Reverse Engineering Cocoa Applications

Introduction to Reverse Engineering Cocoa Applications

While not as normal as Windows malware, there has been a constant flow of malware found throughout the years that keeps running on the OS X working framework, now rebranded as macOS. February saw three especially intriguing distributions on the subject of macOS malware: a Trojan Cocoa application that sends framework data including keychain information back to the assailant, a macOS variant of APT28's Xagent malware, and another Trojan ransomware.

In this blog, the FLARE group might want to present two little apparatuses that can help in the undertaking of figuring out Cocoa applications for macOS. Keeping in mind the end goal to appropriately present these apparatuses, we will lay a touch of establishment initially to acquaint the peruser with some Apple-particular subjects. In particular, we will clarify how the Objective-C runtime confounds code examination in instruments, for example, IDA Pro, and how to discover valuable passage focuses into a Cocoa application's code where you can start investigation.

On the off chance that you discover these themes intriguing or in the event that you need to be better arranged to examine macOS malware in your own particular condition, come go along with us for a two-day brief training on this subject we will instruct at Black Hat Asia and Black Hat USA this year.

Cocoa Application Anatomy

When we utilize the expression "Cocoa application", we are alluding to an application that is fabricated utilizing the AppKit system, which has a place with what Apple alludes to as the Cocoa Application Layer. In macOS, applications are dispersed in an application package, an index structure made to show up as a solitary document containing executable code and its related assets, as delineated in Figure 1.

Figure 1

These packs can contain a wide range of records, yet all groups must contain no less than two basic documents: Info.plist and an executable document dwelling in the MacOS envelope. The executable record can be any document with execute authorizations, even a python or shell content, however it is commonly a local executable. Mach-O is the local executable document organize for macOS and iOS. The Info.plist document depicts the application package, containing basic data the OS needs keeping in mind the end goal to legitimately stack it. Plist documents can be in one of three conceivable arrangements: XML, JSON, or a restrictive paired organization called bplist. A helpful utility named plutil is accessible in macOS that enables you to change over between positions, or just lovely print a plist record paying little respect to its configuration. The most outstanding key in the Info.plist document is the CFBundleExecutable key, which assigns the name of the executable in the MacOS organizer that will be executed. Figure 2 demonstrates a bit of the beautiful printed yield from plutil for the iTerm application's Info.plist record.

Figure2:snippet from iTerm application’s Info.plist file

Objective-C

Cocoa applications are normally composed in Objective-C or Swift. Quick, the more current of the two dialects, has been rapidly making up for lost time to Objective-C in ubiquity and seems to have surpassed it. Regardless of this, Objective-C has numerous years over Swift, which implies the larger part of vindictive Cocoa applications you will keep running into will be composed in Objective-C for now. Also, more established Objective-C APIs have a tendency to be experienced amid malware examination. This can be because of the age of the malware or with the end goal of in reverse similarity. Objective-C is a dynamic and intelligent programming dialect and runtime. Approximately 10 years back, Objective-C variant 2.0 was discharged, which included real changes to both the dialect and the runtime. Where subtle elements are concerned, this blog is alluding to adaptation 2.0.

Projects written in Objective-C are changed into C as a component of the aggregation procedure, making it no less than a to some degree agreeable progress for most figures out. One of the greatest obstacles to such a progress comes in how techniques are brought in Objective-C. Objective-C strategies are theoretically like C capacities; they are a unit of code that plays out a particular undertaking, alternatively taking in parameters and restoring an esteem. Be that as it may, because of the dynamic idea of Objective-C, strategies are not regularly called straightforwardly. Rather, a message is sent to the objective protest. The name of a technique is known as a selector, while the genuine capacity that is executed is called a usage. The message determines a reference to the selector that will be summoned alongside any strategy parameters. This takes into consideration highlights like "strategy swizzling," in which an application can change the usage for a given selector. The most widely recognized path in which messages are sent inside Objective-C applications is the objc_msgSend work. Figure 3 gives a little bit of Objective-C code that opens a URL in your program. Figure 4 demonstrates this same code spoke to in C.