Objective-C phun on Mac OS X


A few posts ago Jose showed a script to clean-up ARM iPhone binaries.The x86 counterparts suffer from the same problems, so I thought it would have been useful to have something similar for it.Both the behaviour and the algorithm behind the script are pretty much the same as the one Jose wrote.
The real difference is in the “dumbish” dataflow tracing method we use. In fact the calling convention on Iphone and OS X is different; so instead of tracing register assignments we have to trace stack variables and of course we are on x86. We currently don’t track function arguments and complex operands. Of course, it can be improved, but it still yields good results as it is:)

Another problem you sometimes encounter when analyzing OSX binaries is that sections are not interpreted correctly. For this purpose I wrote a very simple script that cleans up an OSX binary IDB.Basically it will aggressively make functions in the __text segment and make sure that __cstring is effectively interpreted as a segment containing strings and not code.
You can find both scripts on our company github repository.

If you want to learn a bit more about OS X hacking and reversing consider taking the
I and Dino Dai Zovi are going to teach at Black Hat USA.

3 Responses to “Objective-C phun on Mac OS X”

  1. githublooser Says:

    so… ok, I went to http://github.com/zynamics followed through to objc-helper-plugin-ida and then I gave up and couldn’t find the scripts, where are them? can we get a direct link please! tx!

  2. fry Says:

    tried looking for it in the GIThub…
    its not there can u please updload/update it…

  3. Vincenzo Iozzo Says:

    sorry for the slow reply. The github repository was updated to include the script. There you go: http://github.com/zynamics/objc-helper-plugin-ida

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: