Skip to content

macOS 13.2 ARM64 - attach process doesn't get an access to memory/code #3397

Open
@XVilka

Description

Work environment

Questions Answers
OS/arch/bits (mandatory) macOS 13.2 ARM64
File format of the file you reverse (mandatory) -
Architecture/bits of the file (mandatory) -
rizin -v full output, not truncated (mandatory) 0e8828c

Expected behavior

Show instructions and stack once attached

Actual behavior

rizin =
 -- The more 'a' you add after 'aa' the more analysis steps are executed.
[0x00000000]> dpa 59547
[0x188158320]> pd 1
            0x188158320      ffffffff       invalid
[0x188158320]> pd 5
            0x188158320      ffffffff       invalid
            0x188158324      ffffffff       invalid
            0x188158328      ffffffff       invalid
            0x18815832c      ffffffff       invalid
            0x188158330      ffffffff       invalid
[0x188158320]> px 10
- offset -    0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x188158320  ffff ffff ffff ffff ffff                 ..........
[0x188158320]> dr
x0 = 0x0000000000000004
x1 = 0x0000000000000000
x2 = 0x0000000000000000
x3 = 0x0000000000000000
x4 = 0x0000000000000000
x5 = 0x000000016b2052fc
x6 = 0x000000000000000c
x7 = 0x0000000000000001
x8 = 0x0000000000000000
x9 = 0x00000001e37265c0
x10 = 0x0000000000000002
x11 = 0x00000000fffffffd
x12 = 0x0000010000000000
x13 = 0x0000000000000000
x14 = 0x0000000000000000
x15 = 0x0000000000000000
x16 = 0x000000000000018a
x17 = 0x00000001e857f6c0
x18 = 0x0000000000000000
x19 = 0x0000000000000000
x20 = 0x0000000000000000
x21 = 0x000000016b205300
x22 = 0x0000000000000001
x23 = 0x000000016b2052fc
x24 = 0x0000600003446370
x25 = 0x0000000000000000
x26 = 0x0000000000000001
x27 = 0x000060000196ea88
x28 = 0x000060000196ea80
x29 = 0x000000016b2052e0
wzr = 0x00000000
zr = 0x0000000000000000
fp = 0x000000016b2052e0
lr = 0x000000018816b820
sp = 0x000000016b205270
pc = 0x0000000188158320
pstate = 0x00000001a0001000
nf = 0x0

Steps to reproduce the behavior

  1. Open rizin /bin/ls instance
  2. Start another rizin instance and attach to the first:
rizin =
[0x000000]> dpa <1st rizin pid>
[0x000000]> pd 10
[0x000000]> px 100
...

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions