This is my first Mac OS X reversing tutorial. Target is You Control Desktops, which revealed itself a very nice target to reverse. Download the files below and I hope you learn something from it. There’s no interest whatsoever in piracy, but only in learning and improving things. What you do with this information is YOUR responsability. The keygen (and decrypt.c) make a nice example of OpenSSL API usage. Keygen is non working....

It’s useful to change /etc/hosts, especially with protections requesting online keys. After editing /etc/hosts you need to refresh OS X NetInfo Database. Just run the following command: $ sudo niload -v -m hosts . < /etc/hosts And then flush cache with: $ lookupd -flushcache For Snow Leopard the command has changed. It is now: $ dscacheutil -flushcache And that’s it!

Since there are programs with serial numbers tied to network card MAC address it might be useful to change it. There are some fancy GUI programs for this but it’s faster from terminal: # ifconfig en0 lladdr X:XX:XX:XX:XX:XX And that’s it…

You can see code like this in GDB: 0x3001ce2b : movzx edx,BYTE PTR [ebp-80] <- 80 is decimal 0x3001ce2f : mov eax,DWORD PTR [ebx+0x206c2] <- 0x206c2 is hexadecimal If you try to do a x/x $ebp-80, you will get the wrong address because the default input radix is hexadecimal and not decimal. But in the next line, it’s hexadecimal. I haven’t searched much about this, but it seems the decimal is used due to alignment....

A work in progress list… Otx – Graphical frontend for otool, the disassembler. http://otx.osxninja.com/ Burp Suite, Paros, Webscarab – web application assessment tools, including proxies (useful to sniff those online updates and registration schemes). http://research.corsaire.com/tools/ HexFiend – Hex Editor. http://ridiculousfish.com/hexfiend/