Down the Rabbit Hole - Reverse Engineering Mac OS X

More documents

Recommendations

Info

Single-Instruction OverwritingBenefits:Atomic replacement. Safe in the face of multiplepreemptive threads calling the original function.Less likely to harmfully impact the original code. If youwish to reenter the original function from theoverride, you’ll need to re-execute the replacedinstruction. Moving less code around makes thismore likely to work.Compatibility. Works with the widest variety offunction prologs and other patchingimplementations (including our own!)Monday, February 9, 2009
Single-Instruction OverwritingReplacing a single instruction is good, but limiting.Can’t branch to an arbitrary address, as that wouldtake at least three instructions.Leaves us with branch instructions that encode theirtargets:b (branch relative)ba (branch absolute)bl (branch relative, update link register)bla (branch absolute, update link regiter)Monday, February 9, 2009
Page 1 and 2: Dynamically Overriding Mac OS XDown
Page 3: What Happened toHow to Hack Mac OS
Page 7 and 8: Function OverridingIdeally, overrid
Page 9 and 10: CFM vs MachExporter-Owned Vector Ta
Page 11: Function OverridingWhat will work:
Page 15 and 16: The Branch IslandWe can allocate a
Page 17: Inside the Branch IslandC definitio
Page 21 and 22: Lame Override Animation! Reentry Is
Page 23 and 24: Function Overriding DetailsDiscover
Page 25 and 26: Code Injection OverviewFunction ove
Page 27 and 28: Code Injection DetailsAllocate a re
Page 29 and 30: Code & Doc AvailabilityTwo packages

Down the Rabbit Hole - Reverse Engineering Mac OS X

Create successful ePaper yourself

Delete template?

Save as template?