Some notes, tools, and techniques for reverse engineering macOS binaries.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import ipaddress | |
def is_ip_in_cidr(ip_address, cidr_range): | |
try: | |
network = ipaddress.ip_network(cidr_range, strict=False) | |
ip = ipaddress.ip_address(ip_address) | |
return ip in network | |
except ValueError as e: | |
return f"Error: {e}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// SplitAt returns a bufio.SplitFunc closure, splitting at a substring | |
// scanner.Split(SplitAt("\n# ")) | |
func SplitAt(substring []byte) func(data []byte, atEOF bool) (advance int, token []byte, err error) { | |
return func(data []byte, atEOF bool) (advance int, token []byte, err error) { | |
// Return nothing if at the end of the file and no data passed | |
if atEOF && len(data) == 0 { | |
return 0, nil, nil | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/Applications/Xcode.app/Contents/SharedFrameworks/LLDB.framework/Versions/A/Resources/debugserver |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Example stub caller function that this binary ninja script renames would be like this: | |
# 1001dc540 int64_t sub_8282828818(void* arg1) | |
# 1001dc550 return _objc_msgSend(self: arg1, cmd: "_finalRestoreBlock") __tailcall | |
# Result will be: | |
# 1001dc540 int64_t objc_stub_caller__finalRestoreBlock(void* arg1) | |
# 1001dc550 return _objc_msgSend(self: arg1, cmd: "_finalRestoreBlock") __tailcall | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
from binaryninja import * | |
def replace_non_alphanumeric_characters(input_string): | |
copy = input_string | |
copy = ''.join(filter(str.isalnum, input_string)) | |
return copy | |
This is a work in progress by someone who is learning about Binary Ninja.
References
- https://api.binary.ninja/binaryninja.binaryview-module.html
- https://gist.github.com/psifertex/6fbc7532f536775194edd26290892ef7
Get database name
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
[package] | |
name = "test" | |
version = "0.1.0" | |
authors = ["YOU <[email protected]>"] | |
edition = "2018" | |
[lib] | |
crate-type = ["cdylib"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
[ | |
{ | |
"name": "Stone's", | |
"intervals": [ | |
{ | |
"from": 1660305600000, | |
"to": 1660328099000 | |
} | |
], | |
"seats": 0, |
NewerOlder