Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...
Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...
Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
TECHNIQUES<br />
DODGY KERNEL SYMBOL RESOLUTION<br />
Start of kernel image is at 0xffffff8000200000<br />
$ otool -l /mach_kernel<br />
/mach_kernel:<br />
Load command 0<br />
cmd LC_SEGMENT_64<br />
cmdsize 472<br />
First kernel segment VM load addr<br />
segname __TEXT<br />
vmaddr 0xffffff8000200000<br />
vmsize 0x000000000052e000<br />
gdb$ x/x 0xffffff8000200000<br />
0xffffff8000200000:! 0xfeedfacf<br />
<strong>Mac</strong>h-O header magic number (64-bit)<br />
<strong>Defiling</strong> <strong>Mac</strong> <strong>OS</strong> X - <strong>Ruxcon</strong><br />
November, 2011
Change language