Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > General Forum
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 04-19-2004, 10:18 AM
Bra!NSHiT Bra!NSHiT is offline
Junior Member
 
Join Date: Apr 2004
Posts: 1
Default 68K MacOS Emulating and Reversing

Hi,

well i got some experience on PC but now the time has come to lay my hands on MacOS.

Here is my configuration:

- Basilisk II
- MacOS 8.1

I hope thats enough. Its possible to reverse on very old 68K ?? And if 'Yes', which tools i have to use for this stuff ? I googled a while and found some stuff like MacNosy and smth else, but it would be great if u could say smth to this point.

Regards
Reply With Quote
  #2  
Old 04-19-2004, 02:48 PM
kw kw is offline
Administrator
 
Join Date: Dec 2002
Location: The Netherlands
Posts: 116
Send a message via Yahoo to kw
Default

Not sure if I pointed you to this earlier, but http://www.reteam.org/board/viewtopic.php?t=110 would be worth reading through.. Tools like MacNosy are also mentioned there. A good starting point anyway, I can't really help you further, but I'm sure rous has found some info in the meantime, so he would be a good person to share his findings

KW
__________________
"It's people like this that make you realize how little you've accomplished. It is a sobering thought, for instance, that when Mozart was my age, he had been dead for two years." - Tom Lehrer
Reply With Quote
  #3  
Old 05-17-2004, 02:53 AM
rous rous is offline
Member
 
Join Date: Jan 2004
Posts: 38
Default

Yes, I think it is possible to reverse w/ MacOS 8.1 running through an emulator. That OS is quite old, however, and very different than Apple's most current, Unix based, OS 10.3. One must also take into account the differences between the 68K and PowerPC chip architectures. I guess what I'm trying to say is, almost everything you would have to learn in order to reverse applications, using your current setup, is way outdated.

I really don't want to discourage you, however, because I think its great you're attempting something different. I will try to help anyway I can...I can take apart and analyze old apps, I just can't run them.

Having said that...the tools, to which, kw pointed you, are all pretty useless in your case. I do have, however, have other suggestions:

MacsBug-it's Apple's 68K debugger and I hear it was the best...get for free at http://developer.apple.com/tools/debuggers/MacsBug/

Resourcerer-disassembler/hex editor. I've never used MacNosy so I don't know much about it other than it is probably pretty difficult to find. Try Resourcerer, it's better anyway.

Those two apps are all you will need for most programs. I'm not sure, and this is a question I have wondered for quite a while (maybe somebody knows the answer?) how accurate emulators are when disassembling code...I mean, it is difficult even on native systems. Anyway, there are books on assembly I could point you to if you're interested.

Good Luck,
rous
Reply With Quote
  #4  
Old 05-25-2004, 03:22 PM
rous rous is offline
Member
 
Join Date: Jan 2004
Posts: 38
Default

I just found this on Sourceforge.net:

PearPC is an architecture independent PowerPC platform emulator capable of running most PowerPC operating systems. It includes a JITC for x86-Processors.

I don't know if you're still around but this would probably be better for you...
Reply With Quote
  #5  
Old 10-20-2004, 02:22 PM
nrindah0 nrindah0 is offline
Member
 
Join Date: Oct 2004
Location: America's Hat
Posts: 6
Send a message via MSN to nrindah0
Default

I've never even used a mac68k, let alone reversed it, but since I'm a growing IDA Pro fan, might I suggest this to be another tool to add to your arsenal?

Wasn't sure if IDA Pro supported 68k, but it appears to:
http://www.datarescue.com/idabase/gallery/index.htm

You can find the free version of IDA here: http://www.themel.com/idafree.zip
This version is dated and I'm not entirely certain if it supports the 68k architecture, but this is the best place to start.

The newer versions of IDA Pro come with a GUI (unfortunatly the free is console based) which is quite nice, amoungst many other nice features. And although IDA Pro is quite expensive, it's WELL worth the money. I definitely recommend purchasing it if you can.

Of course, you can always find a warez version of it somewhere...
(I'm impartial to this matter).
Reply With Quote
  #6  
Old 10-29-2004, 05:30 AM
rous rous is offline
Member
 
Join Date: Jan 2004
Posts: 38
Default

It's interesting you mention IDA Pro because I finally got the opportunity to play with it the other day...until then, I never really grasped the power ofl an interactive dissassembler. For instance, imagine my surprise when I noticed it immediately matched strings back to their caller functions. Normally, I would set GDB or Codewarrior, I prefer Codewarrior, to break on the instruction that fetched the string, then read the contents of the corresponding register. If many strings are fetched, this becomes a tedious task indeed.

Anyway, I installed IDA Pro 4.3 Advanced on my girlfriends PC. I must use the "advanced" version because the "standard" version does not include the mach-o powerpc plugins. Her P4 took forever, even taking into account it only has 64MB of RAM, to disassemble my test binary...something like a half-hour! I could have already printed the binaries deadlisting, reversed it, and been sipping a Margarita in that amount of time

However, I just got a copy of version 4.7 "standard"--even though I can't do much with it until I am able to get ahold of the powerpc plugins, and plan on preforming my experiment again as soon as I am able.

rous

ps-its really late (early?) here so please excuse my English.

pps-I actually pay for any app, which I find useful.

Good night
rous
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2022, Jelsoft Enterprises Ltd.