Kirow

Reverse Engineering on macOS

Some notes, tools, and techniques for reverse engineering macOS binaries.

Table of Contents

• Reverse Engineering Tools
  • Binary Ninja
• Ghidra

Kirow

import Foundation
import SwiftUI

struct ReferenceCounter {
    class Box {
        weak var value: ViewModel.Element?
    }

    private var objects: [Box] = []
    

Kirow

// To run this playground, select and build the GRDBOSX scheme.

import GRDB
import PlaygroundSupport

//models

public struct User: Codable, TableRecord, FetchableRecord, MutablePersistableRecord {
    public static let databaseTableName: String = "user"
    public static let log = hasMany(StateLog.self)

Kirow

// To run this playground, select and build the GRDBOSX scheme.

import GRDB
import PlaygroundSupport

public struct User: Codable, TableRecord, FetchableRecord, MutablePersistableRecord {
    public static let databaseTableName: String = "user"
    
    public var id: Int64?
    public var username: String

Kirow

public class InteractiveLabel: UILabel {
    private struct InteractiveText: Equatable {
        let range: Range<String.Index>
        let defaultColor: UIColor
        let highlightedColor: UIColor
        let action: () -> Void

        static func == (lhs: InteractiveText, rhs: InteractiveText) -> Bool {
            return lhs.range == rhs.range
        }

Kirow

CGFloat ScaleToAspectFitRectInRect(CGRect rfit, CGRect rtarget)
{
    // first try to match width
    CGFloat s = CGRectGetWidth(rtarget) / CGRectGetWidth(rfit);
    // if we scale the height to make the widths equal, does it still fit?
    if (CGRectGetHeight(rfit) * s <= CGRectGetHeight(rtarget)) {
        return s;
    }
    // no, match height instead
    return CGRectGetHeight(rtarget) / CGRectGetHeight(rfit);

Kirow

(lldb) po str
“{\n \”userId\”: 1,\n \”id\”: 1,\n \”title\”: \”sunt aut facere repellat provident occaecati excepturi optio reprehenderit\”,\n \”body\”: \”quia et suscipit\\nsuscipit recusandae consequuntur expedita et cum\\nreprehenderit molestiae ut ut quas totam\\nnostrum rerum est autem sunt rem eveniet architecto\”\n}”

(lldb) po NSString(string: str)
{
  “userId”: 1,
 “id”: 1,

Kirow

Delete remote

git push -d $(git tag -l "tag_prefix*")

Delete local

git tag -d $(git tag -l "tag_prefix*")

Kirow

remap home and end by creating ~/Library/KeyBindings/ and saving a property list like this as DefaultKeyBinding.dict:

cd ~/Library 
mkdir KeyBindings
cd ~/Library/KeyBindings/
touch DefaultKeyBinding.dict
nano DefaultKeyBinding.dict

{
    "\UF729"  = moveToBeginningOfParagraph:; // home

Kirow

/* http://www.taltech.com/barcodesoftware/symbologies/upc
  UPC-A Number    Equivalent UPC-E    Notes
  0ab00000cdeX    abcde0X             Manufacturer code must have 2 leading digits with 3 trailing zeros and the item number is limited to 3 digits (000 to 999).
  0ab10000cdeX    abcde1X             Manufacturer code must have 3 leading digits ending with "1" and 2 trailing zeros. The item number is limited to 3 digits.
  0ab20000cdeX    abcde2X             Manufacturer code must have 3 leading digits ending with "2" and 2 trailing zeros. The item number is limited to 3 digits.
  0abc00000deX    abcde3X             Manufacturer code must have 3 leading digits and 2 trailing zeros. The item number is limited to 2 digits (00 to 99).
  0abcd00000eX    abcde4X             Manufacturer code must have 4 leading digits with 1 trailing zero and the item number is limited to 1 digit (0 to9).
  
  0abcde00005X    abcde5X             Manufacturer code has all 5 digits. 
  0abcde00006X    abcde6X             The item nu