Advanced Mac OS X Rootkits.pdf - Reverse Engineering Mac OS X

More documents

Recommendations

Info

Mach messages• Mach messages are structured andunidirectional• Header:typedef struct{mach_msg_bits_tmach_msg_size_tmach_port_tmach_port_tmach_msg_size_tmach_msg_id_tmsgh_bits;msgh_size;msgh_remote_port;msgh_local_port;msgh_reserved;msgh_id;} mach_msg_header_t;• Body consists of typed data items34
Complex Mach Messages• “Complex” Mach messages contain out-of-linedata and may transfer port rights and/ormemory pages to other tasks• In the message body, descriptors describe theport rights and memory pages to be transferred• Kernel grants port rights to the receivingprocess• Kernel maps transferred pages to receivingprocess, sometimes at message-specifiedaddress35
Page 1 and 2: AdvancedMac OS X RootkitsDino Dai Z
Page 3 and 4: WHAT IS MACH?3
Page 5 and 6: Mac OS X System ArchitectureSUP DAW
Page 7 and 8: Mach Microkernel Abstractions• Ta
Page 9 and 10: Example: Bootstrap server• Tasks
Page 11 and 12: Mach Tasks vs. BSD Processes• Mac
Page 13 and 14: Mach Task/Thread System Calls•Mac
Page 15 and 16: Why Mach-based Rootkits?• Traditi
Page 17 and 18: Injecting Mach Threads• Get acces
Page 19 and 20: Injecting Mach Bundles• Inject th
Page 21 and 22: Hooking and Swizzling• Hooking C
Page 23 and 24: INJECTED BUNDLE DEMO23
Page 25 and 26: NetMessage and NetName servers• N
Page 27 and 28: Machiavelli Architecture• Machiav
Page 29 and 30: Machiavelli Message FlowMachiavelli
Page 31 and 32: Machiavelli Message FlowMachiavelli
Page 33: Machiavelli Message FlowMachiavelli
Page 37 and 38: Serializing Mach Messages• Serial
Page 39 and 40: Machiavelli exampleint main(int arg
Page 41 and 42: Miscellaneous Agent services• Age
Page 43 and 44: MACH IN THE KERNEL43
Page 45 and 46: Uncloaking Kernel Rootkits• Acces
Page 47 and 48: Evasive Maneuvers• Unix system ca
Page 49 and 50: Example: inject_subsystemint inject
Page 51: Conclusion• Mach is a whole lot o

Advanced Mac OS X Rootkits.pdf - Reverse Engineering Mac OS X

Create successful ePaper yourself

Delete template?

Save as template?