Reverse engineering Apple's OS X

A number of folks have asked me what tools and techniques I use to reverse engineer Cocoa executables. I thought it would be worth taking some time out from documenting undocumented APIs to show you how easy it is to do the same thing for yourself. My number-one favorite tool is class-dump, a command-line utility written …

[Anonymous Coward]

Thinking braindead

I remember having to do that "call the next address" crap in the early 80's. Good to see Intel has made such great leaps forward (no pun intended) in it's crappy instruction set.

[Adrian Esdaile]

*cough* Excuse me?

"techniques I use to reverse engineer Cocoa executables"

Er, isn't that like, COMPLETELY forbidden under the DCMA? I seem to recall Apple have very little sense of humour when it comes to reverse engineering their software.

What next, 'How to write keyloggers for OSX?'

Come to think of it, carry on!

[Stephen]

@Adrian

Don't forget the Reg is a UK site, the rest of the world doesn't have to abide by the DMCA. (Sound of RIAA/MPAA going 'curses!' in the background)...

[Anonymous Coward]

WTF CARES!!

Reverse engineering OS/X? What the hell for? As a software engineer, understanding the internals of Windows or Linux or Solaris kernels.. yes. Makes sense. But OS/X!? Have. You. Lost. Your. Friggen. Mind? You desperately need to either install an online FPS/RPG, or get a GF, to help while away your spare time.

Mine is the one with the spare o/s flame thrower fuel cells in the pockets.

[Anonymous Coward]

haha

"Er, isn't that like, COMPLETELY forbidden under the DCMA?"

You know you are on the theregister.CO.UK right?

As in , in england, not america, as much as they like to think so , there laws do not apply here.

[Paul Langlais]

F-Script Anywhere

Reverse engineering Cocoa apps is also immensely facilitated by F-Script Anywhere (http://www.fscript.org). It lets you look at the Objective-C objects inside applications and even manipulate them directly (rewire them, invoke methods, and generally mess around).

[Eddie Edwards]

@ braindead

No, Robert, Intel are still using the exact same instruction set. Didn't you know? They do it on purpose to ensure something called "backward compatibility". As as result, it's something of an industry standard these days.

Granted, it's the worst instruction set ever designed, and a massive chunk of every x86 CPU is dedicated just to decoding it. But are we really still bitching about it in 2009?!

You're not even bitching about the right things! You can write code with EIGHT REGISTERS but you have trouble doing a call-and-pop?

[Ken Hagan]

Re: *cough* Excuse me?

I can't speak for Apple, but Microsoft ship the tools to disassemble code as part of the OS, and provide a GUI interface to them as part of the compiler product, supported by symbol files downloadable over the internet from MS servers. These *tools* are the bread and butter for programmers at this level, and Microsoft understand that if you aren't nice to your developers then they don't write apps for your platform.

As for the legality, reverse engineering was (perhaps still is) specifically permitted under EU law for the purposes of producing a product that works with another (rather than competing with it). The DMCA is not the only law in town, and most other laws are considerably less brain-dead.

[Dave Jewell]

RE: *cough* Excuse me?

Ken Hagan said:

"As for the legality, reverse engineering was (perhaps still is) specifically permitted under EU law for the purposes of producing a product that works with another (rather than competing with it). The DMCA is not the only law in town, and most other laws are considerably less brain-dead."

Absolutely. The main reason I ever reverse engineer Apple stuff is for the purposes of interoperability. And as other have pointed out, the DCMA doesn't apply in dear old Blighty....

:-))

Dave