![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1WkAAnjAbQ4s1sD58ZAcpcGJ93rGk_-nxrxxEpMfojbA07Kl1QdU3yVKW-r8KGBZ0K7CtZnZWuRhr3YAr7sljzhDqVbVE0wHw_iUu3gs83cw8-NVKzmQge0TwkQaJf1G0PY-XvQ/s320/Picture+5.png)
This would not do. Not knowing anything about the anti-debugging capabilities of iTunes I decided the best way (and the laziest way) for a programmer to try and keep me from debugging is ptrace. I set a breakpoint on ptrace and tried it again. I got a nibble. I typed return, and then let iTunes continue on its way. It worked somewhat: it would continue but I was prompted over and over again to complete the same task and if I deleted the breakpoint iTunes would exit. I decided to modify ptrace to return immediately. I did so with the following command:
set *(int)ptrace = 0xc3
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9dkvf7EMV5sZwrFrbOYfRvVC7WxClSCAeTzTHXLCjgmIjybaUpGODn7rrqyi4qfB-YxY7rQice7JKM49Z3bVvhUbr1vfx-SQZafFmz2JVTqxInMWZ1QxC2bLK3OyfggUQPBe9Yg/s320/Picture+6.png)
0xc3 translated to ret. After I did this I deleted the breakpoint and let iTunes go about its normal activity, or as 50cent would say, “sit back and let the money pile up.”
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEib4eQmmCqcQd6SU31iWS9JUy2r9ymypZ1VU-QtEGR9qotu4z4ehMeEVVwbm_oTQx0UILgsp0Rowko8C5DBR4FH35FVGC1NRvUDJqOLiccfcis1H1IPYir8ujG2JzCHsL9HVqCDRw/s320/Picture+1.png)
B00m, we have a crash.
Now I can examine the information from the crash and work on how exploitable the problem is. The exploitability is a post for another day; I just thought some folks could use a nifty trick if they found themselves in a jam.
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8wlE6cojL3SMTrX0PAUPcUzrefatujjxgnRKW5Ml5Gsx5_fgOKuJUofZBNaQ0ZpSTllWisrbf3hAzOeyQA0eZM6qN_U-E28H7McvKSfM-SraJo8vKC25x6dGa1M0yNgXmI9kVnw/s320/Picture+4.png)
(This post was written to 50cents “How to rob.” Also I typed some commands in gdb that produced errors becasue my regular alias file was not loaded.)
1 comment:
You had nothing better to do than run a debugger?!? Dude, you could have just called me @ $5 a minute and had a chat. :)
Holla back!
Post a Comment