Earlier quoted context omitted.
How so?
vim, gdb, hex editor...
All of which run inside a shell.
I Can Crack Your App With Just A Shell (And How To Stop Me)
11–20 of 93 posts
Re: I Can Crack Your App With Just A Shell (And How To Stop Me)
#12Thanks for writing a detailed step by step tutorial on this interesting topic. I have always wanted to learn more about this stuff.
Re: I Can Crack Your App With Just A Shell (And How To Stop Me)
#13A much more interesting dive into exploring a binary's internals, at DEFCON CTF difficulty -- http://hackerschool.org/DefconCTF/17/B300.html
Re: I Can Crack Your App With Just A Shell (And How To Stop Me)
#14[deleted]
Re: I Can Crack Your App With Just A Shell (And How To Stop Me)
#15Another fairly easy way to do this kind of thing is to use the DYLD_INSERT_LIBRARIES variable. You can reverse engineer the classnames with class-dump, subclass a class and override a suitable function e.g. IsLicenseValid() to just return true; You can then start your program and insert your new subclassed class into it like this:
$ DYLD_INSERT_LIBRARIES=/path/to/your/Subclassedlibrary.dylib arch -i386 /Applications/OriginalApp.app/Contents/MacOS/OriginalApp &
And on a sidenote, I thought it was funny to see him refer to something as 'badly spelt' - I thought that 'rye' remark was a bit 'corny' (rimshot :-)
Re: I Can Crack Your App With Just A Shell (And How To Stop Me)
#16I wrote labrea for similarly playing with apps: http://dustin.github.com/2010/12/03/labrea.html
Specifically, the PT_DENY_ATTACH thing should be possible to be, itself, denied with labrea (though in practice, I've run into runtime linker problems with that exact call that I haven't quite figured out, but I haven't put much work into it).
Re: I Can Crack Your App With Just A Shell (And How To Stop Me)
#17Gah, this is your standard 2 byte change_je_to_jne. Perhaps, to people who program in higher languages this is not evident, but old assembly programmers know this stuff well. Even for the newer ASM programmers, we had Fravia+ (may he rest in peace) to teach us the ropes on reverse engineering and unprotecting 'nasty' code. And those students of Fravia+ know something well: if it is viewable, executable, listenable on…
Oh no, I did not know that Fravia was dead. Spent a lot of time reading his stuff years ago. RIP Francesco.
Re: I Can Crack Your App With Just A Shell (And How To Stop Me)
#18Another fairly easy way to do this kind of thing is to use the DYLD_INSERT_LIBRARIES variable. You can reverse engineer the classnames with class-dump, subclass a class and override a suitable function e.g. IsLicenseValid() to just return true; You can then start your program and insert your new subclassed class into it like this: $ DYLD_INSERT_LIBRARIES=/path/to/your/Subclassedlibrary.dylib arch -i386 /Applications/…
I didn't know about that, that's really neat! Will need to do some research into that!
PS: I'm poking fun at myself—since I wrote the original app, including misspelling. Also, I use American english, but I do prefer to use the british form of 'spelt' or 'burnt.'
Re: I Can Crack Your App With Just A Shell (And How To Stop Me)
#19Gah, this is your standard 2 byte change_je_to_jne. Perhaps, to people who program in higher languages this is not evident, but old assembly programmers know this stuff well. Even for the newer ASM programmers, we had Fravia+ (may he rest in peace) to teach us the ropes on reverse engineering and unprotecting 'nasty' code. And those students of Fravia+ know something well: if it is viewable, executable, listenable on…
Oh no, I did not know that Fravia was dead. Spent a lot of time reading his stuff years ago. RIP Francesco.
Sadfully, he passed May 3, 2009.
Here was HN's article and responses: http://news.ycombinator.com/item?id=600523
Re: I Can Crack Your App With Just A Shell (And How To Stop Me)
#20The most stealth cracking countermeasure I ever witnessed was the application would XOR some of its UI messages with the hash sig of the application binary file, so if you edited the application binary file directly the crack seemed to work just fine ... but then the application would gradually go insane. The cracker who finally posted a working crack was impressed with how simple and devious the countermeasures were.