Slashdot Mirror


How Encrypted Binaries Work In Mac OS X

An anonymous reader writes "By now we know that OS X uses encrypted binaries for some critical apps like Dock, Finder and LoginWindow. Amit Singh explains the implementation of this protection scheme which makes use of the AES crypto algorithm and a special memory pager in Mach. The so called Do Not Steal Mac OS X (DSMOS) kernel extension helps along the way by decrypting things for the special pager when apps get executed. A funny thing is that if you print the pointer at address 0xFFFF1600 in your own app you get as output Apple's karma poem for crackers! According to the article there are 8 protected binaries in OSX including Rosetta and Spotlight meta data demon. Interestingly Apple's window server is NOT one of those."

14 of 365 comments (clear)

  1. It sure was simpler back in the day! by KlaymenDK · · Score: 4, Interesting

    This is not the first "Do not steal Mac OS" they've done, although the first version never really got tested in action.

    http://www.folklore.org/StoryView.py?project=Macin tosh&story=Stolen_From_Apple.txt&sortOrder=Sort%20 by%20Date&detail=medium&search=stolen

    History repeating! :D

  2. One reason not to encrypt the windowing system by runlevel+5 · · Score: 3, Informative

    WM's are huge apps and decrypting one before every startup would add a lot of work that has to be done at boot. According to the article, "the SystemUIServer binary within SystemUIServer.app", is encrypted and that is presumably a larege component of the WM. Also, it's virtually useless without the the dock and finder anyway.

    1. Re:One reason not to encrypt the windowing system by Trillan · · Score: 4, Informative

      No, SystemUIServer is the process that runs Apple's menu do-dads, like the battery indicator, volume menu, iChat menu, keychain menu, clock, spotlight menu... basically, everything in the top right corner. Except for menus that 3rd party applications add, which are always to the left of the SystemUIServer items.

      Originally, developers could inject their own menus into it if they figured out Apple's undocumented API for it. However, Apple shut that down (in 10.2, I think) since an unstable menu would destabilize all of Apple's menus. They're all run in the same address space, presumably to allow Apple to cut some corners in their command-drag reordering system. After 10.2, some developers hacked it to allow them to inject other menus into it. Maybe that's what Apple is trying to stop.

      Even so, it's a really odd pick for encryption.

  3. why bother? by oohshiny · · Score: 3, Interesting

    It doesn't really matter what they protect, they are simply trying to make copying OS X wholesale more cumbersome. Functionally, there is nothing in OS X that would be worth disassembling for anybody: there are already open source implementations of Spotlight, Finder, SystemUIServer, Doc, and all the other stuff, and arguably, the open source versions are technically better. The thing that makes Macs shine and sell is the packaging and integration, not the technology.

  4. Re:Signed binaries = good, encrypted binaries = ba by Wizard+Drongo · · Score: 4, Insightful

    Actually they're up to about 6% marketshare in the USA, and I think about 8% in the EU. And as for relevance, Apple, like Google are figureheads. When Apple do something, the rest of the market take notice. Like Widgets in OS X 10.4.....after Apple released this, Microsoft weighed in with 'Gadgets' (Yes, I know widgets come from Konfabulator, but Apple made them famous, and after Apple did so, Yahoo! bought Konfabulator, something that wouldn't have happened without Apple copying it in Tiger). So what Apple do is important because you tend to find 6 months after Apple do something, everyone else does too. I wouldn't be at all surprised if Microsoft use the encrypted binary idea in Vista SP1 or whatever comes after Vista (too late to put in Vista). I also wouldn't be at all surprised if Microsoft totally screw it up.

    --
    The truth shall always be free: Boris Floricic is Tron.
  5. Re:Oh look, we can scramble a binary. by binarybum · · Score: 5, Funny

    "Hi, I'm a PC."
    "And I'm a Mac. My insides are all scrambled up. It protects me from dangerous crackers."
    "All scrambled up?"
    "Yep, that's right, my most important parts are very heavily scrambled."
    "Does it hurt when you poop?"
    "like you wouldn't believe"

    --
    ôó
  6. Re:Printing 0xFFFF1600 ? by Anonymous Coward · · Score: 3, Funny

    I'm running 10.2.8 - quite old. Printing 0xFFFF1600 as a string with printf causes a seg. fault on my box.

    well that's one hell of an Easter egg!

  7. Re:Love mac - hate some of the choices by frdmfghtr · · Score: 3, Interesting
    I also can't stand spotlight. It is a resource hog and doesn't work well, plus it takes up critical real estate on the menu bar.


    "Critical real estate on the menu bar"? Exactly how big is your Spotlight icon? Mine is less than half the size of my little fingernail on my 12" iBook, as big across as the menu bar is thick. I hardly call that "critical" but if that's your opinion, then so be it.

    --
    Government's idea of a balanced budget: take money from the right pocket to balance...oh who am I kidding?
  8. Re:Oh look, we can scramble a binary. by sokoban · · Score: 3, Funny

    Where do you think iPods come from?

    --
    09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 is the magic number.
  9. Re:That poem is scary.. by astrosmash · · Score: 3, Insightful

    The fundamental purpose of Copyright law is to allow a creator to control how their works are disseminated. Obviously, Apple wants you to buy their hardware if you want to run their software, and they're perfectly within their rights to do so.

    Say Chevy offers Radiohead $1 Million to use one of their recordings in a stupid truck ad, and Radiohead refuses. By your logic, Chevy should then have the right to use the recording anyway, because since Radiohead refused to sell them the song they're not losing any money.

    You may think it's right, but hundreds of years of copyright law would disagree.

    --
    ENDUT! HOCH HECH!
  10. Re:That poem is scary.. by bdash · · Score: 3, Informative

    The US Treasury would disagree with you: http://www.ustreas.gov/education/faq/currency/lega l-tender.shtml#q1. Then again, what do they know?

  11. Your morals are crap. by porkchop_d_clown · · Score: 3, Insightful

    Say I'm a black man. I go into a store to buy some bread to feed my family. The shop keep says "that bread aint for sale". I say I have a moral right to take it. Irrefutable.

    Nice strawman. Because we all know, any attempt to control my property is equivalent to trying to starve a poor black family.

    Your razor blade argument is equally crap. Those blades belong to the store owner. I don't care what you thought, you have no moral or legal right to steal more blades or to force him to give them to you. End of story. Irrefutable.

    If you don't like it, shop somewhere else.

  12. Re:Signed binaries = good, encrypted binaries = ba by pyite · · Score: 3, Insightful

    OSX is denying the user one of the fundamental Freedoms.

    Uh, it might be a "fundamental Freedom" if you had a "fundamental Right" of some sort to do as you wish with other people's IP. Unfortunately, you don't. A significant number of people make a good living for themselves and their families working for companies that, while being very understanding and supportive of the free software movement in its proper place, gain competitive advantage over their peers by employing the best intellectual talent to solve problems with technological solutions that if copied would eliminate any sort of advantage that company may have in solving a certain problem.

    --

    "Nature doesn't care how smart you are. You can still be wrong." - Richard Feynman

  13. Re:Signed binaries = good, encrypted binaries = ba by Bastian · · Score: 4, Insightful

    If you purchase a physical item, do you still think of it as the seller's property after you've paid for it and taken it home?

    When I purchase a car, the car is my property. Honda is not trampling on my liberties by not giving me all the CAD files and whatnot that were used to make my car.