Advanced Mac OS X Rootkits.pdf - Reverse Engineering Mac OS X
Advanced Mac OS X Rootkits.pdf - Reverse Engineering Mac OS X
Advanced Mac OS X Rootkits.pdf - Reverse Engineering Mac OS X
- No tags were found...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Injecting <strong>Mac</strong>h Bundles• Inject threads to call functions in the remote process– Remote thread calls injected trampoline code and thentarget function– Function returns to chosen bad address, generates anexception– Injector handles exception, retrieves function return value• Call dlopen(), dlsym(), dlclose() to load bundle from disk• Inject memory, call NSCreateObjectFileImageFromMemory(),NSLinkModule()• Injected bundle can hook library functions, Objective-Cmethods19
Change language