Bypassing OS Xs Code Signature Check

I was trying to patch Mavericks OSInstall framework to allow installation on MBR partition schemes, but all of my attempts failed. I noticed that the installers error log reported that it failed to verify the code signature of OSInstall. This never happened to me before with Mountain Lion, so I decided to look into some of the changed in Mavericks. A post by oldnapalm on InsanleyMacs forums confirmed that the installer wont launch OSInstall unless it has been signed to reflect the modifications.

Unfortunately I needed a way to sign this file from Linux, and there are no Linux alternative for Macs codesign program. I decided to compare a signed and unsigned version of the same program to see exactly what codesign was changing. Ill try to make this more interesting by adding in some pictures. Heres two copies of the same program, which are currently unsigned:


So I signed one of them and verified its signature:

Next I compared their differences using the hex editor Hex Fiend.


So theres about 10 locations that differ. Some of these locations contained several bytes, so there was about 40 bytes that differed between them in total. In addition, the signed versions was extended by 9.2 kilobytes of 0x00 characters. I wanted to see what would happen if I changed any arbitrary byte of the signed program and tried to launch it. As expected, the file failed the verification.


So from there I tried changing each altered byte of the signed program back to that of its unsigned versions. Very quickly it stumbled upon the byte that would make the OS think the file wasnt signed.


However, running this file with the 21st byte changed from 0x38 to 0x28 would result in a malformed Mach-o format error when I tried to run the program. Lets exaime these hex values a little bit closer.

 0x28 = 00101000 
 0x38 = 00111000 

The 5th bit is the only thing that changed between these two values, so this bit must correspond to the flag that tells the OS that this application is signed.

So I tried changing a few more bytes, and managed to find the other byte that needed to be changed.


So finally, after changing the 21st byte from 0x38 to 0x28 and the 17th byte from 0x12 to 0x11, I was able to run a modded program which was signed. Lets look at those last hex values:

 0x11 = 00010001 
 0x12 = 00010010 

So the bit that is set in 0x12 but not in 0x11 is the 2nd bit. This must also be related to the the signature check.

After discovering this, I tried applying those same changes to Mavericks OSInstall which had previously failed to launch after being modified. Sure enough, it launched without any problems, and I was able to install Mavericks on my MBR disk. Heres the final pseudo code for how to patch modded, signed applications so that they can run:

 // Clear code signature bits 
 Byte 17 &= 0xFD 
 Byte 21 &= 0xEF 

This works because the OS checks to see if these bits are set in order to determine if the application is signed. So theres no need for it to verify the application before launching it because the OS doesnt think its signed.

Update: I was working with OSInstall again today, March 5th, 2014, and I was able to get the OS to run a modded version of it after only changing byte 17. So changing byte 21 might not be necessary.

Update: Ended up having some problems with developing an MBR patch for OS X 10.10 Yosemite because of the code signature protection. Ended up running a bunch of tests to find a pattern with how bytes 17 and 21 changed when being signed. Things are working much better now :) Heres the final code. Also value is the offset for the start of the current architecture. So it would change for 32bit/64bit/Compatible.

if(buffer[value + 0x10] == 0x24) {
 buffer[value + 0x10] -= 0x01;
 buffer[value + 0x14] >= 0x10 ? buffer[value + 0x14] -= 0x10 : buffer[value + 0x14] += 0xF0;
}
else if(buffer[value + 0x10] > 0x24) {
 buffer[value + 0x10] -= 0x02;
 buffer[value + 0x14] >= 0x20 ? buffer[value + 0x14] -= 0x20 : buffer[value + 0x14] += 0xE0;
} 

Theres probably some binary arithmetic that can simplify this algorithm even further, but Im not very interested in creating one right now.

Update: Someone who did more research than I did left a good comment that explain the flaws in my process. Based on his comment, I guess we can conclude that bits 17 and 21 are not being used as bit field flags to enable the code signature check, however modify them like Ive done will circumvent the security.

Available link for download

All sony Xperia lock code Remove in 5sec vitout full flash by GSMZA

All sony Xperia lock code Remove in 5sec vitout full flash by GSMZA


Xperia Zr C5502 lock remove.ftf
LT18i lock remove.ftf
Xperia LT18a lock remove.ftf
LT22i lock remove.ftf
LT26i lock remove.ftf
LT28i lock remove.ftf file credit: bimes
LT29i lock remove.ftf
Xperia Z1 C6602 lock remove.ftf
Xperia L C2104 lock remove.ftf
Xperia E1 Dual D2105 lock remove.ftf
Xperia E1 D2005 lock remove ftf
Xperia M C1904 lock remove.ftf
Xperia M C1905 lock remove.ftf
Xperia SP C5302 Lock Remove.ftf Credits: itsmedafvan
Xperia Sp C5303 lock remove.ftf
Xperia Tipo St21i lock remove.ftf
W8 Walkman E16i lock remove.ftf
Xperia M Dual C2004 lock remove.ftf
Xperia M Dual C2005 lock remove.ftf
Xperia L C2105 lock remove.ftf
Xperia Arc LT15i Lock Remove.ftf Credits: itsmedafvan
WT19a Walkman lock remove.ftf
WT19i Walkman lock remove.ftf
Xperia Miro St23i lock remove.ftf
Xperia X10 mini pro U20i lock remove.ftf
Xperia X10 mini pro U20a lock remove.ftf
Xperia X8 E15a lock remove.ftf
Xperia X8 E15i lock remove.ftf
Xperia X10a lock remove.ftf
Xperia X10i lock remove.ftf
Xperia X10 mini E10a lock remove.ftf
Xperia X10 mini E10i lock remove.ftf
Xperia M2 Aqua D2403 LTE-A lock remove.ftf
Xperia M2 Dual D2302 lock remove.ftf
Xperia T2 Ultra Dual lock remove.ftf
Xperia E C1504 lock remove.ftf
Xperia Play R800i lock remove.ftf
Xperia U St25i lock remove.ftf
Xperia SL Lt26ii lock remove.ftf
Xperia V Lt25i lock remove.ftf
Xperia P Lt22i lock remove.ftf
Xperia J St26i lock remove.ftf
Xperia Z1 compact LTE-A D5503 lock remove.ftf
Xperia E C1505 lock remove.ftf
Xperia E Dual C1604 lock remove.ftf
Xperia E Dual C1605 lock remove.ftf
Xperia Z C6602 lock remove.ftf
Xperia Ray St18i lock remove.ftf
Xperia Neo Mt11i lock remove.ftf
Xperia Neo MT25i Lock Remove.ftf
Xperia Sola MT27i Lock Remove.ftf
Xperia Z1 C6903 lock remove.ftf
Xperia Z3 Compact LTE-A D5803 lock remove.ftf
Xperia E3 Dual D2212 lock remove.ftf
Xperia T Lt30p lock remove.ftf
Xperia C3 Dual D2502 lock remove.ftf
Xperia Go St27i lock remove.ftf
Xperia M2 D2303 lock remove.ftf
Xperia M2 D2306 lock remove.ftf
Xperia Z2 D6503 lock remove.ftf
Xperia C3 D2533 lock remove.ftf
Xperia Z3 D6653 lock remove.ftf
Xperia Z3 D6633 lock remove.ftf credit
Xperia T3 D5103 lock remove.ftf
Xperia ZL C6503 lock remove.ftf
Xperia mini pro SK17i lock remove.ftf
Xperia Ultra C6802 lock remove.ftf fileXperia Z Ultra C6833 lock remove.ftf 
Xperia Z2 D6543 Lock Remove.ftf File 
Xperia Z2 D6502 Lock Remove.ftf file 
Xperia Z2 D6503 Lock Remove.ftf file
Xperia E3 D2203 Lock Remove.ftf file 
Xperia E3 D2202 lock remove.ftf

download flash tool 
download ftf files
full download

Available link for download

CODE USE TO LOCK FOLDER