re-mac-app

name

re-mac-app

description

macOS application reverse engineering and binary patching. Use when the user needs to: reverse engineer a macOS app to understand its internal logic, disable nagware/popups/trial restrictions in a macOS application, bypass license checks or enable licensed features via binary patching, analyze a Mach-O executable with disassemblers (otool/otx) and GDB/LLDB, patch x86_64 Mach-O binaries with hex edits, or apply the black-box methodology for macOS app exploitation in CTF or security research.

macOS App Reverse Engineering

Black-box methodology for reverse engineering and patching macOS Mach-O binaries. Core principle: observe behavior -> form hypothesis -> locate in binary -> verify with debugger -> patch.

Workflow

Phase 1: Behavioral Analysis

Before touching the binary, map the app's behavior:

1. Use the app normally — note when restrictions/checks trigger
2. Identify patterns: frequency, triggers (specific actions, timer intervals?)
3. Formulate a hypothesis about the internal logic as pseudocode
4. Determine: does the restricted feature depend on the check's return value, or are they independent?

Key questions:

• Licensed vs trial differences?
• Enable features or disable annoyances?
• How does the app know if licensed? (crypto/offline vs login/online)
• When does it check? (startup, specific actions, periodically?)

Reference: references/methodology.md for detailed black-box analysis framework.

Phase 2: Architecture & Symbols

Locate the binary inside the .app bundle:

cd AppName.app/Contents/MacOS/
file "AppName"              # Determine arch (x86_64, arm64, fat)
nm -arch x86_64 "AppName" > symbols.txt
grep -i "<keyword>" symbols.txt   # Search for license/nag/trial functions

Look for method names suggesting the target behavior: show_license, maybe_nag, check_trial, time_since_*, register_*.

Reference: references/toolchain.md for complete tool reference.

Phase 3: Disassembly

Use otx (enhanced disassembler) — provides more context than Apple's otool:

otx "AppName" > disasm.txt
grep -A 50 "candidate_function" disasm.txt

If otx is not installed or broken (pre-built binaries lack x86_64 support), build from source:

git clone [e-mail]:darwin/otx.git && cd otx
# Build "otx cli" scheme via Xcode or xcodebuild
sudo mv ~/otx /usr/local/bin/

Find the candidate function calls and note the hex bytes at the call site for patching.

Reference: references/toolchain.md for otx build steps and Mavericks fix.

Phase 4: Dynamic Verification (GDB/LLDB)

Confirm your candidate functions are actually called:

gdb "AppName"
(gdb) break maybe_nag_prompt
(gdb) run
# Trigger the nagware — breakpoint should hit
(gdb) backtrace   # See call chain
(gdb) continue    # Verify it only fires when expected

Key GDB commands: break, run, continue, next, stepi, backtrace, info registers, disassemble, x/10i $rip, print $rax, set $rax=N.

Phase 5: Binary Patching

Once confirmed, patch the binary. Find the call instruction bytes from otx output and modify:

Goal	Original	Patched Bytes	Notes
Skip function call	e8 XX XX XX XX (5B call)	90 90 90 90 90	NOP out the call
Force return true	function prologue	b8 01 00 00 00 c3	mov eax,1; ret
Force return false	function prologue	31 c0 c3	xor eax,eax; ret
Invert condition	74 XX (je)	75 XX (jne)	Swap jump condition
Always jump	74 XX (je)	eb XX (jmp)	Force unconditional

Workflow:

cp "AppName" "AppName.bak"           # ALWAYS backup
# Use Hex Fiend (GUI) or xxd (CLI) or scripts/patch_binary.py
python3 scripts/patch_binary.py "AppName" 0xOFFSET orig_hex new_hex
# Verify
otx "AppName" | grep -A 5 "0xOFFSET"
# Test the patched app

Reference: references/patching.md for complete patching patterns, x86_64 opcode reference, and verification checklist.

Bundled Scripts

• scripts/extract_symbols.sh <binary> [search] — Dump and search Mach-O symbol table
• scripts/patch_binary.py <binary> <offset> <orig_hex> <new_hex> — Hex patch a Mach-O binary at file offset

References

Load as needed based on task:

• references/methodology.md — Black-box analysis framework, key questions, pseudocode patterns
• references/toolchain.md — Full tool reference (file, nm, otool, otx, GDB, hex editors) with setup steps
• references/patching.md — Binary patching guide with x86_64 opcode reference, common patch patterns, Python patching script template