July 2007 - Darwin-dev - lists.apple.com

Problem while trying to Debug Kernel Panic with GDB using Two Mac's
by Jani P 06 Jul '07

06 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=hbCVJhycVumjMHiNKPYY5Y3ar0eavWOKwNOxDfK5shmCDHcMrRllqUODEOd5D3n7zDH6csIgriUwwPzKuBS1NLFlYmQ39F3u7fABpIEp6PHbavxTaUNpkp2h6wGo+ZNhqOBgJVIxbt+YIrqpg2tkeN9iRBOEv5vAk3HNo7CasJQ= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=k0wzta/7gIo1FNYYeFjveesEDrJaJ645oPQht4Awg7LeHkHY9bE4/RArjycxxG+E5rt08gFisPWsXmTzhkIyyxEuW7Cj9ia8wr+rY+Bisr0vu6i45VRzQrP2CZ1Ne0RI6Cuk03l5w9byCrR5RJ8fs7rWxvsC9cb/BNoTMkvufyU= Hi ALL, I've a kernel extensions which does some vnode operations , which is crashing in the middle . So googled it and found a nice article on debugging kext @ apple developer site (http://developer.apple.com/documentation/Darwin/Conceptual/KEXTConcept/KEXT…) I've setup the two mac machines and facing an issue whil following the step -- On Target Machine, Break into Kernel Debugging Mode. I've tried to press the Power button for 3 secs and tried various alternatives specified, even then my Target Machine is not breaking into Kernel Debug Mode. Please help me to solve this. Thanks in Advacnce. -JanakiRam. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: dup2() Problem
by Justin C. Walker 06 Jul '07

06 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Jul 5, 2007, at 18:10 , Norm Green wrote: Hi, After the fork I do: int logfd = open(logName, O_WRONLY|O_APPEND|O_CREAT, 0644); dup2(logfd, STDOUT_FILENO); Justin -- Justin C. Walker, Curmudgeon-At-Large Institute for the Enhancement of the Director's Income -------- When LuteFisk is outlawed, Only outlaws will have LuteFisk -------- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… I'm having a problem on Darwin i386 using dup2() in a child process. This is after a fork() call but before execve() call. The open() call succeeds but the dup2() call always fails with errno=9, which suggests one of the args is not an open fd. I'm sure I'm not closing either in my code. I think errno == 9 suggests that one of the values is bad, not that one of the file descriptors is closed. The man page implies that 'newd' may be open or closed before the dup2() call. Have you really checked the value of each argument? This email sent to site_archiver(a)lists.apple.com

1 0

dup2() Problem
by Norm Green 06 Jul '07

06 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Code Obfuscation
by Conrad G T Yoder 05 Jul '07

05 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: Ace/Tr/T/m/OjCtBEdyTNgARJHiCXA== Thread-topic: Code Obfuscation User-agent: Microsoft-Entourage/11.3.3.061214 At 7/5/07 4:50 PM -0400, Thomas Inskip <tinskip(a)gmail.com> wrote: > > True, but even encryption is little more than security though > obscurity if the keys are stored locally. Requesting a key to > decrypt the code via some key exchange mechanism with a remote host > is unfortunately not an option in the case I am looking at. I think you're mixing up "binary executable encryption" and "code obfuscation" here. As mentioned, the encryption comes in when a key is required to decrypt it. Obfuscation is, e.g., source code with variable names changed to meaningless identifiers, so as to obfuscate the intent of the code, while still being able to compile it. This is not uncommon when, say, you discover a compiler bug and your source code is your intellectual property, and you don't want it to be compromised, but you still want to give the compiler makers a test case. I wrote a nice little C obfuscator in perl many years ago - not hard to do. > The purpose here is really to make it just painful enough to > discourage reverse engineering. Reverse-engineering any moderately sized binary is quite painful in and of itself. -Conrad -- Happiness - We're all in it together! _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Code Obfuscation
by Amanda Walker 05 Jul '07

05 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Amanda Walker _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Jul 5, 2007, at 4:20 PM, Terry Lambert wrote: On Jul 3, 2007, at 11:26 AM, Thomas Inskip wrote: This may be slightly off topic, but does anyone know of any object code obfuscators which will work with mach-o binaries (PPC and x86)? I've looked around but haven't had much luck. The only product even remotely related I've been able to find is a C/C++ source code obfuscator from stunnix (http://stunnix.com/prod/cxxo/ overview.shtml), which I assume won't much good in terms obfuscating the generated object code. You should be aware that information theory dictates that all unencrypted, obfuscated object code can be deobfuscated via static analysis; this is probably not worth your time to pursue. Sure. But economic theory dictates that the customer is always right--and if they want to pay for a feature, that can make it worthwhile to pursue. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Code Obfuscation
by Thomas Inskip 05 Jul '07

05 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer; b=CyJ0RU2u+Dc89UwNUEPYXzJcdyFSApb2+D55i5OvrxaNwLfYzu+pHh9Mzf1AuRJovlcLhoO8JPYVRjthfwxi1M9t+F78U6qtdyWZD2+JskFW98M1O/0LyPv/n5RCJNpOxSbpQo3oXXHPqKdryrm1lH2OGjUrCjvnOXGW3p3dSxs= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer; b=CThDzDlQiZbK3a+cWi8NgKlea27pzeboVJv3ZhXquwdWiVPgjY6JXrHxeIzl5z5H9A1JilQJzEb8XV1hK+x6GgjNEvrSey2Ik7LazqBHPMuzaCpVTqpCvPBvAaN/9YglMDrk5gfHyeMPAD/enqm4BPqV/yKWeN0bHfpvX76XnMI= On Jul 5, 2007, at 4:20 PM, Terry Lambert wrote: _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… True, but even encryption is little more than security though obscurity if the keys are stored locally. Requesting a key to decrypt the code via some key exchange mechanism with a remote host is unfortunately not an option in the case I am looking at. The purpose here is really to make it just painful enough to discourage reverse engineering. On Jul 3, 2007, at 11:26 AM, Thomas Inskip wrote: This may be slightly off topic, but does anyone know of any object code obfuscators which will work with mach-o binaries (PPC and x86)? I've looked around but haven't had much luck. The only product even remotely related I've been able to find is a C/C++ source code obfuscator from stunnix (http://stunnix.com/prod/cxxo/ overview.shtml), which I assume won't much good in terms obfuscating the generated object code. You should be aware that information theory dictates that all unencrypted, obfuscated object code can be deobfuscated via static analysis; this is probably not worth your time to pursue. -- Terry This email sent to site_archiver(a)lists.apple.com

1 0

Re: Code Obfuscation
by Thomas Inskip 05 Jul '07

05 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer; b=kUiptry1CYxmdWE10CmiVAQe1dg9KEAgJfPhtHcCxSLRs/b+br9O+JJjuu9Gb9Lz0xh8qladSkBLh99SbSdwJATthQ5MRgjEvEQ2K4QPgaddGfjaKBxXwfW0CoMuJg7oiZgBFW00fWCOZlYf/yC3Lk3TJkkrpr6xKtmTUjH5Q1A= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer; b=Hwg4obngW/wqXWkpHEHRlMcVyTYehcqj/z1UO4EBsxBfGZUdB5tfOQbczMtR12gHMw8MzbgKfkA9bXcaYFh+m/2+xJwII9YuS1QquqhS9aOzJP3hzmyntSZo9RlosEEnoNboeqhnhTiBNkJbCFiLIy7ficxrqzehmSS2fltfXho= On Jul 3, 2007, at 7:48 PM, Dave Keck wrote: Hey, Perhaps you could implement something like this? Dave On Jul 3, 2007, at 2:26 PM, Thomas Inskip wrote: _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Thanks. It looks like I may have to implement something similar. Not trivial, and obviously hackable, but better than nothing. I'm fairly sure this patent is referring to Apple's method of encrypting certain binaries (Finder, Dock, etc.) which can "only" (I think it's been cracked now?) be decrypted with the "Dont Steal Mac OS X.kext" kernel extension (check out your /System/ Library/Extensions folder). A very nice article on the subject can be found here: http:// www.osxbook.com/book/bonus/chapter7/binaryprotection/ This may be slightly off topic, but does anyone know of any object code obfuscators which will work with mach-o binaries (PPC and x86)? I've looked around but haven't had much luck. The only product even remotely related I've been able to find is a C/C++ source code obfuscator from stunnix (http://stunnix.com/prod/cxxo/ overview.shtml), which I assume won't much good in terms obfuscating the generated object code. Apparently Apple applied for a patent a couple years ago on some object code obfuscation technology (http://www.macsimumnews.com/ index.php/archive/ apple_files_patent_system_and_method_for_creating_tamper_resistant_co de/). But if they've done anything with it, they haven't made it public. Other than the somewhat irrelevant product from stunnix above, I haven't been able to find any other third party commercial or open source technologies. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Code Obfuscation
by Terry Lambert 05 Jul '07

05 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Jul 3, 2007, at 11:26 AM, Thomas Inskip wrote: This may be slightly off topic, but does anyone know of any object code obfuscators which will work with mach-o binaries (PPC and x86)? I've looked around but haven't had much luck. The only product even remotely related I've been able to find is a C/C++ source code obfuscator from stunnix (http://stunnix.com/prod/cxxo/overview.shtml ), which I assume won't much good in terms obfuscating the generated object code. You should be aware that information theory dictates that all unencrypted, obfuscated object code can be deobfuscated via static analysis; this is probably not worth your time to pursue. This email sent to site_archiver(a)lists.apple.com

1 0

Re: malloc causing vm_allocate errors
by Omar Awile 04 Jul '07

04 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=VhrAvT2XEjNZXEcZKdvpZhfKHbXoJVxKJ7LQQUngPqhAQISzOSO+Jj8HIEJhr3keI2gv5X5bOyNmdcUo4Nqkf2TYfng9EgUCmjioVSYyqzxJ0rsPkVfAepuHZ+dOZepYu4OicoU93cWpdgRu72Mb3n7FIyhIl0b9+DzrUkXb8P4= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=jjaXauCaZrVI8LYz1mjYZ2VLWjrIGdni84Htgpp06aw09HIN6b54EpOWAPsMJBlTdtIWSVJ1HcBmvtOUpwfalk3QD6cG4yy5HcbNrZ/47JewFoGtRL3sWXpQG6ea3OH7SbEbrbH2zzOri9M4/2O0OtlrRm2W+YUShgFS59YYKSM= Boaah.. I feel so silly.. I compiled it as 64 bit code (on my linux system 64 bit is probably the default setting for the used compilers) on darwin and it works!!! I always thought that at least gcc had this somewhere in its default settings. Thanks a lot.. So I guess the explenation is that it used more virtual memory than can be addressed in 32 bit mode (at least on that system). using 64 bit addressing resolves that issue of course... Thanks again omar On 04 Jul 2007, at 18:12, Omar Awile wrote: > 'top' is telling me about VM: > VM: 3.90G + 7.19M 141826(0) pageins, 0(0) pageouts > (my program is not running) > So this means there should be by far enough memory around. Those statistics are irrelevant. Every app gets its own VM space. If your program is 64 bit clean, you can of course also always recompile it as a 64 bit binary. > I was not yet able to check with vmmap (or malloc_history) because my > program spits out these error messages after a very short time and > crashes right after. "man malloc" also describes a number of environment variables you can set. Jonas _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/omar.awile%40gmail.com This email sent to omar.awile(a)gmail.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On 7/4/07, Jonas Maebe <jonas.maebe(a)elis.ugent.be> wrote: This email sent to site_archiver(a)lists.apple.com

1 0

Re: malloc causing vm_allocate errors
by Jonas Maebe 04 Jul '07

04 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On 04 Jul 2007, at 18:12, Omar Awile wrote: 'top' is telling me about VM: VM: 3.90G + 7.19M 141826(0) pageins, 0(0) pageouts (my program is not running) So this means there should be by far enough memory around. I was not yet able to check with vmmap (or malloc_history) because my program spits out these error messages after a very short time and crashes right after. Jonas _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Those statistics are irrelevant. Every app gets its own VM space. If your program is 64 bit clean, you can of course also always recompile it as a 64 bit binary. "man malloc" also describes a number of environment variables you can set. This email sent to site_archiver(a)lists.apple.com

1 0