Here is a small update to gdbinit with a new command, skip. This command will skip over the current instruction, without executing it. Usually I do it manually by set $pc=newvalue but this involves copy & paste and mouse movements and gets boring after a while. It’s great to skip over calls while you are trying some stuff and analysing some program behavior. By default it will not execute the command at the new address....
It sucks, sort of! Let me rewind to the beginning. I was very curious about this one because it was announced with great fanfare. I interpreted it as something more robust than it really is – maybe I was over enthusiastic with the “we know this will be cracked someday” sentence. Some brief comments: There are no anti-debug measures. There are no binary integrity protections – patch whatever you want! It has an annoying constant polling for the license file (I observed at least 5 hits per second – what a meaningless waste of CPU)....
Merry Christmas or whatever applies or not to your particular case, and much more important, Happy New Year! The world is messed up and it will probably get worse in 2012. Cheer up and be positive! Let me write some quick notes about some stuff: Take a look at Snare’s presentation about OS X Rootkits! Available at Papers section or here. Check out the fantastic Hopper disassembler and decompiler here or at the Mac App Store....
Let me start this with some sort of disclaimer. I do not support/condone stealing credit card information, logins, and other personal information. Disclosing security issues is always a double edge sword and a tricky problem with some politics in the mix. This problem was reported almost 3 months ago to Apple. It’s still not fixed after, at least, two iTunes releases. I perfectly understand the business side of fixing bugs and how business most of the times must come first (I have experience in critical environments where these type of problems can cost a lot of money and bad publicity)....
A small update to gdbinit. Many thanks to snare and Plouj for their reports 😃. Here is the changelog: Version 7.4.3 (04/11/2011) – Modified “hexdump” command to support a variable number of lines (optional parameter). – Removed restrictions on type of addresses used in the “dd” command. – Modified the assemble command to support 64bits – You will need to recompile nasm since the version shipped with OS X doesn’t supports 64bits (www....