How to unpack and disassemble mach-o binary (OSX 64 bit)?

Question

Objective-C

Hi, I'm trying to open the OSX mach-o binary.
Unfortunately, the disassembly gives me a bullshit, apparently the binary is crypted, or uses a packer (or in the worst case, obfuscation).
I need to get / determine the encryption algorithm, and decrypt the binary.
Load Commands
Using otool -l myTargetdumped the binary loading commands
(some flags for the fact of the crypt.... but it is still encrypted)
https://www.dropbox.com/s/yg78mesn3w9mm7n/load_com...
Disassembling
Using otool -tvV myTargetdumped the entire __text __TEXT
https segment ://www.dropbox.com/s/ag6xq1n2k9nm4eq/text_seg...
As you can see, no useful information, just mess.
LLVM disassembler refuses immediately

(__TEXT,__text) section
Segmentation fault: 11

Injecting with cycript
I tried `cycript` to dump the `master binary image` from Virtual Memory, and then patched the dump back into the binary with the `dd` tool,
but that trick didn't seem to work and the binary was corrupted.
dylib injection
I've managed to inject dylib into a process and I have my trojan thread in the process,
ie. I can call any method, I can see all classes and the entire object field, I can swizzle any method,
but this does not give me a chance to disassemble, and again the binary remains a black box.
Debuggers
`gdb`/`lldb` refuse to start/attach to a process because the binary uses `pt_deny_atach`/`sysctl`/`kauth` anti-debugging techniques.
I tried patching my OSX kernel to ignore `pt_deny_atach`/`sysctl`/`kauth` (because the assembly to the binary is not available and I can’t remove these calls with `nop`)
But after that the process does not even start, just hangs (While `Github` and `iTunes` start without any problems, and peck at the patch).
Decrypted piece of code
This is the only one that I could find,
The binary uses a fairly popular AquaticPrime library.
I integrated the library on my test project and compiled it, then compared my code with the code that is in the binary.
My code (decrypted)
https://www.dropbox.com/s/mw2e8cvzt0u5vwy/decytpted.png
Code in binary (encrypted)
https://www.dropbox.com/s/o70qq90trz5h914/encrypted.png
Additional Information There is a mangling
trick , but given the size of the function, the encrypted options are quite large. I started thinking in terms of mangling. at the very beginning (when I started to reverse this binary), all disassemblers refused to report (corrupted file), but the binary was launched, it turned out that the segment offsets were incorrect, I corrected them manually and the disassemblers began to read it. Do you think there are signs of mangling here? File https://www.dropbox.com/s/pp2ex3uhqp3aeut/hop.app.zip Contents/MacOS/Hopper Disassembler v3 - binary itself (offsets fixed)


Contents/MacOS/Headers - classdump, class and method names, implementation and field addresses.
Can you suggest some additional techniques (or suggestion that I can try) to get a clean assembly?
PS moderators / users, I know the text with errors (I'm a foreigner), if possible, correct the grammar plz.

Answer 1

I managed to inject dylib into the process and I have my trojan thread in the process,
i.e. I can call any method, I can see all classes and the entire object field, I can swizzle any method,
but this does not give me a chance to disassemble, and again the binary remains a black box.
Here I sketched a small library that dumps the application's executable file from memory - perhaps part of the obfuscation can be bypassed in this way. Since you know how to inject libraries, then there should be no problems.
Although yes, Hopper is not the easiest target, I wish you good luck!