GDB anti-debug, Otool/otx anti-disassembly… It’s Challenge number 3 !!!

Today I decided to give a look at Challenge #3 since it promised nasty tricks. Now that looks like a challenge and I love challenges! If you think this is a spoiler then stop reading and come back in a week or so. There is no solution for the challenge; I’m more interested in the “nasty” trick used and why the tools are failing. And I don’t need the Challenge itself to analyse this behavior since I can reproduce it with own code....

August 18, 2010 · 6 min · 1149 words

How to Keygen MSJ Kracking Challenge ’10 – Challenge #1

The MBA is over and I’m enjoying my vacations to clear stuff from the Todo list, to read books, to play some games and to do other stuff. Today the MacSerialJunkies contest started and I decided to give it a go. It’s a very simple crackme with a small twist where you have to bruteforce a MD5 string. I had reversed the serial routine and was starting the bruteforce without thinking much about it (first attempts were by searching online MD5 hashes databases for the correspondent plaintext but no such luck)....

August 2, 2010 · 2 min · 368 words

Very small update...

Hi! I just updated the crackmes with #5 from MSJ challenge and added a new tool for encrypting/decrypting apple encrypted binaries. I had planned to do this tool but it’s great that someone did it first! It’s good to see people developing tools for OS X, even if they are very simple. Thank you to the author and to the guy who pointed me to it and sent the crackme 😉....

June 8, 2010 · 1 min · 180 words

Onyx the Black Cat v0.4 for Snow Leopard

I had this one working for a long time but I hadn’t released it because I was trying to hijack fork and vfork calls. My objective was to introduce an int3 so I could attach the debugger to a selected process. At that time I suspected that VLOK was forking and I couldn’t debug the new process since follow on fork GDB function isn’t implemented in OS X (so this looks like a good idea for a protection 😉)....

May 24, 2010 · 2 min · 292 words

OS X Crackmes

Hello, I have just added a page to collect crackmes for OS X. I have added the ones that I already had and some recommended from user comments. Since corruptfire.com seems down I cannot retrieve the other ones they had. If you have more crackmes please mail them to me so I can add them to the page. It would be nice to start having more crackmes developed for OS X....

May 21, 2010 · 1 min · 72 words