdb-disables-aslr-in-mac-os-x-lion/</link>
		<comments>http://reverse.put.as/2011/08/11/how-gdb-disables-aslr-in-mac-os-x-lion/#comments</comments>
		<pubDate>Thu, 11 Aug 2011 21:45:17 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[aslr]]></category>
		<category><![CDATA[gdb]]></category>
		<category><![CDATA[kernel]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=953</guid>
		<description><![CDATA[This isn&#8217;t a rocket science post but more like some notes for future reference Lion finally introduces full ASLR and gdb has the possibility to disable that feature when analyzing target binaries. A new gdb setting was added, &#8220;disable-aslr&#8221;, which allows to enable or disable this feature. By default this feature appears to be enabled [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/08/11/how-gdb-disables-aslr-in-mac-os-x-lion/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>There&#8217;s a new protection in town, Software Passport, from the developers of Armadillo :-)</title>
		<link>http://reverse.put.as/2011/02/16/theres-a-new-protection-in-town-software-passport-from-the-developers-of-armadillo/</link>
		<comments>http://reverse.put.as/2011/02/16/theres-a-new-protection-in-town-software-passport-from-the-developers-of-armadillo/#comments</comments>
		<pubDate>Tue, 15 Feb 2011 23:46:22 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=787</guid>
		<description><![CDATA[A reader sent me the link for a new software protection package called Software Passport (here). This is from The Silicons Realms, the makers of Armadillo for Windows. Since I&#8217;m as curious as cats, I started giving a quick look on it, to see if it has any interesting things related to anti-debugging and anti-disassembly. [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/02/16/theres-a-new-protection-in-town-software-passport-from-the-developers-of-armadillo/feed/</wfw:commentRss>
		<slash:comments>23</slash:comments>
		</item>
		<item>
		<title>It&#8217;s not my war but&#8230;</title>
		<link>http://reverse.put.as/2011/02/15/its-not-my-war-but/</link>
		<comments>http://reverse.put.as/2011/02/15/its-not-my-war-but/#comments</comments>
		<pubDate>Tue, 15 Feb 2011 19:42:20 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=782</guid>
		<description><![CDATA[I just saw the following at MSJ and the reaction of the one byte fag and other idiots is simply childish, to not digress much about it.  The author of Remote Buddy leaves the post below, asking for them to stop distributing cracks on his software. As a response, tons of links with the crack [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/02/15/its-not-my-war-but/feed/</wfw:commentRss>
		<slash:comments>16</slash:comments>
		</item>
		<item>
		<title>Universe&#8217;s best and legal Mac OS X reversing tutorial for newbies (or maybe not!)</title>
		<link>http://reverse.put.as/2011/02/12/universes-best-and-legal-mac-os-x-reversing-tutorial-for-newbies-or-maybe-not/</link>
		<comments>http://reverse.put.as/2011/02/12/universes-best-and-legal-mac-os-x-reversing-tutorial-for-newbies-or-maybe-not/#comments</comments>
		<pubDate>Sat, 12 Feb 2011 03:01:22 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=775</guid>
		<description><![CDATA[I have decided to re-release my beginners tutorial, this time based on a crackme, so it deserves the upgrade to Universe instead of World. It includes patching, serial fishing and a keygen. I have updated some errors that I found in the original tutorial. Reversing and breaking protections is a great hobby and fantastic knowledge [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/02/12/universes-best-and-legal-mac-os-x-reversing-tutorial-for-newbies-or-maybe-not/feed/</wfw:commentRss>
		<slash:comments>19</slash:comments>
		</item>
		<item>
		<title>Why cracking the vast majority of Mac apps isn&#8217;t that sexy&#8230;</title>
		<link>http://reverse.put.as/2011/01/17/why-cracking-the-vast-majority-of-mac-apps-isnt-that-sexy/</link>
		<comments>http://reverse.put.as/2011/01/17/why-cracking-the-vast-majority-of-mac-apps-isnt-that-sexy/#comments</comments>
		<pubDate>Mon, 17 Jan 2011 22:50:07 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=739</guid>
		<description><![CDATA[I shouldn&#8217;t be posting this because the guy doesn&#8217;t deserve any traffic he might get by writing this. But it&#8217;s so funny that I cannot resist (yes, I&#8217;m weak!!!). The blog post is called &#8220;I Can Crack Your App With Just A Shell (And How To Stop Me)&#8221; and it&#8217;s available here. I especially like [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/01/17/why-cracking-the-vast-majority-of-mac-apps-isnt-that-sexy/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Reversing the exit(173) from the Mac App Store</title>
		<link>http://reverse.put.as/2011/01/15/reversing-the-exit173-from-the-mac-app-store/</link>
		<comments>http://reverse.put.as/2011/01/15/reversing-the-exit173-from-the-mac-app-store/#comments</comments>
		<pubDate>Sat, 15 Jan 2011 03:33:23 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=733</guid>
		<description><![CDATA[This will be a working in progress so this post might be updated a few times. As promised, a reader sent me the Mac App Store (MAS) validation guidelines (thank you again!) and I got curious about one detail, the exit(173). This guides states if application fails to validate the receipt because it&#8217;s not present, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/01/15/reversing-the-exit173-from-the-mac-app-store/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>The Mac App Store&#8230; Security broken by design?</title>
		<link>http://reverse.put.as/2011/01/07/the-mac-app-store-security-broken-by-design/</link>
		<comments>http://reverse.put.as/2011/01/07/the-mac-app-store-security-broken-by-design/#comments</comments>
		<pubDate>Fri, 07 Jan 2011 15:55:50 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=713</guid>
		<description><![CDATA[The Mac App Store opened yesterday and a few hours after the web is already full of news about the hacking/cracking/defeat/whatever of the store. When I heard about the Mac App Store, I became curious about how it would handle the serial and other protections of normal applications. I had read an article/news that talked [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2011/01/07/the-mac-app-store-security-broken-by-design/feed/</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>A semi-automated way to find sysent</title>
		<link>http://reverse.put.as/2010/11/27/a-semi-automated-way-to-find-sysent/</link>
		<comments>http://reverse.put.as/2010/11/27/a-semi-automated-way-to-find-sysent/#comments</comments>
		<pubDate>Fri, 26 Nov 2010 23:05:42 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=701</guid>
		<description><![CDATA[The original method to hijack sysent table was described by Landon Fuller and then Braeden Thomas updated it to Snow Leopard due to new location and lack of nsysent symbol. Charlie Miller and Dino Dai Zovi at The Mac Hacker&#8217;s Handbook, have some code to try to automate this search for sysent. I never tried [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/11/27/a-semi-automated-way-to-find-sysent/feed/</wfw:commentRss>
		<slash:comments>10</slash:comments>
		</item>
		<item>
		<title>GDB anti-debug, Otool/otx anti-disassembly&#8230; It&#8217;s Challenge number 3 !!!</title>
		<link>http://reverse.put.as/2010/08/18/gdb-anti-debug-otoolotx-anti-disassembly-its-challenge-number-3/</link>
		<comments>http://reverse.put.as/2010/08/18/gdb-anti-debug-otoolotx-anti-disassembly-its-challenge-number-3/#comments</comments>
		<pubDate>Wed, 18 Aug 2010 02:15:06 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=673</guid>
		<description><![CDATA[Today I decided to give a look at Challenge #3 since it promised nasty tricks. Now that looks like a challenge and I love challenges! If you think this is a spoiler then stop reading and come back in a week or so. There is no solution for the challenge; I&#8217;m more interested in the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/08/18/gdb-anti-debug-otoolotx-anti-disassembly-its-challenge-number-3/feed/</wfw:commentRss>
		<slash:comments>20</slash:comments>
		</item>
		<item>
		<title>How to Keygen MSJ Kracking Challenge &#8217;10 &#8211; Challenge #1</title>
		<link>http://reverse.put.as/2010/08/02/how-to-keygen-msj-kracking-challenge-10-challenge-1/</link>
		<comments>http://reverse.put.as/2010/08/02/how-to-keygen-msj-kracking-challenge-10-challenge-1/#comments</comments>
		<pubDate>Mon, 02 Aug 2010 19:18:53 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=661</guid>
		<description><![CDATA[The MBA is over and I&#8217;m enjoying my vacations to clear stuff from the Todo list, to read books, to play some games and to do other stuff. Today the MacSerialJunkies contest started and I decided to give it a go. It&#8217;s a very simple crackme with a small twist where you have to bruteforce [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/08/02/how-to-keygen-msj-kracking-challenge-10-challenge-1/feed/</wfw:commentRss>
		<slash:comments>27</slash:comments>
		</item>
		<item>
		<title>OS X Crackmes</title>
		<link>http://reverse.put.as/2010/05/21/os-x-crackmes/</link>
		<comments>http://reverse.put.as/2010/05/21/os-x-crackmes/#comments</comments>
		<pubDate>Thu, 20 May 2010 23:55:07 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=637</guid>
		<description><![CDATA[Hello, I have just added a page to collect crackmes for OS X. I have added the ones that I already had and some recommended from user comments. Since corruptfire.com seems down I cannot retrieve the other ones they had. If you have more crackmes please mail them to me so I can add them [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/05/21/os-x-crackmes/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>reverse.put.as is back in a new format&#8230;</title>
		<link>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/</link>
		<comments>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/#comments</comments>
		<pubDate>Fri, 09 Apr 2010 18:34:25 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=571</guid>
		<description><![CDATA[I have been thinking about this and how to get this blog back to life. My free time has been almost zero but I miss the motivation to put my brain to tinker and create new things to publish, because reversing and everything around it sometimes is a great relaxing activity for me. The last [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Snow Leopard Impact into reverse engineering world&#8230;</title>
		<link>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/</link>
		<comments>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/#comments</comments>
		<pubDate>Wed, 28 Oct 2009 23:04:26 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=461</guid>
		<description><![CDATA[Some folks were complaining about problems with OTX and Snow Leopard so I decided to boot my Snow Leopard install and give it a try&#8230; Well they were right since Snow Leopard compiles 64 bit binaries by default. OTX v0.16b seems to have problems so you will need to download from the SVN and compile [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Anatomy of a gdb anti-debug trick part II: GDB isn&#8217;t alone !</title>
		<link>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/</link>
		<comments>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/#comments</comments>
		<pubDate>Wed, 26 Aug 2009 00:20:41 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=419</guid>
		<description><![CDATA[After having found the source of the gdb anti-debug trick, I started modifying gdb to work around the problem and fix the number of sections on the fly (it&#8217;s damn simple to calculate the real number of sections !!!). I was coding on a long train trip and everything was going great&#8230; My hack worked [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Reversing Pokerstars online poker client (I hope they aren&#8217;t from Vegas !!!)</title>
		<link>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/</link>
		<comments>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/#comments</comments>
		<pubDate>Thu, 20 Aug 2009 15:47:35 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=410</guid>
		<description><![CDATA[Today I bring you something from the old projects trunk ! Like many other millions of people I enjoy playing online Texas Hold&#8217;em. I started with Pokerstars three years ago, and after a while, diabolical ideas came to my head about reversing the client to have a peek into their communication protocol (what else were [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Anatomy of a gdb anti-debug trick</title>
		<link>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/</link>
		<comments>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/#comments</comments>
		<pubDate>Thu, 13 Aug 2009 16:38:52 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=391</guid>
		<description><![CDATA[Well, it seems this is the GDB post season ! The past days have been dedicated to mess around with gdb source code and today I have what I think it&#8217;s a nice story to tell. After hacking off my old wish of having the disassembly raw bytes to be printed (like Ollydbg, Softice, IDA, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>How to dump a MPress packed binary&#8230;</title>
		<link>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/</link>
		<comments>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/#comments</comments>
		<pubDate>Wed, 22 Jul 2009 22:15:21 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=355</guid>
		<description><![CDATA[Someone at macserialjunkie board posted a problem with the mpress packer. Since packers are a pretty rare thing at OS X and I was bored, I decided to give it a quick look. The result is another tutorial about manually unpacking this kind of binary. It&#8217;s not hard and the packer isn&#8217;t that great. Objective-C [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>How to dump an Apple protected binary</title>
		<link>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/</link>
		<comments>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/#comments</comments>
		<pubDate>Mon, 29 Jun 2009 23:04:43 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=330</guid>
		<description><![CDATA[From the department of useless stuff comes a simple trick&#8230; A few days ago, a reader sent me an email asking about obfuscated code, in what appeared to be Apple&#8217;s binary protection. I already knew this Amit Singh article, but never played with it. Since I&#8217;m very curious (I love cats but Onyx still doesn&#8217;t [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>A bunch of old tutorials&#8230;</title>
		<link>http://reverse.put.as/2009/04/07/a-bunch-of-old-tutorials/</link>
		<comments>http://reverse.put.as/2009/04/07/a-bunch-of-old-tutorials/#comments</comments>
		<pubDate>Tue, 07 Apr 2009 09:51:51 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=231</guid>
		<description><![CDATA[While cleaning my hard disk I have found a zip file with a few old Mac OS X cracking tuts. Most are for PPC but they are still useful for learning reversing techniques. Grab it here: tuts.zip (SHA1(tuts.zip)= 3a0e1729e811deb7b7e8e19e0d6a61c9e3831b84) My free time is almost zero since GMAT study is taking every second I have (well, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/04/07/a-bunch-of-old-tutorials/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Defeating Little Snitch and thinking about piracy&#8230;</title>
		<link>http://reverse.put.as/2009/03/27/defeating-little-snitch-and-thinking-about-piracy/</link>
		<comments>http://reverse.put.as/2009/03/27/defeating-little-snitch-and-thinking-about-piracy/#comments</comments>
		<pubDate>Fri, 27 Mar 2009 12:45:22 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=222</guid>
		<description><![CDATA[I have managed to bypass Little Snitch 3 hour limit with a one or two bytes patch (can&#8217;t remember and too lazy to check it now) three days after I had access to kernel debugging. A very well designed protection (at least it&#8217;s a pain to analyse) was defeated because there was a weak element [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/03/27/defeating-little-snitch-and-thinking-about-piracy/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Mac OS X Kernel debugging with VMware</title>
		<link>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/</link>
		<comments>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/#comments</comments>
		<pubDate>Thu, 05 Mar 2009 12:19:37 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=178</guid>
		<description><![CDATA[I love VMware (used it since it&#8217;s first releases) and I love it even more now Yesterday I had the not so crazy idea (and not original) to use VMware for Mac OS X kernel debugging because newest Little Snitch version seems to have a new anti-debug trick and I don&#8217;t have another Mac at [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>iWork/Photoshop Trojan or Botnet Binary found</title>
		<link>http://reverse.put.as/2009/01/22/iwork-trojan-or-botnet-binary-found/</link>
		<comments>http://reverse.put.as/2009/01/22/iwork-trojan-or-botnet-binary-found/#comments</comments>
		<pubDate>Thu, 22 Jan 2009 11:00:13 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=150</guid>
		<description><![CDATA[It seems there is a trojan or botnet binary for OS X in the wild. Some details available at http://ithreats.wordpress.com/2009/01/22/latest-os-x-threat-iworkservices/ . The iWorkservices binary is available here: iWorkServices-trojan.zip A very quick and dirty strings dump and disassembly seems to show a trojan with botnet capabilities. There are references to p2p and that can be the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/01/22/iwork-trojan-or-botnet-binary-found/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Onyx The Black Cat v0.2</title>
		<link>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/</link>
		<comments>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/#comments</comments>
		<pubDate>Sun, 16 Nov 2008 18:40:24 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=96</guid>
		<description><![CDATA[Here it is with support for Leopard and extended attributes. All calls related to extended attributes are traced and dumped to /var/log/system.log (I find it more useful than fs_usage for this specific calls). Check the .c file for options related to this. For Leopard support you need to edit the .c file and change the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Onyx The Black Cat v0.1 &#8211; Anti Anti-debug kernel module</title>
		<link>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/</link>
		<comments>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/#comments</comments>
		<pubDate>Thu, 30 Oct 2008 11:56:18 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=70</guid>
		<description><![CDATA[Here it is, my crazy idea to create an anti anti-debug kernel module so reversing efforts get a little easier and faster against &#8220;hostile&#8221; code. This module will protect you against the classic PT_DENY_ATTACH trick and the sysctl debugger detection trick (http://developer.apple.com/qa/qa2004/qa1361.html). For now it&#8217;s only compatible with Mac OS X Tiger v10.4.11. Soon I [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/feed/</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>Mac OS X Code injection</title>
		<link>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/</link>
		<comments>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/#comments</comments>
		<pubDate>Thu, 03 Jul 2008 14:32:29 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=17</guid>
		<description><![CDATA[While trying to reverse Little Snitch I needed to understand the concept of Mach Ports (since I suspect it&#8217;s used for communication between the userland programs and the kernel extension) and found some nice articles/code about code injection in Mac OS X. They are: Mach Star (old but interesting): http://rentzsch.com/mach_star/ Mach Inject and Mach Override [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

