Comments on: 3 Easy Tips to Prevent a Binary Crack

By: Mecki

Mecki — Thu, 17 Jul 2008 12:06:20 +0000

Codesigning buys you nothing! If the binary is modified, the signature becomes invalid… that’s it. That’s all that happens. It won’t have any effect other than that. Who cares for an invalid signature? Apps with invalid sig will run just fine!!! And almost nobody understood the KILL flag. An app with invalid sig will run just fine, even with KILL flag. The KILL flag only means it will be killed if the running app in memory somehow loses its identity (e.g. it would be killed if a process was modifying the app in memory), but it will still start when modifying it on disk (try it, if you don’t believe me).

Apple has no plans to change that either! They say “Why would we want to do this? A hacker could just patch your app and then resign it with his own signature and it will have a valid sig again. Okay, you could write code that checks if the signature is valid *AND* if the signature is signed by your cert, but the hacker could just replace this piece of code, too”

By: ctwise

ctwise — Mon, 30 Jun 2008 12:55:04 +0000

PT_DENY_ATTACH doesn’t work to stop hackers. The people who want to hack your code will have the knowledge and know-how to load the kext. The only people who will be affected by the PT_DENY_ATTACH will be the people who have a legitimate desire to understand their systems and incorrect behaviors that they are trying to track down. Those people will be forced to either uninstall your application, live with the problems or install a kext they don’t actually want or need in order to solve their issues. In other words, PT_DENY_ATTACH doesn’t stop hackers and pisses off some of your customers.

Sign your code instead. Use techniques and tools that obfuscate and encrypt your code. Just don’t make the system opaque to understanding. That path takes us back to Windows.

By: Jerry Krinock

Jerry Krinock — Sun, 29 Jun 2008 12:41:55 +0000

Ah, Kevin, you are correct. Being an Xcode GUI user, I missed the tiny letter ‘r’ in your article. Also, I was fooled by the fact that when I run gdb it does that “Reading symbols for shared libraries ++++++” twice, both before and after I ‘run’. Oh, well.

So, I re-ran the test, typed ‘r’ and got an 055 exit. Then I unzipped an old version of my app which was not compiled with the call to ptrace PT_DENY_ATTACH, attached to it, typed ‘r’, and gdb continued to work. So, I take back what I said yesterday.

Thanks, Kenneth.

Also, regarding the original comment by ctwise, I don’t believe that the “makes…impossible” applies to your machine. #ifdef DEBUG, everything is back to normal. Regarding the workaround, of course, if one hacks the system, anything is possible. PT_DENY_ATTACH just sets up another hurdle for some hacker who may be seriously thinking of not drinking another Coke and going to bed instead.

By: kenneth

kenneth — Sun, 29 Jun 2008 08:37:24 +0000

Jerry, I just emailed you the .app.

Note that gdb still loads, but won’t let you run. So if you load gdb with the executable, it will work, read symbols and everything. However, it’s when you “run” that the app exits with code 055 every time.

By: Jerry Krinock

Jerry Krinock — Sun, 29 Jun 2008 05:59:46 +0000

I tried this but gdb still attached. Maybe it’s because I’m using Xcode 3.0, with an earlier version of gdb than you have?

GNU gdb 6.3.50-20050815 (Apple version gdb-768) (Tue Oct 2 04:07:49 UTC 2007)

I’m pretty sure I did it correctly. To make sure that the #ifdef was working (actually I used #ifndef), I logged a compiler #warning just above the call to ptrace(), and it did log. If you send me, or post, your ProtectionSample, I’ll see if my gdb can attach to it.

By: scrod

scrod — Fri, 27 Jun 2008 21:44:23 +0000

When running on leopard you can use code signing and force a static validation of your app at launch time or set the KILL flag and wait for it to become dynamically invalid as resources and pieces of the executable are paged-in. This will be less work and significantly more thorough than implementing your own system from the ground up.

By: ctwise

ctwise — Fri, 27 Jun 2008 11:24:34 +0000

Please avoid PT_DENY_ATTACH. Not only is it easily circumventable (http://landonf.bikemonkey.org/code/macosx/Leopard_PT_DENY_ATTACH.20080122.html) but it makes monitoring and understanding YOUR OWN MACHINE impossible.