Search This Blog

Thursday, September 21, 2017

Rewriting IDAPython Script objc2_xrefs_helper.py for Hopper

Security researchers have identified more and more Mac OS malware attacks over the past two years. In June 2017, Rommel Joven and Wayne Chin Yick Low from Fortinet’s Fortiguard Labs found and analyzed a new ransomware targeted at Mac OS.  Most malware for Mac OS was developed in the Objective-C programming language. A good introduction to reverse engineering Cocoa applications can be found here. In that blog post, the researcher released an IDAPython script named objc2_xrefs_helper.py  that can only be executed in IDA Pro. As you know, IDA Pro is the gold standard for disassemblers. However, IDA Pro Licenses start at $1409 (you can refer to that here). So this can be extremely cost prohibitive for many people.  One good alternative is the Hopper Disassembler for Mac OS. A Hopper Disassembler v4 Personal License is only $99.00.

https://blog.fortinet.com/2017/09/19/rewriting-idapython-script-objc2-xrefs-helper-py-for-hopper

No comments:

Post a Comment

Note: Only a member of this blog may post a comment.