Down the Rabbit Hole - Reverse Engineering Mac OS X

More documents

Recommendations

Info

Function Overriding DetailsBuild the branch instruction. Target the escape island.Optionally allocate and engage the reentry island.Atomically:Insert the original function’s first instruction into thereentry island. If reentry is desired.Target the reentry island and make it executable. Again,if reentry is desired.Swap the original function’s first instruction with thegenerated ba instruction. If atomic replacement fails(unlikely), loop and try again.Monday, February 9, 2009
Code Injection OverviewFunction overriding is a powerful technique, but it’sonly attains half of our goal.By itself, we can only override system functions in ourown software.Code injection, on the other hand, allows us overrideapplication and system functions in any process.Not just override functions, but inject new ObjectiveC classes (example: for posing)Monday, February 9, 2009
Page 1 and 2: Dynamically Overriding Mac OS XDown
Page 3: What Happened toHow to Hack Mac OS
Page 7 and 8: Function OverridingIdeally, overrid
Page 9 and 10: CFM vs MachExporter-Owned Vector Ta
Page 11 and 12: Function OverridingWhat will work:
Page 13 and 14: Single-Instruction OverwritingRepla
Page 15 and 16: The Branch IslandWe can allocate a
Page 17: Inside the Branch IslandC definitio
Page 21 and 22: Lame Override Animation! Reentry Is
Page 23: Function Overriding DetailsDiscover
Page 27 and 28: Code Injection DetailsAllocate a re
Page 29 and 30: Code & Doc AvailabilityTwo packages

Down the Rabbit Hole - Reverse Engineering Mac OS X

Create successful ePaper yourself

Delete template?

Save as template?