Installing Mac OS X on PearPc

hey,
It has been really long since I have written anything in here.
Recently while I was surfing the Internet, I came across this site http://pearpc.sourceforge.net/ . Its an emulator for PowerPC computers. The screen shot of MAC running on it is really nice, so I thought to give it a try; and I was successful in installing the same.

Here's what you will need to install MAC on PearPC emulator.

1.Mac OS X DVD image.
2.PearPC emulator ( http://pearpc.sourceforge.net/ or http://www.pearpc.net/ )
Note: I first tried to compile the source packages downloaded from http://pearpc.sourceforge.net/ but they would not compile properly. You need to apply a patch for it. The packages from http://www.pearpc.net/ are good to start as they already contain the binary and a GUI to configure the virtual machine.

After having the required components, lets get started:

Firstly create a 6 GB file using the 'dd' command in Linux or using the GUI from the PearPC.net package. This file will server as the 'disk' for the virtual machine.

Next we will use the associated GUI ($ java -jar APE.jar or you can use the script file to start the GUI) to configure our virtual machine. The main settings are these:



and the settings for the Installation DVD and virtual disk image



After completing these settings go back to the 'Config file' tab and click on 'Save config and start PearPC' button. This will bring up the emulator screen as follows:



Select CDROM option and hit enter. This will start the Mac OS X installation program.






Next comes this



At this point we need to partition the virtual disk drive. So Goto Utilities > Disk Utility



This will bring you to this screen



The first one is the virtual disk, We need to format it. Remember to format the partition as "Mac OS Extended (journaled)" otherwise you will not be able to boot from that partition. I had done this mistake once; I formatted the partition as "Unix filesystem" and I was not able to boot from the virtual disk.



confirm to delete the existing data and format it.



After the format it will show you this screen. You will have a partition in the virtual disk.



After the partition is created on the virtual disk, we can now proceed with the installation program. You can just close the 'Disk Utility' application.



Select the language of the installation and click 'Continue'



Now select the disk and proceed with the installation.



Here you can 'Customize' the packages that will be installed on the system. Click Install to continue with the installation.



The installer will check for the integrity of the install DVD. You can skip this step if you want.
After this the installation begins:









After this Restart the PearPc emulator.



You can see, there is an additional entry "to boot from the virtual disk". Select the option to boot from the disk, and we are good to go :)



This will bring us to the welcomes screen. Complete all the initial setup and create a user account.





















And here we are, at the Desktop. I followed the tutorial at the PearPC wiki and finally got my virtual machine connected to the Internet.
Here is the tutorial: http://wiki.pearpc.net/index.php?title=Networking

And the final screen shot



Looks good !!

Isn't it !! :)

Change return address on stack through buffer overflow (Windows version)

Here is the windows version of the same program.

#include<stdio.h>
#include<stdlib.h>
#include<string.h>

void shankar()
{
printf("\n\nAey,\nWhat's up doc :) \n\n");
exit(10) ;
}

void vijay(char *input)
{
char buffer[14];
strcpy(buffer,input);
}

int main()
{
//print some useful information for the hack
printf("main=%p\n",main);
printf("vijay=%p\n",vijay);
printf("shankar=%p\n",shankar);
vijay("ABCDEFGHIJKLMNOPQRVS\xdc\x10\x41\x00");
return 0;
}

This program was compiled on windows using Visual Studios 2008

This program works same as the linux version, there is however a difference; the C compiler on windows places some extra data on the stack just after the return address (notice the length of the garbage string is 2 bytes more in this case as compared to the linux version); it does it so that it can verify after the function return that the return address is not tampered.

To make this program work, turn off "Buffer security check" using /GS- option from the command line or through the program properties in visual studios, else you might not get upto the return address and even if you managed to find the return address on the stack and change it, you will not able to execute it because the system will come to know that the return address is tampered and it will stop the execution of the program.



You need to change the return address in the string that is passesd to vijay() function else the program will segfault. The manner in which the return address is written remain the same for both linux and windows.

Hope you all find this a bit useful ;)

Change return address on stack through buffer overflow (Linux)

Ok, i know that i am late; and i should have written this way long before; but anyways, better late than never :)

As said in the previous post, i am going too tell something about changing the return address on the stack through buffer overflow. Please keep in mind that it is not very fancy; its just for the beginners; i am still learning ;)

So, the code goes as:

#include<stdio.h>
#include<stdlib.h>
#include<string.h>

void bar()
{
printf("\n\nAey,\nWhat's up doc :) \n\n");
exit(10) ;
}

int foo(char *input)
{
char buffer[14];
strcpy(buffer,input);
}

int main()

{
//print some useful information
printf("main=%p\n",main);
printf("foo=%p\n",foo);
printf("bar=%p\n",bar);

foo("ABCDEFGHIJKLMNOPQR\x24\x84\x04\x08");
return 0;

}


This code is written on a linux machine, the same will not work on windows machines. It turns out that C compiler on windows places some more information on the stack after the stack frame pointer.


Code explanation:
Here, we have three function; the good old main() our entry point to the application; then we have the foo() function and the bar() function.

In the main() we are just printing the addresses of the functions in the memory; and then there is a call to the foo() function. Please note that the bar() function is never called; it is not in the control flow of the program. My aim was to somehow replace the address on the stack so that the bar() function is called automatically, when the foo() function returns.

The core of the logic ( if you say so :) ) is in the foo() function. Note the strcpy() operation; we are copying more data in the less space; hence it results in a buffer overflow. This overflowed data is then spilt over other information on the stack including the return address on the stack.

At this point when foo() function is executing, the stack looks something like this:

HIGH ADDRESS                                   LOW ADDRESS
-------------------------------------------------------------------------------------------
input | return address (4 bytes)  | sfp (4 bytes)  | buffer (14 bytes) |
-------------------------------------------------------------------------------------------
                           Stack grows this way ------->

From the figure above we can easily see that the return address is at an offset of 18 bytes from the buffer; 14 bytes for the buffer and 4 bytes for the stack frame pointer. So if we copy more then 14 bytes in buffer we will overwrite the stack frame pointer and if we copy more than 18 bytes into the buffer we can easily overwrite the return address on the stack, and there is on one who will stop you from doing this :)

The next question is how to write the return address?
As this code is written on intel machine which is a "little endian" machine; you write the little end of the address first and then the higher end of the address. Say for example, if the address is 0x08048454 the string representation of the same will be \x54\x84\x04\x08. We start with the little end of the address.

If you compile this code on your machine, the address of the bar() function will be different on your system, so just change the return address in the string that is passed to the foo() function as told above and you are ready to go.

Please note that Linux now provides what is called Address Space Randomization. This means that each time your application is loaded into the memory, it is loaded at some random address. This will change the address of the functions every time they are executed. This in turn will render this address changing on the stack useless. To overcome this turn off Address Space Randomization in Linux as follows:

$ echo 0 > /proc/sys/kernel/randomize_va_space

This will make sure that the functions are loaded at the same virtual address every time.

Stack and Assembly

Its long time, I've written something here. Actually was busy with my project, which finally completed yesterday. So for some time now I am kinda free; I am trying to utilize this time to do something useful and something that I've always wanted; that is to learn "Assembly language". I particularly like the tricks with the stacks and the small and smart tricks that can be done with the Assembly language.

So, keeping this thing in mind I have started out with Assembly. As of now I have set 2 tasks for myself:

1. To change the return address on the stack.(should be easy one :) )
2. To execute a shellcode and spawn a shell.

Lets see, how does it goes. If I succeed in doing these, then maybe I will post a small howto of the same.

Feelings......

I wish all my feelings for you could be like these flowers........

DEAD.