Apple’s GDB Bug?

I was trying to add some features to gdbinit and I needed global variables. I already knew that feature wasn’t working on Mac OS X GDB and I was puzzled why it didn’t work. Some quick tests on a Linux box couldn’t reproduce the same behaviour so something is wrong with Apple’s GDB version. I finally found how it happens ! A very simple .gdbinit to test things would be: [Read More]

The IDA Pro Book: The Unofficial Guide to the World’s Most Popular Disassembler

Excellent book! Recommended if you are into Reverse Engineering and not only IDA specific.
Well written with lots of examples. Really enjoyed it. Well worth the money (and even cheaper if you use Amazon Market Place).
I’m back with huge amounts of work so my reversing efforts are on a halt.
Let’s see if things get calm again so I can try some ideas :-).

"Hacker" Challenge


If you want to have some fun and maybe improve your security/reversing skills, you might try this site It has some nice challenges in different fields (reversing is only for Windows, but hey you should be able to reverse anything!).

Have fun !

How to change /etc/hosts

It’s useful to change /etc/hosts, especially with protections requesting online keys. After editing /etc/hosts you need to refresh OS X NetInfo Database. Just run the following command:

$ sudo niload -v -m hosts . < /etc/hosts

And then flush cache with:

$ lookupd -flushcache

For Snow Leopard the command has changed. It is now:

$ dscacheutil -flushcache

And that’s it!

Change network card MAC address

Since there are programs with serial numbers tied to network card MAC address it might be useful to change it.
There are some fancy GUI programs for this but it’s faster from terminal:

# ifconfig en0 lladdr X:XX:XX:XX:XX:XX

And that’s it…

GDB input radix option

You can see code like this in GDB: 0x3001ce2b : movzx edx,BYTE PTR [ebp-80] <- 80 is decimal 0x3001ce2f : mov eax,DWORD PTR [ebx+0x206c2] <- 0x206c2 is hexadecimal If you try to do a x/x $ebp-80, you will get the wrong address because the default input radix is hexadecimal and not decimal. But in the next line, it’s hexadecimal. I haven’t searched much about this, but it seems the decimal is used due to alignment. [Read More]