Skip to content

Instantly share code, notes, and snippets.

@xkef
Last active November 5, 2023 03:22
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save xkef/c8b7dc8ebd9b724b0b9a47b884900319 to your computer and use it in GitHub Desktop.
Save xkef/c8b7dc8ebd9b724b0b9a47b884900319 to your computer and use it in GitHub Desktop.
catalina spctl

codesign

sign unsigned package yourself (carefully debug first with ghidra, virustotal etc ;)

sudo codesign –force –deep –sign – /Applications/Foobar.app

example studio one crack

this is postinstall script from .pkg package

#!/bin/sh
sudo chmod -R 777 /Applications/Studio\ One\ 4.app 
sudo codesign -fs - /Applications/Studio\ One\ 4.app

# homecalling
sudo -- sh -c -e "echo '127.0.0.1 updates.presonus.com' >> /etc/hosts";
sudo -- sh -c -e "echo '127.0.0.1 registration.presonus.com' >> /etc/hosts";
sudo -- sh -c -e "echo '127.0.0.1 api.presonus.com' >> /etc/hosts";
sleep 3
sudo spctl --master-disable
exit 0

example russian group TNT

#!/bin/bash
printf '\e[1;40;92m'
clear
printf "All TNT releases are provided\n\tfree of charge for educational and uncommercial reasons.\n"
printf "Все релизы TNT предоставляются\n\tбезвозмездно для образовательных и некоммерческих целей.\n"
echo ""
echo "Press ENTER if you agree or close this window!"
echo "Нажмите ENTER, если вы согласны, или закройте окно!"
read ok
echo "Please wait..."
echo "Пожалуйста, подождите..."
echo ""
DMG=$(dirname "$0")
DIR=/tmp/tnt$RANDOM
rm -rf $DIR
mkdir -p $DIR
cp "$DMG/Manual install"/*.dmg $DIR
xattr -r -d com.apple.quarantine $DIR/*.dmg  &>/dev/null
#if [ $? -ne 0 ]; then
# echo "Failed to add a Gatekeep exception, please try manual installation!"
# echo "Ошибка добавления исключения Gatekeep, установите программу вручную!"
# printf '\e[39m'
# exit 1
#fi
mkdir -p $DIR/mount
hdiutil attach -owners on -quiet -noverify -mountpoint $DIR/mount $DIR/*.dmg -shadow $DIR/shadow
find $DIR/mount -maxdepth 1 \! -type l \! -path $DIR/mount -exec xattr -r -d com.apple.quarantine {} \; &>/dev/null
echo ""
echo "If the application fails to open wait a bit and try again!"
echo "Если программа не открывается, подождите немного и попробуйте снова!"
echo ""
echo "Have a nice day/night!"
echo "Приятного дня/вечера!"
(sleep 5 && hdiutil detach -force "$DMG") &
printf '\e[39m'
exit 0
@xkef
Copy link
Author

xkef commented Mar 22, 2020

iZotope Insight patch

sudo perl -pi -e 's|\x00\x55\x48\x89\xE5\x48\x8B\xBF\x18\x05\x00\x00\x48\x8B\x35|\x00\x31\xC0\xFF\xC0\xC3\x8B\xBF\x18\x05\x00\x00\x48\x8B\x35|g' /Library/Audio/Plug-Ins/Components/iZInsight2AUHook.component/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/VST/Insight\ 2.vst/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/VST3/Insight\ 2.vst3/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/Components/iZRelayAUHook.component/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay /Library/Audio/Plug-Ins/VST/Relay.vst/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay /Library/Audio/Plug-Ins/VST3/Relay.vst3/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay

sudo perl -pi -e 's|\x55\x48\x89\xE5\x48\x8B\xBF\x18\x05\x00\x00\x48\x8B\x35|\xB8\x05\x00\x00\x00\xC3\xBF\x18\x05\x00\x00\x48\x8B\x35|g' /Library/Audio/Plug-Ins/Components/iZInsight2AUHook.component/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/VST/Insight\ 2.vst/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/VST3/Insight\ 2.vst3/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/Components/iZRelayAUHook.component/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay /Library/Audio/Plug-Ins/VST/Relay.vst/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay /Library/Audio/Plug-Ins/VST3/Relay.vst3/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay

sudo perl -pi -e 's|\x55\x89\xE5\x83\xEC\x08\xE8\x00\x00\x00\x00\x58\x8B\x4D\x08\x83\xEC\x08\xFF\xB0|\x31\xC0\x40\xC3\xEC\x08\xE8\x00\x00\x00\x00\x58\x8B\x4D\x08\x83\xEC\x08\xFF\xB0|g' /Library/Audio/Plug-Ins/Components/iZInsight2AUHook.component/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/VST/Insight\ 2.vst/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/VST3/Insight\ 2.vst3/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/Components/iZRelayAUHook.component/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay /Library/Audio/Plug-Ins/VST/Relay.vst/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay /Library/Audio/Plug-Ins/VST3/Relay.vst3/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay

sudo codesign -fs - /Library/Audio/Plug-Ins/Components/iZInsight2AUHook.component/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/VST/Insight\ 2.vst/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/VST3/Insight\ 2.vst3/Contents/Resources/iZInsight2.bundle/Contents/MacOS/iZInsight2 /Library/Audio/Plug-Ins/Components/iZRelayAUHook.component/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay /Library/Audio/Plug-Ins/VST/Relay.vst/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay /Library/Audio/Plug-Ins/VST3/Relay.vst3/Contents/Resources/iZRelay.bundle/Contents/MacOS/iZRelay

@xkef
Copy link
Author

xkef commented Mar 22, 2020

TNT

tnt.nfo

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

  ___________________________________________________________________________  
 /  _____  _   _  _____   _                               _   _  ___   ___   \ 
|| |_   _|| \ | ||_   _| | |_   ___   __ _  _ __ ___     | \ | ||  _| / _ \  ||
||   | |  |  \| |  | |   | __| / _ \ / _` || '_ ` _ \    |  \| || |_ | | | | ||
||   | |  | |\  |  | |   | |_ |  __/| (_| || | | | | |   | |\  ||  _|| |_| | ||
||   |_|  |_| \_|  |_|    \__| \___| \__,_||_| |_| |_| . |_| \_||_|   \___/  ||
||___________________________________________________________________________||
||                                                                           ||
||   Title:      CleanMyMac X                                                ||
||   Category:   Utilities                                                   ||
||   Source:     Web                                                         ||
||   URL:        https://macpaw.com/cleanmymac                               ||
||   Version:    4.6.0                                                       ||
||   Languages:  Multilanguage                                               ||
||   Requires:   macOS 10.10 (Intel 64)                                      ||
||                                                                           ||
||   Date:       2020-03-04                                                  ||
||   Protection: Custom                                                      ||
||                                                                           ||
||   Description:                                                            ||
||   CleanMyMac X is all-in-one package to awesomize your Mac. It cleans     ||
||   megatons of junk and makes your computer run faster. Just like it did   ||
||   on day one.                                                             ||
||                                                                           ||
||   All TNT releases are provided free of charge for educational and        ||
||   uncommercial reasons.                                                   ||
||   Support the software developers. If you like this app, BUY IT!          ||
||                                                                           ||
||   tnt.sfv digest (SHA-256):                                               ||
||      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855     ||
||   rhash digest (SHA-256):                                                 ||
||      88f68531f38551bfbac210161bf16c1c2008092eb09eb2f89c17b7585029791b     ||
||                                                                           ||
||   You could verify files by running:                                      ||
||   cd imagepath; Extra/rhash -r Extra/tnt.sfv --sha256 --skip-ok -c        ||
||                                                                           ||
||                 Why join the navy if you can be a pirate?                 ||
||                        Reach us at tnt4mac@tuta.io                        ||
||    Key fingerprint: 9D4B 00AE 65EC 2E79 F8AE  9B2D 3E42 3DD4 CF0A 7487    ||
 \___________________________________________________________________________/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEnUsArmXsLnn4rpstPkI91M8KdIcFAl5fgfkACgkQPkI91M8K
dIcH+A/+Klw76gHVicEm3Zd/pfry6dTYrW6AOWAfWbeV1lV80SncvAQ9MSe1zRRR
TLVO1wEsR/kCVfaiGlBZFVMlMzG6bhbG+vjSGXbA/JLh/LQFnqO06lCAWqOg2NJa
YNYLszYVqJlbMrZL10W1lU/QI7Qy+GEUMHOzVUl+bwMderBAldX3pkDBc01OnaLR
dyexKjY8GtLYpTHVAuXMBuerxGg5wAdrpwWiGWRJEx+gTmQVLBycoW2YDG9cUVbU
Iz3bNvBkqemOr/PIE0oHsr5x3zOU4iuM9gazyHX4ruC8XbcjANr7J755nrXLtlUl
wW0k7pnXYY/od6pFOoIBak5lGVLK2FWaEOVK44FuPzGxh+RWjgiJKf1jqAEvYjLZ
+vXuuO1SZOFNJrxLNgi7UkiUS4tZ1dHebEQV03nnJloSyv5Cm6mexNrf1rfYGpmf
6W2tV/OT/5bXoktJ99ykybdKKsdemaxycEQnvfObv1bb0qJseirYnu1on4SsgSxQ
uenCHLBVKLXwZ2WMps/LBY6i9FZ7NTcILwDNVczxM1vsRYI+Yvaf+vlRujxtJmX6
vKbG20ucWL55djZWk/TyVT/HLWJDXt43eNjrnH21CkwUjqXaYTE45nJzCYRFw9gI
Z5Q1hpR7LoTqoQ47AG/U43ePdzclxBLDCUGA8oJ4kiMGeeT8iZY=
=EOyT

@xkef
Copy link
Author

xkef commented Mar 22, 2020

vcuijyhr@sharklasers.com
March 22, 2020
Your comment is awaiting moderation.

keygen probably trojan:

https://www.virustotal.com/gui/file/6773a1d28cc64ef2e4563fdfc4438de32cb6f5b229faaa71498a39dd8261f2c1/community

https://imgur.com/H8morWs.png

@xkef
Copy link
Author

xkef commented Mar 24, 2020

iZotope Neutron Patch using regex; works for all plugins

sudo perl -pi \
    -e 's|\x00\x55\x48\x89\xE5\x48\x8B\xBF\x18\x05\x00\x00\x48\x8B\x35|\x00\x31\xC0\xFF\xC0\xC3\x8B\xBF\x18\x05\x00\x00\x48\x8B\x35|g' \
    /Library/Audio/Plug-Ins/Components/iZNeutron3AUHook.component/Contents/Resources/iZNeutron3.bundle/Contents/MacOS/iZNeutron3

sudo perl -pi \
    -e 's|\xC3\x55\x48\x89\xE5\x48\x8B\xBF\x18\x05\x00\x00\x48\x8B\x35|\xC3\xB8\x05\x00\x00\x00\xC3\xBF\x18\x05\x00\x00\x48\x8B\x35|g' \
    /Library/Audio/Plug-Ins/Components/iZNeutron3AUHook.component/Contents/Resources/iZNeutron3.bundle/Contents/MacOS/iZNeutron3

sudo codesign -fs - \
    /Library/Audio/Plug-Ins/Components/iZNeutron3AUHook.component/Contents/Resources/iZNeutron3.bundle/Contents/MacOS/iZNeutron3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment