There are no reviews yet. Be the first to send feedback to the community and the maintainers!
__________________________________ _____ __________ __ __ \__ __/_ __ \_ __ \__ / ___ | / /_ ____/ _ / / /_ / _ / / / / / /_ / _________ |/ /_ / __ / /_/ /_ / / /_/ // /_/ /_ /___/_____/ /| / / /_/ / \____/ /_/ \____/ \____/ /_____/ /_/ |_/ \____/ This is a fork from Apple's otool with my personal modifications to otool. Otool is one of my favourite reversing tools since I work a lot from Terminal.app. The introduction of LC_MAIN as replacement for LC_UNIXTHREAD lost the entrypoint address information. Now you need to calculate the address, which is a another step and I'm too lazy for that! I also modified the output of some fields to hexadecimal values because I also hate to convert those values all the time. The -z option was added. It will invert the current PIE flag, remove if set, set if removed. It's something I use from time to time and it's faster than loading into MachOView and changing there. The -O option was added. It's used to point the file offset where the mach-o header is located. Usually it's at the beginning of the file, but this option makes it possible for example to dump embedded headers in data or binaries files. If you have any suggestions or improvements feel free to contact me, send patches, etc. Darwinbuild is not needed anymore to compile! Just go to the cctools folder and type make. If you just want to build otool you need to: - First go to libstuff folder and type make. - Now go to otool folder and type make. Output is otool.NEW. TRIE support had to be removed. Only the strip util uses it so damage is not big. For historic references, if you want to use darwinbuild: http://reverse.put.as/2009/01/14/how-to-compile-gdb-and-other-apple-open-source-packages-in-mac-os-x/ Enjoy, fG!
MachOView
MachOView forkGdbinit
Gdbinit for OS X, iOS and others - x86, x86_64 and ARMlldbinit
A gdbinit clone for LLDBfirmware_vault
A repo for all Apple EFI firmware filesreadmem
A small OS X/iOS userland util to dump processes memoryonyx-the-black-cat
Kernel extension to disable anti-debug tricks and other useful XNU "features"rootfool
A small tool to dynamically disable and enable SIP in El CapitanEFISwissKnife
An IDA plugin to improve (U)EFI reversingHexRaysDeob
Hex-Rays OLLVM Deobfuscator and MicroCode Explorerhydra
A kernel extension and userland daemon to patch applicationsgopher
A OS X crypto ransomware PoCmach_race
Exploit code for CVE-2016-1757efi_dxe_emulator
EFI DXE Emulator and Interactive Debuggerpydbg64
PyDBG64 - OS X PyDbg with 64 bits supportosx_boubou
A PoC Mach-O infector via library injectionmpress_dumper
MPRESS dumper for OS Xgimmedebugah
A small utility to inject a Info.plist into binaries.gdb-ng
Apple's gdb fork with some fixes and enhancementsExtractMachO
IDA plugin to extract Mach-O binaries located in the disassembly or dataGatekeerper
A kernel extension to mitigate Gatekeeper bypasseskextstat_aslr
Implementation of kexstat via /dev/kmem with kernel ASLR supportcan_I_suid
A TrustedBSD module to control execution of binaries with suid bit setcrackme_nr1
fG!'s crackme #1 source codebruteforcesysent
Small util to discover OS X sysent via bruteforcetcplognke
Apple's tcplognke code sampleTELoader
A TE executable format loader for IDAunicorn_string_deobfuscator
A Unicorn based emulator to deobfuscate Equation Group string XOR obfuscationmario
The kernel component of rootpipe fix for Mavericksadium-ng-preview
Repo to dump some preview info and builds for adium-ngMicrocodeExplorer
Hex-Rays MicrocodeExplorerreadkmem
small utility to dump kernel memoryrex_versus_the_romans
Anti Hacking Team TrustedBSD modulereadphysmem
A small utility to read and write to Macs physical memory using default AppleHWAccess.kext.llvmpatches
Misc llvm patcheshello_santa_bye_santa
Bypass Google's Santafixobjc
IDA IDC script to improve Objective-C disassembly outputcheckidt
Small util to dump the IDT table of a running OS X system with kmem enabledarmorysandbox
A USB armory based USB sandboxMachOPlugin
IDA plugin to Display Mach-O headersicetheguardianv2
A TrustedBSD module PoC to monitor writes to Daemons and Agents foldersdiagnostic_service
OS X rootkit loader version #1kgmacros
Fixed kgmacros to work with VMware kernel gdb stubExtractMacho2
IDA plugin to extract Mach-O binaries located in the disassembly or datasyscall-benchmark
macOS syscall performance benchmarkav-monster
PoC kext to disable OS X anti-virus softwareluigi
The userland component of rootpipe fix for Maverickscarbon_copy_cloner_keychaingen
A keygen for Carbon Copy Cloner private keychainCrisis-Analysis-Tools
Scripts and other material related to OS.X/Crisis malware analysisdiagnostic_service2
OS X rootkit loader version #2calcspace
Small util to calculate available free space in mach-o binaries for code injectionidc-scripts
Random collection of IDA's IDC scriptsDisable-m3u
iTunes plugin to disable creation of m3u playlistsrexthewonderdog
A lazy PoC for implementing backdoors in OS X TrustedBSD Mac framework.fuckyouilfak
A IDA Pro 9.0 Beta 2 macOS x86 Fix Loaderdelambert
GreenLambert macOS IDA plugin to deobfuscate stringsGiveMeHex
A quick IDA hack to get addresses with 0x prefixtwitterwipe
A Go utillty to delete your Twitter historyhow_crap_is_ida
An IDA plugin to compare IDA detected functions output versus LC_FUNCTION_STARTS informationevilquest_stats
Small utility to hash EvilQuest code and cstrings sectionskeygen_CrackMe_nr1_qwertyoruiop
Keygen for qwertyoruiop's CrackMe nr1spiflash
Very fast reader for SPI flashes for Teensy 2.x.bpf_dbg_output
Small tool to convert bpf binary bytecode to bpf_dbg formatevilquest_deobfuscator
EvilQuest/ThiefQuest malware strings decrypter/deobfuscatoricetheguardian
A PoC to protect critical OS X files using TrustedBSD Mac framework.SMBIOSKeygen
macserial and GenSMBIOS merged and ported to Goyage
An age fork with internal Yubikeys supportsnake_queue_parser
A decryptor for Snake/Turla configuration filesMach-O-Lib
Library to access and manipulate Mach-O headersmacserial
macserial Go moduleLove Open Source and this site? Check out how you can help us