Comments for Reverse Engineering Mac OS X

Comment on A little disassembler for MPress packer… by B:.

B:. — Mon, 26 Jul 2010 20:40:17 +0000

Anyone found anything useful about this vmmap exception?

Comment on Onyx the Black Cat v0.4 for Snow Leopard by negev

negev — Tue, 13 Jul 2010 11:48:05 +0000

- table = (struct sysent *) ( 0×008317f0 – 0×28b0 );

This causes my 10.6.4 mbp to panic, is this for 32bit? How does one find the 64bit values?

Thanks!

Comment on Very small update… by skuret

skuret — Fri, 02 Jul 2010 10:11:10 +0000

thank you very much for the help. and also thanks for pointing out that svn trunk of otx has x64 support. (i guess i read it here somewhere)

Comment on Onyx the Black Cat v0.4 for Snow Leopard by Reflejo

Reflejo — Thu, 01 Jul 2010 05:02:31 +0000

In 10.6.4, substracting 0×2850 will not work, It’s now located at -0x28b0 from the _nsysent symbol.

table = (struct sysent *) ( 0x008317f0 – 0x28b0 );

Comment on Very small update… by fG!

fG! — Fri, 25 Jun 2010 23:07:05 +0000

Macserialjunkies.

Comment on Very small update… by Gunther

Gunther — Fri, 25 Jun 2010 16:40:59 +0000

Hi fG!,

but may i know the website you got the crackmes from MSJ challenge?

Thanks in advance.

BR,
[ Gunther ]

Comment on Very small update… by fG!

fG! — Mon, 21 Jun 2010 22:03:41 +0000

Check out http://vxheavens.com/lib/vsc04.html

It’s the false breakpoint trick (int3). There is one int3 in the code but that one isn’t breaking. I bet the binary has obfuscated code protecting that int3 that’s confusing gdb. You will have to trace since the entrypoint and manually find where it is (yeah it’s a pain in the ass but works all the time!).
I don’t have the time at the moment to further analyse it! But it seems like an interesting time. First time I ever saw someone using this trick at OS X.
Have fun!

Comment on Very small update… by fG!

fG! — Mon, 21 Jun 2010 21:43:03 +0000

Hello,
Sorry for the late answer. I think 06 is the error for a anti-debug technique published by Apple. I cannot remember the name right now. I will have to find my notes to see what is it!
Let me see if I can find it. Not sure if it is into one of the removed tutorials.

fG!

Comment on Very small update… by skuret

skuret — Wed, 16 Jun 2010 15:29:46 +0000

Hi! I could not find out anywhere else to ask you this so I am posting a comment. I am an intermediate reverser. I can write keygens for mac. But I cannot circumvent anti debugging techniques. Nowadays I am working on it. I was looking at Postbox 1.1.5 and i cannot even figure out what anti debugging technique is used. If you have time and see which technique is used i can start to work on it. I know it is a little too much to ask but i figured i should try my chances.

by the way in gdb, program exits with code 06.

thanks for this fantastic blog

Comment on Apple’s GDB Bug ? by Singh

Singh — Sun, 13 Jun 2010 08:24:05 +0000

This is quite annoying. Here is an expect script to allow you to type “gdb file” and allow global variables to work:

$ cat gdbx
#!/usr/bin/expect
spawn gdb
expect “(gdb) ”
send “exec-file [lindex $argv 0]\n”
interact

$ ./gdbx /bin/ls
spawn gdb
GNU gdb 6.3.50-20050815 (Apple version gdb-962) (Sat Jul 26 08:14:40 UTC 2008)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type “show copying” to see the conditions.
There is absolutely no warranty for GDB. Type “show warranty” for details.
This GDB was configured as “i386-apple-darwin”.
(gdb) exec-file /bin/ls
Reading symbols for shared libraries …. done
(gdb) b *0x000023f0
Breakpoint 1 at 0x23f0
(gdb) r
Starting program: /bin/ls
Reading symbols for shared libraries ….. done

Breakpoint 1, 0x000023f0 in ?? ()
$1 = “test”
$2 = 10
$3 = 20
(gdb)

Comment on OS X Crackmes by fredo

fredo — Thu, 27 May 2010 13:09:04 +0000

Hi fG!

Do you know where i can read about ways of dealing with Dynamic function calls and how to use breakpoints in gdb for such scenarios?

Comment on Onyx the Black Cat v0.4 for Snow Leopard by fG!

fG! — Tue, 25 May 2010 22:11:05 +0000

I don’t remember much about Remote Buddy except that the author is very active in changing protections and he was a bit annoyed by my article. I would expect him to be improving the protection and making things harder. The nice trick he was using was the extended attributes to store information. That’s the reason that I coded that feature into onyx the black cat so I could easily monitor any attempts to it.

Comment on Onyx the Black Cat v0.4 for Snow Leopard by fG!

fG! — Tue, 25 May 2010 22:08:36 +0000

The address should be 0xffffff800048996c. But the substract size must be different since we are talking about 64 bit addresses. Let me check and compute the right value and I will come back to you

Comment on Onyx the Black Cat v0.4 for Snow Leopard by Ans

Ans — Tue, 25 May 2010 21:56:22 +0000

Hello again fG!

I just read that you was working on “Remote Buddy” too. Could you share your experience?. I’m a little bit lost on this one. I can’t get symbols correctly, and I’m running out of luck using just otx/hexeditor.

I removed _ptraced calls and could locate CopyCore address but i don’t know if that helps. What are RBuddy encrypting on directories?.

Thank you for all your work by the way.

Comment on Onyx the Black Cat v0.4 for Snow Leopard by fry

fry — Tue, 25 May 2010 20:11:53 +0000

killer….
10x…

cheers

Comment on Onyx the Black Cat v0.4 for Snow Leopard by navaja

navaja — Mon, 24 May 2010 16:35:25 +0000

And here is the output for _nsysent for 32bit and 64bit arch:

$ nm -arch i386 /mach_kernel | grep _nsysent
00831730 D _nsysent
0085df7c S _nsysent_size_check

$ nm -arch x86_64 /mach_kernel | grep _nsysent
ffffff800065ac90 D _nsysent
ffffff8000695830 S _nsysent_size_check

Comment on Onyx the Black Cat v0.4 for Snow Leopard by navaja

navaja — Mon, 24 May 2010 15:51:47 +0000

navaja:~ navaja$ nm -arch i386 /mach_kernel | grep _nosys
004910f3 T _nosys

navaja:~ navaja$ nm -arch x86_64 /mach_kernel | grep _nosys
ffffff800048996c T _nosys

Comment on Onyx the Black Cat v0.4 for Snow Leopard by navaja

navaja — Mon, 24 May 2010 15:48:17 +0000

The output is: ffffff800048996c T _nosys

Does this mean that I should change this line in onyx_the_black_cat.c:
table = (struct sysent *) ( 0×00831730 – 0×2710 );
to this:
table = (struct sysent *) ( 0x0048996c – 0×2710 );
?

Comment on Onyx the Black Cat v0.4 for Snow Leopard by fG!

fG! — Mon, 24 May 2010 14:01:49 +0000

Most probably has to do with the fact that you are using a 64bit kernel!
Issue this command “nm /mach_kernel | grep _nosys” and tell me what’s the output

Totally forgot about 64bit kernels!

Comment on Onyx the Black Cat v0.4 for Snow Leopard by navaja

navaja — Mon, 24 May 2010 09:29:42 +0000

Can’t get it to work. If I try to load it a second time my mac crashes and I have to reboot.

navaja:~ navaja$ sudo kextload /System/Library/Extensions/onyx-the-black-cat.kext
/System/Library/Extensions/onyx-the-black-cat.kext failed to load – (libkern/kext) kext (kmod) start/stop routine failed; check the system/kernel logs for errors or try kextutil(8).

navaja:~ navaja$ sudo dmesg
npvhash=4095
PAE enabled
64 bit mode enabled
Darwin Kernel Version 10.3.0: Fri Feb 26 11:58:09 PST 2010; root:xnu-1504.3.12~1/RELEASE_I386

…

[onyx-the-black-cat] Starting patching …
[onyx-the-black-cat] Finding sysent table…
[onyx-the-black-cat] Sanity check: verifying if number of syscalls arguments are the expected ones
[onyx-the-black-cat] Sanity check: sanity check failed, could not find sysent table.
[onyx-the-black-cat] Error: Cannot find sysent table
Kext com.reverse.put.as.kext.onyx_the_black_cat start failed (result 0×5).
Kext com.reverse.put.as.kext.onyx_the_black_cat failed to load (0xdc008017).
Failed to load kext com.reverse.put.as.kext.onyx_the_black_cat (error 0xdc008017).

Any suggestions?
Perhaps it has something to do with the pt_deny_attach.kext I was using before?
http://bit.ly/96OzCq

Comment on Onyx the Black Cat v0.4 for Snow Leopard by Fz

Fz — Mon, 24 May 2010 07:41:38 +0000

Playing around with traced i just found one interesting object address. (Still I can’t read function names in gdb).

gdb$ print (int)[0x42e150 licenseIsValid]
$1 = 0×0

How can I add a breakpoint into this function?

gdb$ break licenseIsValid
Function “licenseIsValid” not defined.

Thank you!

Comment on Onyx the Black Cat v0.4 for Snow Leopard by Fz

Fz — Mon, 24 May 2010 02:17:30 +0000

Ok. The kext is working. Now PT_DENY_ATTACH/P_LNOATTACH is blocked. But for some reason functions/symbols are not loaded.

I keep getting:

Function “xxxxx” not defined.
Make breakpoint pending on future shared library load? (y or [n])

But those functions not only are present on the dump (class-dump) and showed by otx, also ARE called (checked sing dtrace)

#!/usr/sbin/dtrace -qs

pid$1::objc_msgSend:entry
{
self->isa = *(long *)copyin(arg0,4);
printf(“-[%s %s]\n”,copyinstr(*(long *)copyin(self->isa + 8,
4)),copyinstr(arg1));
}

Any idea why ?

Comment on Onyx the Black Cat v0.4 for Snow Leopard by fG!

fG! — Mon, 24 May 2010 01:52:53 +0000

Yeah I was going to answer but you already found by yourself. Have to change project default to use 10.6 SDK.

Thanks for the test

Comment on Onyx the Black Cat v0.4 for Snow Leopard by Fz

Fz — Mon, 24 May 2010 01:47:38 +0000

My fault.

PROTip: Check that 10.6 is your active SDK

Comment on Onyx the Black Cat v0.4 for Snow Leopard by Fz

Fz — Mon, 24 May 2010 01:02:11 +0000

It seams that sctructures.h are redefining some structs. I’m getting lot of compiling errors like:

In file included from /Users/…/Downloads/onyx-the-black-cat-snowleopard/onyx_the_black_cat.c:30:
/Users/…/Downloads/onyx-the-black-cat-snowleopard/structures.h:439: error: redefinition of ‘struct _pcred’
/Users/…/Downloads/onyx-the-black-cat-snowleopard/structures.h:449: error: redefinition of ‘struct _ucred’
/Users/…/Downloads/onyx-the-black-cat-snowleopard/structures.h:457: error: redefinition of ‘struct extern_proc’
/Users/…/Downloads/onyx-the-black-cat-snowleopard/structures.h:513: error: redefinition of ‘struct kinfo_proc’
/Users/…/Downloads/onyx-the-black-cat-snowleopard/structures.h:515: error: redefinition of ‘struct eproc’

Comment on A little disassembler for MPress packer… by fG!

fG! — Sat, 22 May 2010 23:19:34 +0000

I just verified everything and you are correct. When you try to vmmap inside the linker code it crashes with the same problem.
Seems like a bug or something was changed with Snow Leopard… Have to investigate it further!

Comment on Crackmes by hawke

hawke — Sat, 22 May 2010 16:36:09 +0000

Three CorruptFire krackmes.
http://www.mediafire.com/?wzrzmtn3znm
http://www.mediafire.com/?znzm4dmjdrn
http://www.mediafire.com/?oxymhtikh1z

Comment on OS X Crackmes by fredo

fredo — Sat, 22 May 2010 16:21:29 +0000

Thanks for the crackMes fG!

Any chance you can write some new about opcodes? i’m struggling to go from changing the flow of apps into making it stick using hex editor since i don’t know how to what i’m doing. You’re Slidpad tutorial only touches the hex editing and patching only very briefly touches this for the very specific example.

Comment on OS X Crackmes by coffeebean

coffeebean — Sat, 22 May 2010 14:39:38 +0000

Great idea! Thanks, fG!

coffee

Comment on Gdbinit v7.3 by fG!

fG! — Thu, 20 May 2010 23:21:07 +0000

It seems you are trying to debug the 64bits version with the 32bits settings in gdbinit. If you want to do that you need to change to 32bits
Check gdbinit header about how to do it (basically issue the command 32bit or modify the preferences in the script).

Comment on Gdbinit v7.3 by fredo

fredo — Thu, 20 May 2010 01:00:27 +0000

Thanks fG! i’ll look into that.

also when you get a chance can you please look at this post (tinyurl.com/2cnb83d) i made about my problems trying to debug the “Hello world” program in gdb. I think the problem might be with the gdbinit (but what do i know so is possibly wrong). Thanks in advance

Comment on Gdbinit v7.3 by fG!

fG! — Wed, 19 May 2010 15:03:15 +0000

You will need to download latest otx source and compile it. The problem is that the downloadable version doesn’t support 64bits and that’s the reason for the error.
The latest version doesn’t have issues with Snow Leopard (just some minor stuff). It’s fine if you debug 32bits binaries.

Comment on Gdbinit v7.3 by fredo

fredo — Wed, 19 May 2010 03:44:45 +0000

Thanks for your answers fG!
I’ve set the option via “Get info” to open in 32-bit mode making it easier to follow the tutorials so thanks for the hint.

about the gdbinit file you’ve made , From what you’ve written it has some issues with snow leopard, would that effect me doing basic RE or is it just effecting the more complex scenarios you guys get into? In short, is it safe gdbinit safe to use for someone like me(newbie) on snow leopard?

as for otx commandline tool, it tell me the same thing as the GUI otx, “otx: main is not a Mach-O file.” , main being the same “Hello world” code in C from your SlidePad tutorial!

also can anyone get into CorruptFire.Com? I’ve been trying to get into the site to see what else is in there but it just times out.

Lastly (fG! is probably going to IP block me soon with all these questions) when should one expect to see a new tutorial ?

Comment on Gdbinit v7.3 by fG!

fG! — Tue, 18 May 2010 23:09:18 +0000

1) Install gdbinit by copying it to your home dir as “.gdbinit”. It will give you a softice look, for example, disassembly output and registers info. Without it you must script yourself or do it by hand.
2) I not sure about this but I think you have the otx command line tool in the otx install package. If not, download otx source and compile it. It will compile the command line version for you.
3) Yes, Snow Leopard is 64bits and defaults to it if binary has it available. You should use the 32bits version since it’s easier for you to follow the tutorials and the code.

Comment on A little disassembler for MPress packer… by fG!

fG! — Tue, 18 May 2010 23:05:22 +0000

I gave a quick check yesterday and it seems to work without any problems in my Snow Leopard 10.6.3.
I will do a complete test with a new binary this weekend and I will tell you about my results. You got me curious on this one!

Comment on Gdbinit v7.3 by hawke

hawke — Tue, 18 May 2010 11:27:56 +0000

MSJ ’09 Challenge, CorruptFire.

Comment on Gdbinit v7.3 by fredo

fredo — Tue, 18 May 2010 01:13:28 +0000

hawkesays thanks for the crackme file, i hope it means new tutorials by fG!

may i also use this section to ask two questions?

1) what do i do with the gdbinit file that seems to be popular amongst the folks here? is it useful? what does it do? How is it applied?

2) what is the equivalent command line command for otx that can produces the same output as when done through otx itself, when i do “otool -vt …” the output is not as clean and readable as when done though otx , reason why i need it is because sometimes otx doesn’t recognize the programs i write in c saying “No mach-o file” even for something as simple as the “Hello world” in fG! tutorial, but command line otool has no problems with it.

3) The reason to why the hexadecimal values i see on my machine have extra zeros is because i’m using a 64bit machine (snow leopard) where as the tutorials were written on 32bit?

ie : fG!’s tutorial outout (shell$ vmmap -allSplitLibs 303 | grep xprogram
__TEXT 00036000-00051000)

compared to my out put(vmmap -allSplitLibs 1860 | grep xprogram
__TEXT 0000000100243000-000000010024c000)

or am i wrong?

Comment on Gdbinit v7.3 by trolleater

trolleater — Mon, 17 May 2010 23:12:45 +0000

just about anything that uses aquatic primes (you can tell usually if it accepts a license file) is weak to crack despite the level of security put into the framework

Comment on A little disassembler for MPress packer… by fG!

fG! — Mon, 17 May 2010 21:49:41 +0000

Yes I went and checked mpress and it’s still the same version… I will test it out in my system and see if the same thing is happening.
Could be something that changed in Snow Leopard that’s killing it.

Comment on Gdbinit v7.3 by fG!

fG! — Mon, 17 May 2010 21:48:42 +0000

Thanks !!! Do you know where I can find more ?

Comment on Gdbinit v7.3 by hawke

hawke — Fri, 14 May 2010 18:35:56 +0000

Want krackmes? Got some.
http://www.mediafire.com/?zwfrtmmgtkm

Comment on Gdbinit v7.3 by roboguy

roboguy — Fri, 14 May 2010 17:10:08 +0000

great blog dude!,

loving gdbinit.

Comment on A little disassembler for MPress packer… by navaja

navaja — Fri, 14 May 2010 16:42:12 +0000

The mpress version hasn’t changed (v1.21). The target was mpress. However I get the same error with other targets.

Comment on Gdbinit v7.3 by fredo

fredo — Fri, 14 May 2010 13:12:02 +0000

Thank you for replying fG!

I can’t wait to see a new tutorial written by you. Maybe a tutorial based on some new app of fair size that allows for teaching of varying techniques in RE would be a dream for someone like me who’s keen on learning but am struggling to find resources, It can’t come soon enough, mean time its back to SlidePad tutorial for me.

Comment on Gdbinit v7.3 by fG!

fG! — Fri, 14 May 2010 08:15:21 +0000

Hello,
There are some crackmes around and I might give a try at creating some tutorials for them.
The problem today with OS X is the lack of crackmes.
fG!

Comment on Gdbinit v7.3 by fredo

fredo — Fri, 14 May 2010 07:07:06 +0000

hi fG!
I don’t know how else to talk to you hence why i’m writing here, i hope you read it.

I’m desperate to learn RE on macOSX and find your way of showing how its done by tutorials excellent. Following your SlidePad tutorial i learnt a fair bit but i don’t think my skill are up to scratch and i am desperate for more tutorial or a resource you can direct me to to learn more. I know there are “Crackme” tutorials out there but they’re mostly very old (not even intel mac) and i could hardly apply the skills on snowLeopard.

My intention isn’t to become a cracker , i just find RE exciting . To me you’re like a god in mac RE field ,Please show me where i can learn more , something like your slidepad tutorials where everything is up-to-date and explanations on what to do with gdb , otool and class-dump are clear instead of assumed knowledge.

Comment on A little disassembler for MPress packer… by fG!

fG! — Thu, 13 May 2010 23:49:08 +0000

Hello,

I have never seen that error. Either something was changed with Snow Leopard 10.6.3 or MPress has a new version.
Can you tell me what is the target so I can give it a look?

Thx!
fG!

Comment on A little disassembler for MPress packer… by navaja

navaja — Thu, 13 May 2010 22:09:39 +0000

Hi. I was going through your “Dumping MPress packed binaries” article.

Towards the end I get an error when trying to use vmmap…

[QUOTE:]
That jump at 0xa09a is very suspicious…If you follow it you will land at this address 0x8fe01010 (might be different for you).
Using again vmmap to understand to what corresponds this address we get:
(…)
__TEXT 8fe00000-8fe2e000 [ 184K/ 184K] r-x/rwx SM=COW /usr/lib/dyld
(…)
[/QUOTE]

Instead of finding out the region that address corresponds to, I get the following error:

[QUOTE]
Terminating app due to uncaught exception ‘VMUDyld fatal error’, reason: ‘Attempt to get _dyld_all_image_infos failed’
[/QUOTE]

Do you have any idea what going on? Do you see this error msg often when using vmmap?

I am using Mac OS X 10.6.3.

Comment on Gdbinit v7.3 by fry

fry — Thu, 13 May 2010 13:18:56 +0000

Cheers…
looking forward to it…
thanks

Comment on reverse.put.as is back in a new format… by dvdhacker

dvdhacker — Wed, 12 May 2010 20:52:40 +0000

I recently posted on the macosxhints forums about some reverse engineering I did on the OS X DVD Player.app — perhaps you might be interested:

http://forums.macosxhints.com/showthread.php?t=111399

Comment on Gdbinit v7.3 by fG!

fG! — Wed, 12 May 2010 17:04:02 +0000

You can’t compile it since it needs modifications to the code to work on Snow Leopard.
I will try to get it published asap hehehe

Comment on Gdbinit v7.3 by fry

fry — Wed, 12 May 2010 10:07:33 +0000

“Onyx The Black Cat”—PLS…

i tried to compile it myself…nogood…
hope u get time publish it soon…

cheers

Comment on Gdbinit v7.3 by fG!

fG! — Thu, 06 May 2010 23:53:51 +0000

I already have, need to find some time to publish it.

Comment on Gdbinit v7.3 by ®everSe

®everSe — Thu, 06 May 2010 18:33:56 +0000

Thanks for the update i was really needing this!
ould you please also update Onyx The Black Cat to work with Snow Leo? Thanks!

Comment on reverse.put.as is back in a new format… by i0rek

i0rek — Tue, 04 May 2010 19:30:11 +0000

Hello fG!,

i’m really happy that you are back. I totally agree with you and it sounds funny, but what you proposed for the new direction of this blog is in my mind since a year or so. I planned to develop some utilities for protecting osx-applications, just to make it more difficult to reverse an app. I would love to share my experience, although i don’t have enough time at the moment. But when nothing cropped up, i can start in a month.

Drop me a line, if you want.

i0rek

Comment on Tools by Neo

Neo — Sun, 18 Apr 2010 23:21:30 +0000

Hi friend,

Thanks a lot for sharing! This is the spirit!

This is the perfect place for a beginner like myself.

Please, keep the excellent work.

Neo

Comment on Gdbinit v7.3 by Admirer

Admirer — Sat, 17 Apr 2010 00:59:46 +0000

Welcome back… good to see you posting again

Comment on reverse.put.as is back in a new format… by ulf.e

ulf.e — Mon, 12 Apr 2010 18:39:28 +0000

That would be really nice… I enjoyed your blog.

Comment on reverse.put.as is back in a new format… by fG!

fG! — Fri, 09 Apr 2010 21:58:25 +0000

My original idea for the return was a private site by invitation and each member would have to contribute with something to enter it.
It can be done if enough interested people show up.

Comment on reverse.put.as is back in a new format… by Hjalti Jakobsson

Hjalti Jakobsson — Fri, 09 Apr 2010 20:00:46 +0000

Hi.

I didn’t find your email address so I’m dropping a comment instead. I’ve been doing plenty of reverse engineering myself, both to make my own app “more secure” and also to take advantage of stuff that you aren’t necessarily meant to tinker with.

I really enjoy(id) your blog and think it’s something that can also help developers. I’m sorry that other people have used your material in a wrong way and wish that there was a community where people could exchange ideas without of misusing them.

Thanks.
- H

Comment on Gdb patches by fG!

fG! — Thu, 28 Jan 2010 18:13:26 +0000

Nope. You have to patch and recompile.

Comment on Gdb patches by NeoBetas

NeoBetas — Mon, 25 Jan 2010 08:44:56 +0000

Is there anyways to modified .gdb_init to show the raw bytes instead patching and recompiling?

Comment on A new util to process Mach-O binaries information (or a replacement to otool -l) by Antonin Hildebrand

Antonin Hildebrand — Tue, 05 Jan 2010 04:47:38 +0000

Looks promising, will give it a shot next time instead of otool. Thanks for sharing!

I had lot fun reverse engineering Finder.app recently: http://totalfinder.binaryage.com

Comment on A new util to process Mach-O binaries information (or a replacement to otool -l) by Gabor Szabo

Gabor Szabo — Tue, 05 Jan 2010 03:52:50 +0000

If you would like to add a GUI and an editor to this you might take a look at Padre, the Perl IDE. It is a GUI based editor for Perl written in Perl. It works under all 3 major OSes though admittedly our weakest point is Mac. You could try to build on it and integrate your script with Padre via its plugin system. Come by the #padre IRC channel on irc.perl.org and someone will help you get started.

Comment on Mac OS X Kernel debugging with VMware by Mac OS X as VMware Fusion guest OS

Mac OS X as VMware Fusion guest OS — Sat, 12 Dec 2009 03:45:19 +0000

[...] very convenient to use virtual machines for debugging because of snapshots. I found the post about Mac OS X kernel debugging with VMware in Google very quickly. Unfortunately, there are a few words about Mac OS X installation process in [...]

Comment on Small gdbinit update… by fG!

fG! — Mon, 30 Nov 2009 04:22:44 +0000

HEHEHEHEH !!!

I have to find a way to update the gdbinit for x86_64 without creating two different versions. Need to explore that and see if it’s possible since I plan to move to Snow Leopard soon !

Have fun !

Comment on Small gdbinit update… by Runa Takashi

Runa Takashi — Sun, 29 Nov 2009 18:43:45 +0000

Nevermind my stupidity!

Forgot to use lipo to extract out the x86_64 / i386.. gdb tried to run the x86_64 hence all the void in eax, ebx..

Comment on Small gdbinit update… by Runa Takashi

Runa Takashi — Sun, 29 Nov 2009 03:22:49 +0000

Hey, thanks for the great gdbinit file! It looks real nice.. unfortunately, I have a problem that’s stopping me from using context (and stopping hook-stop from executing context) – I attach here the output I get:

————————————————————————–[regs]
EAX:Error while running hook_stop:
Value can’t be converted to integer.

(if running context alone, only “Value..” shows)

I’ve tried using it with the original gdb, with your binary gdb and with my compiled (+patched) gdb via darwinbuild.. no avail.

Can you shed some light?

Comment on Snow Leopard Impact into reverse engineering world… by carbon

carbon — Fri, 30 Oct 2009 12:36:13 +0000

Thanks for the update – was wondering about OTX and x86_64 binaries.

Comment on Gdb patches by fG!

fG! — Fri, 23 Oct 2009 21:54:26 +0000

The patches work for Snow Leopard without a problem. Someone already left all the required steps to compile it for Snow Leopard

Comment on Gdb patches by Dave

Dave — Fri, 23 Oct 2009 15:19:08 +0000

Also what about patches for Snow Leopard / 64-bit?

Comment on Gdb patches by Dave

Dave — Fri, 23 Oct 2009 15:18:19 +0000

Did you file a radar about this? It’s possible that Apple would fix these bugs.

Comment on Small gdbinit update… by fG!

fG! — Wed, 21 Oct 2009 14:11:20 +0000

Excellent work ! Thanks for the feedback

Comment on Small gdbinit update… by SF666

SF666 — Wed, 21 Oct 2009 10:24:00 +0000

Hi,

you’re right! Thank you very much.

I followed your instructions (Jan 2009) to compile gdb with darwinbuild. I had to make minor modifications for SnowLeopard. To all whom it may concern:

1.) Build-Target for SnowLeopard 10.6.1 is “10B504″, so change all references from “Build9G55″ to “10B504″

# mkdir Build10B504 (this is for Leopard 10.6.1)
# cd Build10B504
# darwinbuild -init 10B504

2) The “environment-section”

- changed UNAME_RELEASE to “UNAME_RELEASE = 10.0″
- changed RC_RELEASE to “RC_RELEASE = SnowLeopard”
- changed MACOSX_DEPLOYMENT_TARGET to “MACOSX_DEPLOYMENT_TARGET = 10.6″

3) Patching the sources

Following the tutorial, now it’s time to build gdb

# darwinbuild -nochroot gdb

You get an unpatched gdb. All sources are now expanded.

* Patch sources located at /Volumes/Builds/Build10B504/BuildRoot/SourceCache/gdb/gdb-1344

# cd /Volumes/Builds/Build10B504/BuildRoot/SourceCache/gdb/gdb-1344
# patch -p2 < patchfile

* create source-archive /Volumes/Builds/Build10B504/Sources/gdb-1344.tar.gz

# cd /Volumes/Builds/Build10B504/BuildRoot/SourceCache/gdb
# tar cfz /Volumes/Builds/Build10B504/Sources/gdb-1344.tar.gz gdb-1344/*

By executing

# darwinbuild -nochroot gdb

you get a patched gdb. Copy this file as described.

SF666

Comment on Small gdbinit update… by fG!

fG! — Mon, 19 Oct 2009 21:41:09 +0000

Hello,

You should be able to patch without any problems. For what I saw there were no updates on that version, Apple just increased the build number.
Just try to apply the patches and compile it with the method that is in a past article.
I still haven’t upgraded to Snow Leopard so I can’t yet compile a version for it.

fG!

Comment on Small gdbinit update… by SF666

SF666 — Mon, 19 Oct 2009 12:17:36 +0000

Hi there,

thx for the cool ‘n interesting stuff … I have snow leopard running and would like to benefit from your gdb/gdbinit patches because i like your “softice” like contex view. However on snow leoprad your compiled binary isn’t working. gdb on 10.6.1 seems to be gdb-1344. Is here any possibility to “port” the patches to this version?

Greets,

SF666

Comment on Gdb patches by x_O

x_O — Tue, 15 Sep 2009 23:13:39 +0000

Nope. That was it. It’s all working now. Thanks fG!

Comment on Gdb patches by fG!

fG! — Tue, 15 Sep 2009 23:09:57 +0000

$ ls -la /usr/libexec/gdb/gdb-i386-apple-darwin
-rwxr-sr-x 1 root procmod 3051328 Aug 26 23:31 /usr/libexec/gdb/gdb-i386-apple-darwin

Do you have the s bit set and group procmod ?

Comment on Gdb patches by x_O

x_O — Tue, 15 Sep 2009 23:04:21 +0000

I backed up the original gdb-i386-apple-darwin to gdb-i386-apple-darwin.orig and copied your patched version to /usr/libexec/gdb/. I load a file in GDB using exec-file and upon executing the “run” command, I too receive the error: “Unable to find Mach task port for process-id 70506: (os/kern) failure (0×5).” The only way I’ve found to get rid of the error is to issue “sudo gdb” instead of just “gdb”. Is there a way to I could run GDB without having to issue the sudo command (to circumvent that error)? I’m running as an Admin account and the file permissions on gdb-i386-apple-darwin (patched version) are the same as the original I backed up.

Comment on Gdb patches by fG!

fG! — Thu, 10 Sep 2009 11:14:33 +0000

Ahhhhhhhhhhhhhhhhh ! That explains… I tried to understand if you had copied it or not. I assumed you did because you tried to change permissions (which now seems like a rather lame assumption since I should have remembered that copy preserves permissions hehehe).

You have to copy the binary because gdb command in reality is a script at /usr/bin/gdb. It does some magic due to different architectures

Comment on Gdb patches by wishi

wishi — Thu, 10 Sep 2009 08:58:29 +0000

I missed something… I didn’t copy the binary to /usr/libexec/gdb/ but just called it directly.
- Debugging as root was/is possible without problems: task_for_pid() by default is only accessible by root (or procmod) (http://developer.apple.com/legacy/mac/library/documentation/MacOSX/Conceptual/universal_binary/universal_binary_tips/universal_binary_tips.html).

However I wonder why the binary has to be in a specific path… Anyhow.

Sorry But I learned something.

Comment on Gdb patches by fG!

fG! — Wed, 09 Sep 2009 22:28:04 +0000

I had some free time but I can’t reproduce the bug… I tested with a clean vmware snapshot and replaced original gdb binary with this one and it works… Tried to attach to a running program and it was fine. Tried to run a new program and it was fine… Hummm something is missing ! My Xcode version is 3.1.

Any ideas ? Must find some more free time to try to reproduce this hehehe

Comment on Gdbinit 7.1.7 and some bla bla bla… by rev

rev — Tue, 08 Sep 2009 13:51:58 +0000

There is a bug in gdbinit 7.1.7:
Defination for jump/not jump for JLE is not correct.

To reproduct the bug:
1. download Layers 1.1.4:
http://www.megaupload.com/?d=MD29L66I
2. set breakpoint to 2 different JLE locations:
$ b *0xbc78
$ b *0x7fcb
$ r

Result:
0000bc78 7e5f jle 0x0000bcd9 > gdb shows “Jump is taken”. It jump indeed.
00007fcb 7e5f jle 0x0000802c > gdb shows “Jump is NOT taken”. But It still jumps

Fix:
Search for ## JLE or JNG:
if ((($_zf_flag == 1) && ($_sf_flag == $_of_flag))
Relace with:
if ((($_zf_flag == 1) && ($_sf_flag == $_of_flag)) || (($_sf_flag == 1) && ($_zf_flag == $_of_flag)))

Comment on Gdb patches by anonym

anonym — Sun, 06 Sep 2009 23:31:41 +0000

I got the same err on test using your binary:
“Unable to find Mach task port for process-id 70506: (os/kern) failure (0×5).”
whatever i will use your patch and compile it later…

You have a very nice and informative blog!
i know you from the windows world for over 5 years ago.
i am a still reader, but i come twice time almost every day here.
please add the link to wishi’s blog in your “Links” collection. (very nice blog too, wishi!)

Thank you and keep update!

Comment on Gdb patches by wishi

wishi — Sun, 06 Sep 2009 09:26:50 +0000

I guess I compile that stuff… because for testing reasons I used your binary. Debugging a Debugger: sounds like fun!

Comment on Gdb patches by fG!

fG! — Sat, 05 Sep 2009 20:57:22 +0000

Hello,

Thank you for the compliment Are you using the binary I provided or compiled it yourself (knowing your blog I would bet on this hehehe) ? I had that same error when I compiled gdb from Apple package out of the source. To compile correctly you need to refer to this process http://reverse.put.as/2009/01/14/how-to-compile-gdb-and-other-apple-open-source-packages-in-mac-os-x/ . You have to use darwinbuild. If you I can upload my image with my building environment.

Keep up the good work with your blog

fG!

Comment on Gdb patches by wishi

wishi — Sat, 05 Sep 2009 10:35:53 +0000

You’ve got a very interesting blog. Especially optimizing the Apple Dev Tools to be more reversing friendly is a kewl project. However I gave this a try and it doesn’t work:

gdb$ r
Unable to find Mach task port for process-id 70506: (os/kern) failure (0×5).
gdb$ quit

Even if:

wishi@dawn ~/patched
% sudo chgrp procmod gdb-i386-apple-darwin

wishi@dawn ~/patched
% sudo chmod 2755 gdb-i386-apple-darwin

You don’t get it working. Maybe I miss something crucial?

Comment on Reversing Pokerstars online poker client (I hope they aren’t from Vegas !!!) by Cody Brocious (Daeken)

Cody Brocious (Daeken) — Sat, 22 Aug 2009 15:00:38 +0000

Ah hah! I was looking at the files in a hex editor a few days ago and knew it had to be a simple XOR, but I didn’t bother to figure out the key. Thanks for reading the article and contributing that

Comment on Gdbinit 7.1.7 and some bla bla bla… by iorek

iorek — Thu, 20 Aug 2009 17:01:04 +0000

sorry for the late answer, i didn’t noticed your comment.

app: Opacity: http://likethought.com/opacity/
Breakpoint 1, 0x00041ac5 in PCDrawAllLayerInContext ()

no change, when stack is disabled:

gdb$ context
Invalid type combination in equality test.
gdb$ disablestack
gdb$ context
Invalid type combination in equality test.

hope that helps.

Comment on Anatomy of a gdb anti-debug trick by who cares

who cares — Mon, 17 Aug 2009 23:15:45 +0000

great gdb season!
great site!
thx for sharing your knowledge, much appreciated here!

Comment on Tools by alex

alex — Thu, 13 Aug 2009 20:46:34 +0000

Hello,
This is Alex from Seattle. I just want to thank you so much for investing your time and energy into this website. It’s got an abundance of *reversing* knowledge for a relative novice such as myself, in addition to many advanced techniques as well.
It’s absolutely awesome!
Keep up the great work,

Cheers,
Alex

Comment on Fix for Apple’s GDB bug or why Apple forks are bad… by beowulf

beowulf — Thu, 13 Aug 2009 09:24:49 +0000

Thanks man, you really rock! Yes, that code is a mess… Anyway, I did this yesterday and seems to work like a charm! Let’s hope Apple will apply this, sooner or later…
Regards.

Comment on Gdbinit 7.1.7 and some bla bla bla… by fG!

fG! — Mon, 10 Aug 2009 10:37:38 +0000

Hello,

Could you please tell me how to reproduce that ? Which program and at what breakpoint ? I see you have the stack window activated. Does the same happens if you remove it ?

Thanks,
fG!

Comment on Gdbinit 7.1.7 and some bla bla bla… by iorek

iorek — Sat, 08 Aug 2009 06:30:04 +0000

hi fg,
there is one drawback for me with the new gdbinit, perhaps you can fix that. in the previous version, i often see:
gdb$ context
————————————————————————–[regs]
EAX: 003821C0 EBX: 0000001E ECX: 003821C0 EDX: 001E0007 o d I t s z a P c
ESI: 000000BE EDI: 0038222C EBP: BFFFDD98 ESP: BFFFDD60 EIP: 00042FE7
CS: 0017 DS: 001F ES: 001F FS: 0000 GS: 0037 SS: 001F Jump is NOT taken (z flag)
[001F:BFFFDD60]———————————————————-[stack]
Invalid type combination in ordering comparison.

but now only this

gdb$ context
Invalid type combination in ordering comparison.

shows up. thats the reason, why i downgraded.

thanks

Comment on Gdbinit 7.1.7 and some bla bla bla… by TheTuKays

TheTuKays — Thu, 06 Aug 2009 10:07:34 +0000

grand, thx a lot!!

Comment on Gdbinit 7.1.7 and some bla bla bla… by fG!

fG! — Thu, 06 Aug 2009 09:38:44 +0000

Yes. Have a look at this post http://reverse.put.as/2007/10/18/gdb-input-radix-option/

You need to change the input-radix setting

Comment on Gdbinit 7.1.7 and some bla bla bla… by fG!

fG! — Thu, 06 Aug 2009 09:36:40 +0000

Hello,

It’s not a trick but a bug ! The only solution is to find the fix in the original gnu version. It might be a bit complicated to track down
The “file” command loads the symbols but it reproduces the bug.

Well it seems you are lucky… While writing this I found a workaround for the problem. You can use “gdb program_to_analyse” or the “file” command inside the gdb. After gdb starts, you need to issue the command “source ~/.gdbinit”. And that’s it… That will workaround and make it usable Weeeeeeeee

fG!

Comment on Gdbinit 7.1.7 and some bla bla bla… by Anthony

Anthony — Thu, 06 Aug 2009 08:34:53 +0000

Hello man,
You’re job is awesome but I’ve a question on the starting of gdb with this gdbinit…
It requires to start gdb like this : “gdb” and after make a “exec-file $EXEC_FILE” but doesn’t work with “gdb $EXEC_FILE”.
You already say it before…. but have you a solution to bypass this “trick” ?
Because when I do that, my $EXEC-FILE doesn’t has it symbols analyzed…

thanks

Comment on Gdbinit 7.1.7 and some bla bla bla… by TheTuKays

TheTuKays — Thu, 06 Aug 2009 07:33:24 +0000

i’ve noticed that when gdbinit is loaded, all numbers are output as hex. Is there a way to turn that off or to tell gdb to print decimal numbers? i sometimes use gdb for some quick calculations and thinking hex is not the most intuitive

Comment on Gdbinit v7.1.6 by fG!

fG! — Thu, 30 Jul 2009 10:00:28 +0000

Hi !

Thanks for the reminder ! I knew it wasn’t working anymore and it was in my todo list ! I will give it a try and understand why it’s not working… /bin/echo does exist. Something with Leopard changed things

bye!