Understanding and Defending Against Reflective Code Loading on macOS

Introduction

Executing Mach-Os In-Memory

Loading Mach-Os In-Memory with macOS API

Calling a Function

NSObjectFileImageReturnCode NSCreateObjectFileImageFromMemory(
const void* address,
size_t size,
NSObjectFileImage *objectFileImage
);
NSModule NSLinkModule(
NSObjectFileImage objectFileImage,
const char* moduleName,
uint32_t options
);
NSSymbol NSLookupSymbolInModule(
NSModule module,
const char* symbolName
);
void* NSAddressOfSymbol(
NSSymbol symbol
);

Executing the Entry Point of a Binary

Cleaning Up

bool NSUnLinkModule(
NSModule module,
uint32_t options
);
bool NSDestroyObjectFileImage(
NSObjectFileImage objectFileImage
);

Further Operationalizing

Handling Universal Binaries

Thin vs Fat Mach-Os

Retrieving stdout/stderr Using Inter-Process Communication (IPC)

Preventing In-Memory Mach-O From Exiting

SwiftInMemoryLoading

Executing `ifconfig` and `SwiftBelt` with Arguments In-Memory

Reflective Code Loading: Big Sur vs Monterey

Segmentation Faults on Monterey

Checking OS Version
Right Shift if Monterey is Detected

“In-Memory”?

Big Sur Using dyld-852
NSLinkModule() Temporarily Writes In-Memory File to Disc
No File Creations from FileMonitor on Big Sur
Hitting Breakpoint in lldb on Big Sur
dyld Loaded Within Hopper
Monterey Using dyld-955
slyd0g-dev@slyd0g-devs-Mac Downloads % lldb SwiftInMemoryLoading -- /sbin/ping -c3 google.com(lldb) target create "SwiftInMemoryLoading"Current executable set to '/Users/slyd0g-dev/Downloads/SwiftInMemoryLoading' (x86_64).(lldb) settings set -- target.run-args  "/sbin/ping" "-c3" "google.com"(lldb) b NSLinkModuleBreakpoint 1: where = libdyld.dylib`NSLinkModule, address = 0x00007ff80032cd87(lldb) rProcess 631 launched: '/Users/slyd0g-dev/Downloads/SwiftInMemoryLoading' (x86_64)[+] Named pipe created successfully at /private/tmp/1E09F7A1-DE07-43F7-AA0D-E2F47E2099FE[+] Waiting for a client to write ...Process 631 stopped* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1frame #0: 0x00007ff805c74d87 libdyld.dylib`NSLinkModulelibdyld.dylib`NSLinkModule:->  0x7ff805c74d87 <+0>: pushq  %rbp0x7ff805c74d88 <+1>: movq   %rsp, %rbp0x7ff805c74d8b <+4>: movl   %edx, %ecx0x7ff805c74d8d <+6>: movq   %rsi, %rdxTarget 0: (SwiftInMemoryLoading) stopped....
...
...
(lldb) sProcess 631 stopped* thread #1, queue = 'com.apple.main-thread', stop reason = instruction step intoframe #0: 0x000000010004b7d6 dyld`dyld4::APIs::NSLinkModule(__NSObjectFileImage*, char const*, unsigned int)...
...
(lldb) ddyld`dyld4::APIs::NSLinkModule:...
...
0x10004b83c <+102>: movq (%rdi), %rax0x10004b83f <+105>: leaq 0x3a5c3(%rip), %rsi ; "TMPDIR"...
...
0x10004b8b7 <+225>: leaq 0x3a558(%rip), %rsi ; "NSCreateObjectFileImageFromMemory-XXXXXXXX"...
...
0x10004b8f6 <+288>: callq 0x10006a63c ; pwrite
slyd0g-dev@slyd0g-devs-Mac Downloads % sudo /Applications/FileMonitor.app/Contents/MacOS/FileMonitor | grep SwiftInMemory | grep NSCreateObject{"event":"ES_EVENT_TYPE_NOTIFY_CREATE","timestamp":"2022-04-11 22:11:51 +0000","file":{"destination":"/private/var/folders/z3/2kpksmzs38x9yjgr7yndd57h0000gn/T/NSCreateObjectFileImageFromMemory-zvSxCzD5","process":{"pid":1084,"name":"SwiftInMemoryLoading","path":"/Users/slyd0g-dev/Downloads/SwiftInMemoryLoading","uid":501,"architecture":"Intel","arguments":["/Users/slyd0g-dev/Downloads/SwiftInMemoryLoading","/sbin/ping","-c3","google.com"],"ppid":1085,"rpid":1084,"ancestors":[1085,387,1],"signing info (reported)":{"csFlags":838860839,"platformBinary":0,"signingID":"SwiftInMemoryLoading-55554944e33587e81304398cac8e385f4c6c1b03","teamID":"","cdHash":"8D55D6EB5E3A38BF3A67142E5DB1D0C155B21C08"},"signing info (computed)":{"signatureStatus":0,"signatureSigner":"AdHoc","signatureID":"SwiftInMemoryLoading-55554944e33587e81304398cac8e385f4c6c1b03"}}}}slyd0g-dev@slyd0g-devs-Mac Downloads % shasum /private/var/folders/z3/2kpksmzs38x9yjgr7yndd57h0000gn/T/NSCreateObjectFileImageFromMemory-zvSxCzD57d031b92a86d815bac7bb2c1b298e8000c470593  /private/var/folders/z3/2kpksmzs38x9yjgr7yndd57h0000gn/T/NSCreateObjectFileImageFromMemory-zvSxCzD5slyd0g-dev@slyd0g-devs-Mac Downloads % shasum /sbin/ping7bbd3cd1d03386823b2bcf37c25431e08cea4733  /sbin/ping

Detection

Conclusion

Credits

--

--

I break computers and skateboards and write about the former

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store