/osx-re-101

A collection of resources for OSX/iOS reverse engineering.

osx & ios re 101

Work in progress as I am actively collecting these.

Must read

Keep these handy

Basics

Malware, Anti-debugging, infection techniques, obfuscation, and encryption

Various research & tutorials

Kernel extension (KEXT) development

Other

Crackmes and challenges

Books

  • "The Mac Hacker's Handbook" by Charlie Miller, Dino Dai Zovi
  • "Mac OS X and iOS Internals: To the Apple's Core" by Jonathan Levin
  • "Mac OS X Internals: A Systems Approach" by Amit Singh
  • "iOS App Reverse Engineering" https://github.com/iosre/iOSAppReverseEngineering
  • "iOS Hacker's Handbook" by Charlie Miller, Dion Blazakis, Dino Dai Zovi, Stefan Esser, Vincenzo Iozzo, Ralf-Philip Weinmann
  • "Hacking and Securing iOS Applications" by Jonathan Zdziarski

Reverse Engineering Resources

Debugging

These are very important guides for understanding the debugging process and how applications work.

  • Mac OS X Debugging Magic Technical Note (TN2124) (link - PDF Mirror)
  • iOS Debugging Magic Technical Note (TN2239) (link - PDF Mirror)
  • Understanding and Analyzing iOS Application Crash Reports (TN2151) (link - PDF Mirror)
  • Malloc Debug Environment Variables (link - PDF Mirror)

Mach-O Binaries

Mac OS X and iOS use Mach-O file format for executable binaries and shared libraries. It supports multiple architectures in one binary file (Universal or fat binaries).

Analysis

Guides and introductory material to binary analysis.

  • Analyzing Binaries with Hopper (link)

System ABIs

Calling conventions define how functions and subroutines receive the parameters passed to them from the calling function.

Language Resources

Language specific knowledge is often required to understand what is going on behind the scenes.

Further Reading

Collection of blogs and reading resources that give deep insight into how many aspects of languages and system functionality.

  • NSBlog (link)
  • Reverse Engineering Mac OS X (link)
  • Landon's Blog (link)
  • OS X Internals (link)
  • Greg Parker's Blog (link)
  • Ridiculous Fish (link)
  • Snare's Blog (link)
  • To The Apple's Core (link)
  • The Objective-C Runtime: Understanding and Abusing (link)

Tools

Mach-O Binary Analyzers:

Hex Editors:

Disassemblers:

Decompilers:

Debuggers:

Memory Editors:

Various Command Line Tools:

  • nm (man page)
  • strings (man page)
  • dsymutil (man page)
  • install_name_tool (man page)
  • ld (man page)
  • lipo (man page)
  • codesign (man page)
  • hexdump (man page)
  • dyld_shared_cache (link)
  • vbindiff (link)
  • binwalk (link)
  • xpwntool (link)
  • objdump (link)

Useful Source Repositories:

  • Apple Source Code (link)
  • PLCrashReporter (link)
  • Mike Ash's Github (link)
  • Landon Fuller's Github (link)
  • Jonathan Rentzsch's Github (link)
  • fG!'s Github (link)