<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Reverse Engineering Mac OS X</title>
	<atom:link href="http://reverse.put.as/feed/" rel="self" type="application/rss+xml" />
	<link>http://reverse.put.as</link>
	<description>Reverse Engineering Mac OS X for fun and NO profit</description>
	<lastBuildDate>Tue, 27 Jul 2010 21:01:51 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0</generator>
		<item>
		<title>Very small update&#8230;</title>
		<link>http://reverse.put.as/2010/06/08/very-small-update/</link>
		<comments>http://reverse.put.as/2010/06/08/very-small-update/#comments</comments>
		<pubDate>Mon, 07 Jun 2010 23:14:02 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=652</guid>
		<description><![CDATA[Hi! I just updated the crackmes with #5 from MSJ challenge and added a new tool for encrypting/decrypting apple encrypted binaries. I had planned to do this tool but it&#8217;s great that someone did it first! It&#8217;s good to see people developing tools for OS X, even if they are very simple. Thank you to [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/06/08/very-small-update/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Onyx the Black Cat v0.4 for Snow Leopard</title>
		<link>http://reverse.put.as/2010/05/24/onyx-the-black-cat-v0-4-for-snow-leopard/</link>
		<comments>http://reverse.put.as/2010/05/24/onyx-the-black-cat-v0-4-for-snow-leopard/#comments</comments>
		<pubDate>Sun, 23 May 2010 23:23:36 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=643</guid>
		<description><![CDATA[I had this one working for a long time but I hadn&#8217;t released it because I was trying to hijack fork and vfork calls. My objective was to introduce an int3 so I could attach the debugger to a selected process. At that time I suspected that VLOK was forking and I couldn&#8217;t debug the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/05/24/onyx-the-black-cat-v0-4-for-snow-leopard/feed/</wfw:commentRss>
		<slash:comments>16</slash:comments>
		</item>
		<item>
		<title>OS X Crackmes</title>
		<link>http://reverse.put.as/2010/05/21/os-x-crackmes/</link>
		<comments>http://reverse.put.as/2010/05/21/os-x-crackmes/#comments</comments>
		<pubDate>Thu, 20 May 2010 23:55:07 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=637</guid>
		<description><![CDATA[Hello, I have just added a page to collect crackmes for OS X. I have added the ones that I already had and some recommended from user comments. Since corruptfire.com seems down I cannot retrieve the other ones they had. If you have more crackmes please mail them to me so I can add them [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/05/21/os-x-crackmes/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Gdbinit v7.3</title>
		<link>http://reverse.put.as/2010/04/16/gdbinit-v7-3/</link>
		<comments>http://reverse.put.as/2010/04/16/gdbinit-v7-3/#comments</comments>
		<pubDate>Fri, 16 Apr 2010 10:28:36 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=615</guid>
		<description><![CDATA[I was bored and decided to fix gdbinit to support 64bits binaries. I had tried it before but the solution was a piece of crap (not that this one is much better). I was testing the registers to see if the binary was 32 or 64bits. Now there is a default setting to 32bits (change [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/04/16/gdbinit-v7-3/feed/</wfw:commentRss>
		<slash:comments>20</slash:comments>
		</item>
		<item>
		<title>reverse.put.as is back in a new format&#8230;</title>
		<link>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/</link>
		<comments>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/#comments</comments>
		<pubDate>Fri, 09 Apr 2010 18:34:25 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=571</guid>
		<description><![CDATA[I have been thinking about this and how to get this blog back to life. My free time has been almost zero but I miss the motivation to put my brain to tinker and create new things to publish, because reversing and everything around it sometimes is a great relaxing activity for me. The last [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/04/09/reverse-put-as-is-back-in-a-new-format/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>A new util to process Mach-O binaries information (or a replacement to otool -l)</title>
		<link>http://reverse.put.as/2010/01/05/a-new-util-to-process-mach-o-binaries-information-or-a-replacement-to-otool-l/</link>
		<comments>http://reverse.put.as/2010/01/05/a-new-util-to-process-mach-o-binaries-information-or-a-replacement-to-otool-l/#comments</comments>
		<pubDate>Tue, 05 Jan 2010 02:15:22 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=474</guid>
		<description><![CDATA[For a long time I have been annoyed by the information displayed by otool -l because it mixes hexadecimal with decimal information. For example, offsets are displayed in decimal and relative to the cpu architecture in the fat binary. So I had to convert and calculate things by hand everytime I wanted to peek or [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2010/01/05/a-new-util-to-process-mach-o-binaries-information-or-a-replacement-to-otool-l/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Happy new year and a small christmas gift!</title>
		<link>http://reverse.put.as/2009/12/26/happy-new-year-and-a-small-christmas-gift/</link>
		<comments>http://reverse.put.as/2009/12/26/happy-new-year-and-a-small-christmas-gift/#comments</comments>
		<pubDate>Sat, 26 Dec 2009 01:45:19 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=469</guid>
		<description><![CDATA[November was a pretty busy month with exams and assignments to be delivered. I have been having a lot of fun with the MBA since analysing financial statements is some kind of reverse engineering and I missed Economics stuff (I do have a undergraduate degree in Economics). I really like to go outside the box [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/12/26/happy-new-year-and-a-small-christmas-gift/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Snow Leopard Impact into reverse engineering world&#8230;</title>
		<link>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/</link>
		<comments>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/#comments</comments>
		<pubDate>Wed, 28 Oct 2009 23:04:26 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=461</guid>
		<description><![CDATA[Some folks were complaining about problems with OTX and Snow Leopard so I decided to boot my Snow Leopard install and give it a try&#8230; Well they were right since Snow Leopard compiles 64 bit binaries by default. OTX v0.16b seems to have problems so you will need to download from the SVN and compile [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/10/29/snow-leopard-impact-into-reverse-engineering-world/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Small gdbinit update&#8230;</title>
		<link>http://reverse.put.as/2009/10/11/small-gdbinit-update/</link>
		<comments>http://reverse.put.as/2009/10/11/small-gdbinit-update/#comments</comments>
		<pubDate>Sun, 11 Oct 2009 19:06:48 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=455</guid>
		<description><![CDATA[Things have been very quiet since the beginning of September&#8230; Well my MBA has started and my free time until now has been ZERO ! It has been a fun but very busy ride and comeback to the world of economics. The first weeks are recruit like, pretty intensive with many assignments to be delivered. [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/10/11/small-gdbinit-update/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Gdb patches</title>
		<link>http://reverse.put.as/2009/08/26/gdb-patches/</link>
		<comments>http://reverse.put.as/2009/08/26/gdb-patches/#comments</comments>
		<pubDate>Wed, 26 Aug 2009 15:16:54 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=442</guid>
		<description><![CDATA[Here you have the patches I did for gdb: To fix problem with gdbinit To display raw bytes in x/i and disassemble commands To warn about possible number of sections anti-debug trick You can download a single patch for all changes or one for each individual change. A patched gdb binary for Intel only is [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/26/gdb-patches/feed/</wfw:commentRss>
		<slash:comments>15</slash:comments>
		</item>
		<item>
		<title>Anatomy of a gdb anti-debug trick part II: GDB isn&#8217;t alone !</title>
		<link>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/</link>
		<comments>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/#comments</comments>
		<pubDate>Wed, 26 Aug 2009 00:20:41 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=419</guid>
		<description><![CDATA[After having found the source of the gdb anti-debug trick, I started modifying gdb to work around the problem and fix the number of sections on the fly (it&#8217;s damn simple to calculate the real number of sections !!!). I was coding on a long train trip and everything was going great&#8230; My hack worked [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/26/anatomy-of-a-gdb-anti-debug-trick-part-ii-gdb-isnt-alone/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Reversing Pokerstars online poker client (I hope they aren&#8217;t from Vegas !!!)</title>
		<link>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/</link>
		<comments>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/#comments</comments>
		<pubDate>Thu, 20 Aug 2009 15:47:35 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=410</guid>
		<description><![CDATA[Today I bring you something from the old projects trunk ! Like many other millions of people I enjoy playing online Texas Hold&#8217;em. I started with Pokerstars three years ago, and after a while, diabolical ideas came to my head about reversing the client to have a peek into their communication protocol (what else were [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/20/reversing-pokerstars-online-poker-client-i-hope-they-arent-from-vegas/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Anatomy of a gdb anti-debug trick</title>
		<link>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/</link>
		<comments>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/#comments</comments>
		<pubDate>Thu, 13 Aug 2009 16:38:52 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=391</guid>
		<description><![CDATA[Well, it seems this is the GDB post season ! The past days have been dedicated to mess around with gdb source code and today I have what I think it&#8217;s a nice story to tell. After hacking off my old wish of having the disassembly raw bytes to be printed (like Ollydbg, Softice, IDA, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/13/anatomy-of-a-gdb-anti-debug-trick/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Fix for Apple&#8217;s GDB bug or why Apple forks are bad&#8230;</title>
		<link>http://reverse.put.as/2009/08/10/fix-for-apples-gdb-bug-or-why-apple-forks-are-bad/</link>
		<comments>http://reverse.put.as/2009/08/10/fix-for-apples-gdb-bug-or-why-apple-forks-are-bad/#comments</comments>
		<pubDate>Mon, 10 Aug 2009 16:19:29 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=378</guid>
		<description><![CDATA[It&#8217;s not a breakthrough post but I finally found where the bug that messed up gdbinit is located. I got obsessed into this problem and started browsing gdb source code. I knew that the problem ocurred when the &#8220;file&#8221; or &#8220;add-symbol&#8221; commands were used. The difference from &#8220;file&#8221; to &#8220;exec-file&#8221; is that symbols are loaded [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/10/fix-for-apples-gdb-bug-or-why-apple-forks-are-bad/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Workaround for Apple&#8217;s GDB bug&#8230;</title>
		<link>http://reverse.put.as/2009/08/06/workaround-for-apples-gdb-bug/</link>
		<comments>http://reverse.put.as/2009/08/06/workaround-for-apples-gdb-bug/#comments</comments>
		<pubDate>Thu, 06 Aug 2009 09:56:38 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=373</guid>
		<description><![CDATA[I had unconsciously found the workaround a few months ago while hacking around Little Snitch with kernel debugging. To make things easier I had a small gdb script to call the debug kit macros and set all the variables that are the source of the problem with gdbinit. This was something I never thought about, [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/06/workaround-for-apples-gdb-bug/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Gdbinit 7.1.7 and some bla bla bla&#8230;</title>
		<link>http://reverse.put.as/2009/08/05/gdbinit-7-1-7-and-some-bla-bla-bla/</link>
		<comments>http://reverse.put.as/2009/08/05/gdbinit-7-1-7-and-some-bla-bla-bla/#comments</comments>
		<pubDate>Wed, 05 Aug 2009 19:51:19 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=368</guid>
		<description><![CDATA[Greetings ! For the past weeks I have been pretty much bored with any kind of reversing so all my projects are stopped. Today I decided to fix some bugs at gdbinit and the result is version 7.1.7. The assemble command is finally fixed, added some semi useful commands and changed some colours. Nothing big [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/08/05/gdbinit-7-1-7-and-some-bla-bla-bla/feed/</wfw:commentRss>
		<slash:comments>9</slash:comments>
		</item>
		<item>
		<title>A little disassembler for MPress packer&#8230;</title>
		<link>http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/</link>
		<comments>http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/#comments</comments>
		<pubDate>Thu, 23 Jul 2009 10:49:57 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=360</guid>
		<description><![CDATA[Since otool and otx can&#8217;t disassemble the packed binary, Andreas Gumundsson wrote a quick tool to do that job, using Udis86, a disassembler library for x86 and AMD64. Check the source to see the required compiler options. Example usage: $ ./disas -f mmpress.i386 -t macho &#124; head -10 Found entrypoint inmemory address 0xd6b0 NCMDS 2 [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>How to dump a MPress packed binary&#8230;</title>
		<link>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/</link>
		<comments>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/#comments</comments>
		<pubDate>Wed, 22 Jul 2009 22:15:21 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=355</guid>
		<description><![CDATA[Someone at macserialjunkie board posted a problem with the mpress packer. Since packers are a pretty rare thing at OS X and I was bored, I decided to give it a quick look. The result is another tutorial about manually unpacking this kind of binary. It&#8217;s not hard and the packer isn&#8217;t that great. Objective-C [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/07/22/how-to-dump-a-mpress-packed-binary/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>A memory dumper for Apple crypted binaries ! Hurray !!!</title>
		<link>http://reverse.put.as/2009/07/08/a-memory-dumper-for-apple-crypted-binaries-hurray/</link>
		<comments>http://reverse.put.as/2009/07/08/a-memory-dumper-for-apple-crypted-binaries-hurray/#comments</comments>
		<pubDate>Wed, 08 Jul 2009 22:34:00 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=341</guid>
		<description><![CDATA[Here it is, another example of my super l33t lame coding skills ! This wonder code will decrypt an Apple crypted binary via memory dumping. Maybe direct decryption (based on Amit Singh code) would be easier and nicer, but I wanted to do it this way as a test and an exercise. The code has [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/07/08/a-memory-dumper-for-apple-crypted-binaries-hurray/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>How to dump an Apple protected binary</title>
		<link>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/</link>
		<comments>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/#comments</comments>
		<pubDate>Mon, 29 Jun 2009 23:04:43 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=330</guid>
		<description><![CDATA[From the department of useless stuff comes a simple trick&#8230; A few days ago, a reader sent me an email asking about obfuscated code, in what appeared to be Apple&#8217;s binary protection. I already knew this Amit Singh article, but never played with it. Since I&#8217;m very curious (I love cats but Onyx still doesn&#8217;t [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Onyx The Black Cat v0.3</title>
		<link>http://reverse.put.as/2009/03/25/onyx-the-black-cat-v03/</link>
		<comments>http://reverse.put.as/2009/03/25/onyx-the-black-cat-v03/#comments</comments>
		<pubDate>Wed, 25 Mar 2009 16:01:17 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=214</guid>
		<description><![CDATA[Version 0.3 is here. A couple small bugs are fixed, module features can be controled via sysctl variables (enable or disable features) and code is split into different source files (it was a mess in a single file!). Tiger support is removed so it&#8217;s ready to work with Leopard 10.5.6. Check the README file for [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/03/25/onyx-the-black-cat-v03/feed/</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>Mach-O binary offset calculator</title>
		<link>http://reverse.put.as/2009/03/13/mach-o-binary-offset-calculator/</link>
		<comments>http://reverse.put.as/2009/03/13/mach-o-binary-offset-calculator/#comments</comments>
		<pubDate>Fri, 13 Mar 2009 12:47:40 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=201</guid>
		<description><![CDATA[I made a mistake in this tutorial ! The way to calculate offsets to patch is wrong because I commited an inference error (analysed only a few binaries and assumed it to be correct). Found this while creating a program to calculate everything automatically. Check the code if you are interested in understanding how it&#8217;s [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/03/13/mach-o-binary-offset-calculator/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Mac OS X Kernel debugging with VMware</title>
		<link>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/</link>
		<comments>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/#comments</comments>
		<pubDate>Thu, 05 Mar 2009 12:19:37 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=178</guid>
		<description><![CDATA[I love VMware (used it since it&#8217;s first releases) and I love it even more now Yesterday I had the not so crazy idea (and not original) to use VMware for Mac OS X kernel debugging because newest Little Snitch version seems to have a new anti-debug trick and I don&#8217;t have another Mac at [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/03/05/mac-os-x-kernel-debugging-with-vmware/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Gdbinit v7.1.6</title>
		<link>http://reverse.put.as/2009/01/21/gdbinit-v716/</link>
		<comments>http://reverse.put.as/2009/01/21/gdbinit-v716/#comments</comments>
		<pubDate>Wed, 21 Jan 2009 00:19:47 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=146</guid>
		<description><![CDATA[While searching the web for some gdb patches I stumbled upon this fix to &#8216;assemble&#8217; function from gdbinit by Tavis Ormandy (good work!). I modified it a little bit to work with Mac OS X. This function allows you to assemble directly (using nasm, Intel format) to running program or just output the correspondent opcodes [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/01/21/gdbinit-v716/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>How to compile GDB and other Apple open source packages in Mac OS X</title>
		<link>http://reverse.put.as/2009/01/14/how-to-compile-gdb-and-other-apple-open-source-packages-in-mac-os-x/</link>
		<comments>http://reverse.put.as/2009/01/14/how-to-compile-gdb-and-other-apple-open-source-packages-in-mac-os-x/#comments</comments>
		<pubDate>Tue, 13 Jan 2009 23:29:05 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=141</guid>
		<description><![CDATA[I wanted to recompile so I can modify it&#8217;s source and add some custom patches to enhance it&#8217;s output&#8230; Easier said than done !!!! There&#8217;s no much information around about this and my first attempt was by downloading gdb source package from Apple and trying to compile it. Didn&#8217;t compiled out of the box so [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/01/14/how-to-compile-gdb-and-other-apple-open-source-packages-in-mac-os-x/feed/</wfw:commentRss>
		<slash:comments>9</slash:comments>
		</item>
		<item>
		<title>Mailing list and IRC channel</title>
		<link>http://reverse.put.as/2009/01/05/mailing-list-and-irc-channel/</link>
		<comments>http://reverse.put.as/2009/01/05/mailing-list-and-irc-channel/#comments</comments>
		<pubDate>Mon, 05 Jan 2009 12:23:08 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=139</guid>
		<description><![CDATA[I forgot to mention this previously but there is a mailing list available at http://0&#215;90.org/mailman/listinfo/xso and an IRC channel at irc.freenode.net, #osxre ! It&#8217;s still a small community but more people are showing up and IRC is always a good communication tool. I&#8217;m not administrator of both, but YOU are invited to join fG!]]></description>
		<wfw:commentRss>http://reverse.put.as/2009/01/05/mailing-list-and-irc-channel/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>More gdbinit addons!</title>
		<link>http://reverse.put.as/2008/12/31/more-gdbinit-addons/</link>
		<comments>http://reverse.put.as/2008/12/31/more-gdbinit-addons/#comments</comments>
		<pubDate>Wed, 31 Dec 2008 15:02:36 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=130</guid>
		<description><![CDATA[End of the year is slow and I was a bit inspired so I decided to hack around another features I was missing from gdbinit ! First one is about conditional jump display. Original gdbinit doesn&#8217;t tell you what will be the decision that will be taken on a conditional jump. You must look at [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/12/31/more-gdbinit-addons/feed/</wfw:commentRss>
		<slash:comments>22</slash:comments>
		</item>
		<item>
		<title>A lazy xmas gift or a lazy addon to gdbinit</title>
		<link>http://reverse.put.as/2008/12/29/a-lazy-xmas-gift-or-a-lazy-addon-to-gdbinit/</link>
		<comments>http://reverse.put.as/2008/12/29/a-lazy-xmas-gift-or-a-lazy-addon-to-gdbinit/#comments</comments>
		<pubDate>Mon, 29 Dec 2008 15:39:00 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=125</guid>
		<description><![CDATA[While I was messing with gdbinit three weeks ago, I added a small feature that displays the messages being sent to objc_msgSend. Usually I follow the otool or IDA dump and see what&#8217;s being sent, but that it&#8217;s not very practical! So I made a dirty hack with gdbinit so that information appears automatically into [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/12/29/a-lazy-xmas-gift-or-a-lazy-addon-to-gdbinit/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Apple&#8217;s GDB Bug ?</title>
		<link>http://reverse.put.as/2008/11/28/apples-gdb-bug/</link>
		<comments>http://reverse.put.as/2008/11/28/apples-gdb-bug/#comments</comments>
		<pubDate>Fri, 28 Nov 2008 11:17:16 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=119</guid>
		<description><![CDATA[I was trying to add some features to gdbinit and I needed global variables. I already knew that feature wasn&#8217;t working on Mac OS X gdb and I was puzzled why it didn&#8217;t work. Some quick tests on a Linux box couldn&#8217;t reproduce the same behaviour so something is wrong with Apple&#8217;s gdb version. I [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/11/28/apples-gdb-bug/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>gdbinit version 7.0 (and 7.1)</title>
		<link>http://reverse.put.as/2008/11/19/gdbinit-version-70/</link>
		<comments>http://reverse.put.as/2008/11/19/gdbinit-version-70/#comments</comments>
		<pubDate>Wed, 19 Nov 2008 17:36:09 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=99</guid>
		<description><![CDATA[There is a new version of original +mammon gdbinit, 7.0 (available at http://truthix.dump.cz/files/.gdbinit). GDB version used by Apple has some problems with it (doesn&#8217;t recognize global variables outside each function) so it needed some fixes to work. I have changed the colors and removed the data window display (personally I don&#8217;t think it&#8217;s useful, edit [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/11/19/gdbinit-version-70/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Onyx The Black Cat v0.2</title>
		<link>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/</link>
		<comments>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/#comments</comments>
		<pubDate>Sun, 16 Nov 2008 18:40:24 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=96</guid>
		<description><![CDATA[Here it is with support for Leopard and extended attributes. All calls related to extended attributes are traced and dumped to /var/log/system.log (I find it more useful than fs_usage for this specific calls). Check the .c file for options related to this. For Leopard support you need to edit the .c file and change the [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/11/16/onyx-the-black-cat-v02/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Onyx The Black Cat v0.1 &#8211; Anti Anti-debug kernel module</title>
		<link>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/</link>
		<comments>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/#comments</comments>
		<pubDate>Thu, 30 Oct 2008 11:56:18 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=70</guid>
		<description><![CDATA[Here it is, my crazy idea to create an anti anti-debug kernel module so reversing efforts get a little easier and faster against &#8220;hostile&#8221; code. This module will protect you against the classic PT_DENY_ATTACH trick and the sysctl debugger detection trick (http://developer.apple.com/qa/qa2004/qa1361.html). For now it&#8217;s only compatible with Mac OS X Tiger v10.4.11. Soon I [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/10/30/onyx-the-black-cat-v01-anti-anti-debug-kernel-module/feed/</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>The IDA Pro Book: The Unofficial Guide to the World&#8217;s Most Popular Disassembler</title>
		<link>http://reverse.put.as/2008/10/17/the-ida-pro-book-the-unofficial-guide-to-the-worlds-most-popular-disassembler/</link>
		<comments>http://reverse.put.as/2008/10/17/the-ida-pro-book-the-unofficial-guide-to-the-worlds-most-popular-disassembler/#comments</comments>
		<pubDate>Fri, 17 Oct 2008 21:53:10 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=68</guid>
		<description><![CDATA[Excellent book ! Recommended if you are into Reverse Engineering and not only specific for IDA. Well written with lots of examples. Really enjoyed it. Well worth the money (and even cheaper if you use Amazon Market Place). I&#8217;m back with huge amounts of work so my reversing efforts are on a halt. Let&#8217;s see [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/10/17/the-ida-pro-book-the-unofficial-guide-to-the-worlds-most-popular-disassembler/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>&#8220;Hacker&#8221; Challenge</title>
		<link>http://reverse.put.as/2008/09/25/hacker-challenge/</link>
		<comments>http://reverse.put.as/2008/09/25/hacker-challenge/#comments</comments>
		<pubDate>Thu, 25 Sep 2008 10:15:40 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=66</guid>
		<description><![CDATA[Hello, If you want to have some fun and maybe improve your security/reversing skills, you might try this site http://www.dareyourmind.net ! It has some nice challenges in different fields (reversing is only for Windows, but hey you must be able to reverse for anything!). Have fun !]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/09/25/hacker-challenge/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>News&#8230;</title>
		<link>http://reverse.put.as/2008/09/08/news/</link>
		<comments>http://reverse.put.as/2008/09/08/news/#comments</comments>
		<pubDate>Mon, 08 Sep 2008 20:01:31 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Papers]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=45</guid>
		<description><![CDATA[A peak of work and vacations results in no reversing for the past weeks I had some advances on Little Snitch and I will publish them soon. Blackhat USA 2008 had some interesting stuff related to Mac OS X. And older paper related to DTrace (I really need to install Leopard to start messing around [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/09/08/news/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Kernel module for syscall interception and fixing ptrace</title>
		<link>http://reverse.put.as/2008/08/06/kernel-module-for-syscall-interception-and-fixing-ptrace/</link>
		<comments>http://reverse.put.as/2008/08/06/kernel-module-for-syscall-interception-and-fixing-ptrace/#comments</comments>
		<pubDate>Wed, 06 Aug 2008 11:13:09 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=22</guid>
		<description><![CDATA[Landon Fuller (http://landonf.bikemonkey.org/code/macosx) created a kernel module to bypass the PTRACE_DENY_ATTACH &#8220;anti-debug&#8221; feature of Mac OS X. For the Tiger version he used a deprecated API, removed on Leopard. For Leopard he re-routes the ptrace syscall to his own version by patching the syscall table. Since the Leopard version is much more interesting because we [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/08/06/kernel-module-for-syscall-interception-and-fixing-ptrace/feed/</wfw:commentRss>
		<slash:comments>11</slash:comments>
		</item>
		<item>
		<title>Mac OS X Code injection</title>
		<link>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/</link>
		<comments>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/#comments</comments>
		<pubDate>Thu, 03 Jul 2008 14:32:29 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Mac Reversing]]></category>

		<guid isPermaLink="false">http://reverse.put.as/?p=17</guid>
		<description><![CDATA[While trying to reverse Little Snitch I needed to understand the concept of Mach Ports (since I suspect it&#8217;s used for communication between the userland programs and the kernel extension) and found some nice articles/code about code injection in Mac OS X. They are: Mach Star (old but interesting): http://rentzsch.com/mach_star/ Mach Inject and Mach Override [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/07/03/mac-os-x-code-injection/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How to change /etc/hosts</title>
		<link>http://reverse.put.as/2008/02/02/how-to-change-etchosts/</link>
		<comments>http://reverse.put.as/2008/02/02/how-to-change-etchosts/#comments</comments>
		<pubDate>Sat, 02 Feb 2008 18:54:07 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/archives/6</guid>
		<description><![CDATA[It&#8217;s useful to change /etc/hosts, specially with protections requesting online keys. After editing /etc/hosts, you need to refresh OS X NetInfo Database. Just run the following command: sudo niload -v -m hosts . &#38;lt; /etc/hosts And then flush cache with: lookupd -flushcache For Snow Leopard the command has changed. It is now: dscacheutil -flushcache And [...]]]></description>
		<wfw:commentRss>http://reverse.put.as/2008/02/02/how-to-change-etchosts/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Change network card mac address</title>
		<link>http://reverse.put.as/2007/12/28/change-network-card-mac-address/</link>
		<comments>http://reverse.put.as/2007/12/28/change-network-card-mac-address/#comments</comments>
		<pubDate>Fri, 28 Dec 2007 20:27:28 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://reverse.put.as/archives/5</guid>
		<description><![CDATA[Since there are programs with serial numbers tied to network card mac address it might be useful to change it. There are some fancy GUI programs for this but it&#8217;s faster from terminal: ifconfig en0 lladdr X:XX:XX:XX:XX:XX And that&#8217;s it&#8230;]]></description>
		<wfw:commentRss>http://reverse.put.as/2007/12/28/change-network-card-mac-address/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Must have tools&#8230;</title>
		<link>http://reverse.put.as/2007/10/10/must-have-tools/</link>
		<comments>http://reverse.put.as/2007/10/10/must-have-tools/#comments</comments>
		<pubDate>Wed, 10 Oct 2007 11:32:57 +0000</pubDate>
		<dc:creator>fG!</dc:creator>
				<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://reverse.put.as/2007/10/10/must-have-tools/</guid>
		<description><![CDATA[A work in progress list&#8230; Otx &#8211; Graphical frontend for otool, the disassembler. http://otx.osxninja.com/ Burp Suite, Paros, Webscarab &#8211; web application assessment tools, including proxies (useful to sniff those online updates and registration schemes). http://research.corsaire.com/tools/ HexFiend &#8211; Hex Editor. http://ridiculousfish.com/hexfiend/]]></description>
		<wfw:commentRss>http://reverse.put.as/2007/10/10/must-have-tools/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
