1. Reverse Engineering OS X
drivers
Egor Fedoseev
May 21, 2014
PHDays, Moscow

2. ● OS X market share grows over the time
● Kernel-land malware is scary
● Porting drivers, of course
Why do we need that

3. About presentation
#OSX, #C++, #IDA, #DWARF, #Python
Not exactly a rocket science. I just didn’t see
a simple OS X driver reverse engineering
tutorial yet.

4. About presentation
● OS X kernel overview
● Drivers overview
● Reverse engineering a driver, facing
problems
● Solving problems

5. ● Hybrid XNU kernel (Mach + BSD + IOKit)
● Microkernel Mach
● BSD for unixness (POSIX, process model,
network stack, access conrol, filesystems,
etc.)
● IOKit for drivers
OS X kernel

6. ● C++ subset
● Multithreaded
● Power management, driver management,
driver layering, driver interface
● Drivers, families, nubs
● Registry & Catalog
● Classes hierarchy
IO Kit

8. Kernel extensions
● /System/Library/Extensions
● /Library/Extensions (codesigned)
● Application bundle:
Contents/Info.plist
Contents/MacOS/
Contents/PlugIns
● Ordinary Mach-O file

9. Reverse engineering a driver
● http://opensource.apple.com/
● IDA
● Hopper
● kextstat, kextlibs, kextutil
● otool
● dwarfdump
● ...

10. ● 10.9+ — x86-64 only
● Any IDA prior to 6.5 fails to parse
relocations
● Heavily C++ — fields and virtual methods
Problems

11. What can we do?
● Fix relocations
● Parse VMTs to get class structures
● Process dependencies
● Kernel type library

12. Relocations
● No comprehensive Python library to parse
Mach-O files
● Look for LC_SYMTAB, LC_DYSYMTAB
● Hopper and otool handles relocations just
fine.

13. VMT
● Luckily, vtables are exported symbols
● Process relocations, look for ‘_ZVT’
● Easy way to import is to serialize data into
C header file

14. Dependencies
● kext/Contents/Info.plist
● com.apple.kpi -> look in mach_kernel
● otherwise look in
/System/Library/Extensions
/Library/Extensions

15. Kernel type library
● IDA has a way to store reusable type
information — TIL
● SDK utility tilib fails to parse C++ code
● dwarf2c fails to parse C++ code
● Probably the easiest way is to parse DWARF
● DWARF parser from elftools package is good

16. Useful links
● http://opensource.apple.com/
● http://reverse.put.as/
● https://developer.apple.com/library/
● python macholib
● python elftools
● python dwarf2c

17. That's all
github.com/binchewer
domi@hackerdom.ru