Removing the code signature from a mac app executable

user_3901497 0
Viewed 6321

I have a signed mac app executable. I initialised NSMutableData with the content of code signed executable. Then I modified some part of the executable and I saved the modified executable. When I tried the run the original app with this modified executable, the app crashed.

Crash log is, 

 System Integrity Protection: disabled

 Crashed Thread:        0  Dispatch queue: com.apple.main-thread

 Exception Type:        EXC_CRASH (Code Signature Invalid)
 Exception Codes:       0x0000000000000001, 0x0000000000000000
 Exception Note:        EXC_CORPSE_NOTIFY

 Termination Reason:    Namespace CODESIGNING, Code 0x2

From the crash log it is clear that it crashed because of invalid code signature. I don't have source code for the app and I'm simply trying to fix some bugs in someone's old app.

So my question is how to remove code signature of a binary in objective c ?

assembly macos objective-c
2 Answers

In addition to decrementing Mach_header.ncmds and reducing Mach_header.sizeofcmds, in my case codesign --remove-signature also truncated the file, removing the data portion of the signature, and also removing of 8 bytes of zero padding which followed the string text belonging to LC_SYMTAB (the data portion of LC_CODE_SIGNATURE must be 16-byte aligned.) This also reduced the __LINKEDIT.filesize so that it marked the position of end-of-file.

user_82320160
Related