Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #15728648
Ghidra
Manual Analysis of a 64-bit kernelcache in Ghidra
Getting Offsets
- Install Ghidra 5.6.3 with AARCH64 processor support
- Run analysis
- find "last entry has non-NULL string in kernelcache by doing a memory search for the string
- this is in a kext, so find mach_header_64 by search backwards in memory, search for 'feedfacf', in hex
- mark as as mach_header_64 (press t)
- next available memory, mark as segment_command_64
- Expand segment to see number of sections
- next avail, mark as an array of section_64
- expand first section, should be __text, __TEXT
- copy size into clipboard, jump to address
- select the size of the section by doing Select -> bytes as shown below
- enter 'd' to disassemble