October 2010 - Darwin-dev - lists.apple.com

How to decrypt files?
by lists＠ianblake.me.uk 05 Oct '10

05 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Pipex Webmail (IMP3.1) I have been given the task of creating a program to filter files and decrypt encrypted files. On MS Windows I would implement this as a file system filter driver. This option does not seem to be available at present. How can I implement file filtering on MAC OS X? My colleague suggests I try to use dylib interposition using something like the Mach_Override hack this seems to me a little improper. I would aim to interpose PBForkRead etc. Any input on how I should be approach this problem would be appreciated. I am confused. -- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Breakpoint Implementation
by Dave Keck 04 Oct '10

04 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:mime-version:received:from:date :message-id:subject:to:content-type; bh=rJHMoGM+6flHCNPR2iGFBQ91jmXm9CgNCUUKi0Get5g=; b=hVwCg6SB6kthCiogKRsq3qFcVUDdPKRjXsnyqHvpW1TNJOJUDR6DpV41hHOtwwjKXU +keEoCoGjbKHx+j13tRaxwlz+ZErznmujvRZUrtovXz7eS09Uc2N899nDUqB2JzVtkHU FHwy+88Gienvg/UhQ4H1PCVTJcracLaxYqkvs= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:from:date:message-id:subject:to:content-type; b=qWwpSdXE2MsumAa4BYFNatKNwN458Gvu9lg7WxpfQ6KNvk7UG9FX2dMIb2tTtSLMXb XO2oap9lWBrc6wkf73C+/ZMEekmQ4gHuBKwo+D0BhMrr3dlrTmDnBmgTGXYEoKRqMD7E bbFGCymeS1q+bAKnPmCAw7Fl7N6+qBymcnsBM= Hey list, I'm implementing breakpoint functionality in a hobby i386 debugger using the INT3 instruction. Let's say Thread 1 hits Breakpoint A: 1. Suspend every thread 2. Restore original instruction that was replaced by INT3 3. In Thread 1, EIP--, let Thread 1 single-step (using EFL_TF flag) 4. Revert instruction back to INT3 5. Resume every thread This technique appears to work as expected, but let's say: 1. Breakpoint A is at the very 'syscall' instruction within pthread_create() that causes Thread B to spawn 2. Thread B will hit Breakpoint A Due to the race between Thread B executing and step #4 completing, couldn't Thread B bypass Breakpoint A? Is there a way to fix this? Thanks very much! David _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Additonal device API
by Robert Bielik 03 Oct '10

03 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; sv-SE; rv:1.9.2.9) Gecko/20100915 Lightning/1.0b2 Thunderbird/3.1.4 Hi all, I'm creating an audio device (virtual) based on IOAudioDevice, but I need to have an extra API towards the device. Which way is best ? Can I use sysctl or is that more suited for kernel components ? TIA /Rob _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Retrieving information about loaded kernel extensions
by Andrew Myrick 01 Oct '10

01 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Retrieving information about loaded kernel extensions
by Alastair Houghton 01 Oct '10

01 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha1; c=relaxed; d=coriolis-systems.com; h= subject:mime-version:content-type:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; s=aug07; bh=1JPSswCrlt0FAYuJz1Do/Vf6Zoc=; b=qb/EVZ27/68kHEYKfQpJjs5PHTR1 OWtzWM12ENmrNoE49UXAhuXIYoR30SrpawIVVSJT0r7+UOIdxAy6/7zV+dUw7LIs pG1hbM/LvL2oHQAYb6/Q+QNBnUT0L2wrY8IBKKBK3mEXc0sagtYoQGC6iVeFCdH5 WIUpTYnaYy0c98M= On 1 Oct 2010, at 14:39, nithesh salian wrote: > However, I have to access the information inside a user level application. How can i do that? Are there any interfaces supported in Snow leopard. On 29 Sep 2010, at 14:24, Alexander von Below wrote: > kextstat 8 > > I would just pipe and parse that. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ This is a very sensible answer to that exact question. Kind regards, Alastair. -- http://alastairs-place.net _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Retrieving information about loaded kernel extensions
by nithesh salian 01 Oct '10

01 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=0cAtdIeAexNFyVqGeN9mwjEJ1nN9dcvu9PMhvhBlieI=; b=JHRIvX0uZVE8kCJ9cizOkjkPLz94rB9fUVKUxnlaxZk2JcCd1v97EGUqjv7+GCYbpd rIDfufduBfxppQwm5XsNijqfTGak2iwwqWtDDV65QbI1J60mAwYyZNcTGHpJtbHG0jGa 0bNtnQVcznPY3qx4wUrXG6fdyGPXqXY0SF+/I= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=mQYEwk2q9ibqneW9XUL+UJRW+GcSAtAwnHFlYQjfua9lV+Nvnm7NpbWYw0c3QNcQXt WJPofO03leFDYqeiQgryoqUZ8/RZsrkLnbpOUxKam7CKjxwRxm9RQnYBTBJt/W1eYXgi GeeBdTckUdUCzybtl8P8dIMsXj9E7FR7+Y/mA= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Retrieving information about loaded kernel extensions
by nithesh salian 01 Oct '10

01 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=stjiEv9kyaQZ0czf1S3cOWtCvZmyiHBs7F2xAZruBi4=; b=H1utX4ZsaR/+q8qSXA4gfqy5dxdZFjsuU8hFxYccJj/W4NLtRPHSRVoCKRA6cCF7oR +WICEt5NpZtIkY+IyxDj5zu2J84ziynjGBKCrSbbaM2yoX7hatz+Ekf20Pq1VzCQmfQ7 usQ4ZniY6BbHXS3hAyXMjl1NMWsjfQpUQVFrc= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=nM//KunhOI3FklECms0zD4/eJSbrPpbhnN01qsa066dTmqZWyMjvnLfgPW22rM+fT9 hdmO77Oyk5oAbkNgcHw60POUl5pcgJeqsmFCxmYo+ob0MJuvdQIib385iSkPID8oNHY7 Fc/GH4wq9OHA1XdgtUMNT0IgT6PuA4S1xKwsc= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0