Kirow

Reverse Engineering on macOS

Some notes, tools, and techniques for reverse engineering macOS binaries.

Table of Contents

• Reverse Engineering Tools
  • Binary Ninja
• Ghidra

Kirow

import Foundation
import SwiftUI

struct ReferenceCounter {
    class Box {
        weak var value: ViewModel.Element?
    }

    private var objects: [Box] = []
    

Kirow

// To run this playground, select and build the GRDBOSX scheme.

import GRDB
import PlaygroundSupport

//models

public struct User: Codable, TableRecord, FetchableRecord, MutablePersistableRecord {
    public static let databaseTableName: String = "user"
    public static let log = hasMany(StateLog.self)

Kirow

// To run this playground, select and build the GRDBOSX scheme.

import GRDB
import PlaygroundSupport

public struct User: Codable, TableRecord, FetchableRecord, MutablePersistableRecord {
    public static let databaseTableName: String = "user"
    
    public var id: Int64?
    public var username: String

Kirow

public class InteractiveLabel: UILabel {
    private struct InteractiveText: Equatable {
        let range: Range<String.Index>
        let defaultColor: UIColor
        let highlightedColor: UIColor
        let action: () -> Void

        static func == (lhs: InteractiveText, rhs: InteractiveText) -> Bool {
            return lhs.range == rhs.range
        }

Kirow

CGFloat ScaleToAspectFitRectInRect(CGRect rfit, CGRect rtarget)
{
    // first try to match width
    CGFloat s = CGRectGetWidth(rtarget) / CGRectGetWidth(rfit);
    // if we scale the height to make the widths equal, does it still fit?
    if (CGRectGetHeight(rfit) * s <= CGRectGetHeight(rtarget)) {
        return s;
    }
    // no, match height instead
    return CGRectGetHeight(rtarget) / CGRectGetHeight(rfit);

Kirow

(lldb) po str
“{\n \”userId\”: 1,\n \”id\”: 1,\n \”title\”: \”sunt aut facere repellat provident occaecati excepturi optio reprehenderit\”,\n \”body\”: \”quia et suscipit\\nsuscipit recusandae consequuntur expedita et cum\\nreprehenderit molestiae ut ut quas totam\\nnostrum rerum est autem sunt rem eveniet architecto\”\n}”

(lldb) po NSString(string: str)
{
  “userId”: 1,
 “id”: 1,

Kirow

Delete remote

git push -d $(git tag -l "tag_prefix*")

Delete local

git tag -d $(git tag -l "tag_prefix*")

Kirow

@implementation UIImage (ImageBlur)
// This method is taken from Apple's UIImageEffects category provided in WWDC 2013 sample code
- (UIImage *)applyBlurWithRadius:(CGFloat)blurRadius tintColor:(UIColor *)tintColor saturationDeltaFactor:(CGFloat)saturationDeltaFactor maskImage:(UIImage *)maskImage {
    // Check pre-conditions.
    if (self.size.width < 1 || self.size.height < 1) {
        NSLog(@"*** error: invalid size: (%.2f x %.2f). Both dimensions must be >= 1: %@", self.size.width, self.size.height, self);
        return nil;
    }
    if (!self.CGImage) {
        NSLog(@"*** error: image must be backed by a CGImage: %@", self);

Kirow

remap home and end by creating ~/Library/KeyBindings/ and saving a property list like this as DefaultKeyBinding.dict:

cd ~/Library 
mkdir KeyBindings
cd ~/Library/KeyBindings/
touch DefaultKeyBinding.dict
nano DefaultKeyBinding.dict

{
    "\UF729"  = moveToBeginningOfParagraph:; // home