yhs0602 / osx_runbin

#Running Executables on macOS from Memory

This is the code repo for the blog post located .

##symbolyzer.py

symbolyzer.py is used for generating unique offsets / ints for a list of symbols to use for matching in place of a hash algorithm. It can be run in the following manner to do so for dyld:

$ nm /usr/lib/dyld | cut -d" " -f3 | sort | uniq | python symbolyzer.py

The output is in the following format:

$ _sysctlbyname[4] = 0x626c7463

This means that if you read an int from the start of the string table entry + 4 and get 0x626c7463, you have found the entry for sysctlbyname.

##run_bin.c

run_bin.c is the proof-of-concept code for running a binary from memory. It can be run as follows:

$ gcc run_bin.c && ./a.out /bin/ls