Skip to content

FOX: Update for analysing Mac binaries - #3

Draft
Tokarak wants to merge 3 commits into
federicodotta:mainfrom
Tokarak:main
Draft

FOX: Update for analysing Mac binaries#3
Tokarak wants to merge 3 commits into
federicodotta:mainfrom
Tokarak:main

Conversation

@Tokarak

@Tokarak Tokarak commented Sep 21, 2023

Copy link
Copy Markdown
  • Create extractFunctionListMac.py
  • eFLM.py: remove unneeded variables
  • Update eFLM.py

@Tokarak

Tokarak commented Sep 21, 2023

Copy link
Copy Markdown
Author

This uses a device.attach() pattern rather than device.spawn(), allowing to get a method dump on a Mac (or hopefully any other desktop/headless environment). In addition, I have cleaned up the code, hopefully making it readable: maybe some of this style can be merged into the original script.

FOX.java still does not work, and I'm not experienced enough to know why.

FOX.java> Running...

FOX 1.0 - Fix Objective-C XREFs in Ghidra
Attempting to fix Objective-C XREFs...

*** Loading Frida input file
*** Loading input file process finished
*** Findind msgSend functions in the binary
*** Findind msgSend functions in the binary - DONE
*** Getting a list of all functions that call one of the msgSend functions
*** Getting a list of all functions that call one of the msgSend functions - DONE
*** Decompiling and analyzing the 0 functions
*** Decompiling and analyzing the functions - DONE
*** Creating a list of all functions of the binary
*** Creating a list of all functions of the binary - DONE
*** Adding XREFs
*** Add XREF - Processing 0 function names*** Adding XREFs - DONE
*** FOX finished correctly. Computation time: 43 seconds
FOX.java> Finished!

I'm not experienced enough in RE to work out why it doesn't work. I would appreciate help.

@Tokarak Tokarak changed the title Update for analysing Mac binaries FOX: Update for analysing Mac binaries Sep 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant