Under the iHood
Learn where OS X binaries hide useful metadata and how to read it during reverse engineering.
Summary
Architecture and Background
DEF CON 16 - Cameron Hotchkies: Under the iHood The market share for Apple devices has grown considerably over the past few years, but most reverse engineering topics still focus on Microsoft platforms. This talk will outline what is necessary to begin reversing software on OS X.
Vulnerability Analysis
This will include a rundown of the tools available to an apple based researcher, how Objective-C works and what it looks like in a binary, the basics of the Mach-O file format including the undocumented _OBJC section and comparisons of Windows applications and the OS X counterparts. Cameron Hotchkies has been a vulnerability researcher for TippingPoint's DVLabs since 2005.
Exploitation and Demonstrations
His day to day tasks include verification and analysis of Zero Day Initiative submissions, internal product security audits and a whole lot of reverse engineering. Prior to this he created the Absinthe/SQueaL automated SQL injection engine.
Remediation and Defensive Strategies
He doesn't do web stuff anymore. Just reverse engineering. He holds a Bachelor's Degree in Software Engineering from McMaster University. For copies of the slides and additional materials please see the DEF CON 16 Archive here:
Related talks
Main Stage·1 hr 54 min
Workshop
Workshop details workshop: Davix Workshop Need help understanding your gigabytes of application logs or network captures.
Main Stage·41 min
Weasel
Weasel details weasel: Compliance: The Enterprise Vulnerability Roadmap Compliance is no longer new.
Main Stage·48 min
Valsmith · Colin Ames
Valsmith and Colin Ames explores metapost-exploitation at DEF CON 16, examining emergency-systems and practical defenses.