Analysis notes for thunder mac

Riusksk @ localhost :~ $ Gdb/Applications/Thunder. app/Contents/MacOS/Thunder (gdb) set env DYLD_INSERT_LIBRARIES =/usr/lib/libgmalloc. dylib (gdb) rStarting program:/Applications/Thunder. app/Contents/MacOS/Thunder GuardMalloc [bash-720]: Allocations will be placed on 16 byte boundaries. guardMalloc [bash-720]:-Some buffer overruns may not be noticed. guardMalloc [bash-720]:-Applications using vector instructions (e.g ., SSE) Shocould work. guardMalloc [bash-720]: version 25 GuardMalloc [arch-720]: Allocations will be placed on 16 byte boundaries. guardMalloc [arch-720]:-Some buffer overruns may not be noticed. guardMalloc [arch-720]:-Applications using vector instructions (e.g ., SSE) shocould work. guardMalloc [arch-720]: version 25 Reading symbols for shared libraries ++. ++ ................................. ................ ........................................ ........................................ ...... DoneReading symbols for shared libraries. doneGuardMalloc [Thunder-720]: Allocations will be placed on 16 byte boundaries. guardMalloc [Thunder-720]:-Some buffer overruns may not be noticed. guardMalloc [Thunder-720]:-Applications using vector instructions (e.g ., SSE) shocould work. guardMalloc [Thunder-720]: versio N 25 Reading symbols for shared libraries. done ...... GuardMalloc [rm-728]: Allocations will be placed on 16 byte boundaries. guardMalloc [rm-728]:-Some buffer overruns may not be noticed. guardMalloc [rm-728]:-Applications using vector instructions (e.g ., SSE) shocould work. guardMalloc [rm-728]: version 25 Reading symbols for shared libraries ................................. .. done ....... DoneReading symbols for shared libraries... doneReading symbols for shared libraries ............. done Program received ed signal EXC_BAD_ACCESS, cocould not access memory. reason: KERN_PROTECTION_FAILURE at address: 0xfefff0000xfefff000 in ?? () (Gdb) bt #0 0xfefff000 in ?? () #1 0x108a3b8 in-[TaskDirCombox awakeFromNib] () #2 0x988d6586 in-[NSObject into mselector:] () #3 0x90310b64 in-[NSSet failed:] () #4 0x92841011 in-[partition: topLevelObjects:] () #5 0x9281f572 in loadNib () #6 0x9281e94a in + [NSBundle (NSNibLoading) _ loadNibFile: nameTable: withZone: ownerBundle:] () #7 0x9296f9a4 in + [NSBundle (NSNibLoading) loadNibF Ile: externalNameTable: withZone:] () #8 bytes in + [NSBundle (NSNibLoading) loadNibNamed: owner:] () #9 0x000033ba in-[NewTaskWndController initWithTasks: index:] #10 0x0000332b in-[NewTaskWndController initWithXLTask:] () #11 0x00009051 in-[TaskController taskInfo] () #12 0x988d65d3 in-[NSObject notify mselector: withObject:] () #13 0x9296dbd2 in-[NSApplication sendAction: to: from:] () #14 0x92aaa3 Dc in-[NSMenuItem _ core1_maction] () #15 0x92aaa06b in-[NSCarbonMenuImpl handle:] () #16 0x92aa96f4 in-[NSMenu _ HANDLE: sendAccessibilityNotification:] () #17 0x9278a2ba in-[NSMenu into mactionforitematindex:] () #18 0x9278a26f in-[NSMenu _ blank:] () #19 0x9278a23a in-[NSMenuItem _ internalkaline Signature] () #20 0x9278a0b9 in-[NSCarbonMenuImpl _ carbonCommandProcessEvent: handlerCallRef:] () #21 0x92aa27ce in signature () #22 0x90d1eb6b in _ signature () #23 0x90ba6594 in container () #24 0x90ba5980 in container () #25 0x90bb9855 in SendEventToEventTarget () #26 0x90d1ea1a in SendHICommandEvent () #27 0x90b95b84 in Running () #28 0x90b95b31 in loading () #29 0x90b959b6 in FinishMenuSelection () #30 0x90d6bb33 in loading () #31 running in _ loading () #32 0x92b32335 in _ loading () #33 0x92b31251 in-[NSCarbonMenuImpl _ popUpContextMenu: withEvent: forView: withFont:] () #34 0x92caf0c3 in-[NSMenu _ popUpContextMenu: withEvent: fo RView: withFont:] () #35 bytes in-[NSMenu _ popUpContextMenu: withEvent: forView:] () #36 bytes in + [NSMenu popUpContextMenu: withEvent: forView:] () #37 0x00008ce7 in-[TaskController popUpMenu:] () #38 0x0000955c in-[TaskTableView rightMouseDown:] () #39 0x92962bf1 in-[NSWindow sendEvent:] () #40 0x9295da0f in-[NSApplication sendEvent:] () #41 0x9287772c in-[NSApplication run] () #42 0x0000e93d Function called before in main () Crash: _ text: 425a38a mov eax, ds :( cls_aNsworkspace-9F60h) [esi]; class: "NSWorkspace" _ text: running a390 mov ecx, ds :( msg_aSharedworkspac-9F60h) [esi]; message: "sharedWorkspace" _ text: Drawing a396 mov [esp + 4], ecx _ text: when a39a mov [esp], eax _ text: Drawing a39d call _ objc_msgSend _ text: Drawing a3a2 mov ecx, ds :( msg_aIconforfile-9F60h) [esi]; message: "iconForFile: "_ text: Running a3a8 mov [esp + 8], ebx; point to the file path. objc_class_name_NSPathStore2>: points to the desktop _ text: Running a3ac mov [esp + 4], ecx _ text: Running a3b0 mov [esp], eax _ text: Running a3b3 call _ objc_msgSend; this function crashes !!! _ Text: running a3b8 mov ebx, eax gdb $ ni0x98bbd63e in-[NSWorkspace iconForFile:] () Error while running hook_stop: Invalid type combination in integrity test. gdb $ niProgram stored ed signal EXC_BAD_ACCESS, cocould not access memory. reason: KERN_PROTECTION_FAILURE at address: 0xfefff0000xfefff000 in ?? () Error while running hook_stop: Invalid type combination in equality test. gdb $ x/I 0x98bbd63e 0x98bbd63e <-[NSWorkspace iconForFile:] + 148>: call Dig gdb $ info reax 0xbfffd66c 0xe83be401 0x0x1 0x1ebx 0xbfffd670 0xbfffd63c 0xbfffe028 0000000000000000000000000xfefff000 limit 0x10202 0x10202cs 0x1b 0x1bss 0x23 0x23ds 0x23 0x23es 0x23 0x23fs 0x0 0x0 gs 0xf 0xf int _ cdecl _ TaskDirCombox_awakeFromNib _ (int a1) {void * v1; // ST40_4 @ 1 void * v2; // ST3C_4 @ 1 void * v3; // ST38_4 @ 1 void * v4; // ST34_4 @ 1 void * v5; // ST30_4 @ 1 void * v6; // ebx @ 1 void * v7; // edi @ 1 void * v8; // eax @ 1 void * v9; // eax @ 1 void * v10; // eax @ 1 void * v11; // eax @ 1 void * v12; // eax @ 2 void * v13; // eax @ 3 void * v14; // ebx @ 3 void * v15; // eax @ 4 void * v16; // ST40_4 @ 5 void * v17; // eax @ 5 void * v18; // ST40_4 @ 7 void * v19; // eax @ 7 int v20; // edi @ 11 int v21; // ebx @ 14 int v22; // ST3C_4 @ 14 void * v23; // eax @ 14 void * v24; // eax @ 14 int v25; // ST40_4 @ 14 void * v26; // edi @ 14 void * v27; // eax @ 14 void * v28; // ebx @ 14 int result; // eax @ 16 void * v30; // [sp + 28 h] [bp-90h] @ 1 int v31; // [sp + 2Ch] [bp-8Ch] @ 10 void * v32; // [s P + 30 h] [bp-88h] @ 9 void * v33; // [sp + 34 h] [bp-84h] @ 9 char v34; // [sp + 40 h] [bp-78h] @ 9 _ int128 v35; // [sp + 80 h] [bp-38h] @ 9 _ int128 v36; // [sp + 90 h] [bp-28h] @ 9 char v37; // [sp + A7h] [bp-11h] @ 5 int v38; // [sp + A8h] [bp-10h] @ 1 v30 = _ stack_chk_guard_ptr; v38 = * (_ DWORD *) _ stack_chk_guard_ptr; objc_msgSend (void *) a1, "setPullsDown:", 0); objc_msgSend (void *) a1, "setAutoenablesItems:", 1); v1 = obj C_msgSend ("NSArray", "alloc"); v2 = objc_msgSend (& cfs_aDesktop, "prop"); v3 = objc_msgSend (& cfs_asc_2ADCA, "stringByStandardizingPath "); v4 = objc_msgSend (& cfs_aDownloads, "batch"); v5 = objc_msgSend (& cfs_aMovies, "batch"); v6 = objc_msgSend (& cfs_aMusic, "batch "); v7 = objc_msgSend (& cfs_aPictures, "stringByStandardizi NgPath "); v8 = objc_msgSend (& cfs_aDocuments," stringByStandardizingPath "); * (_ DWORD *) (a1 + 96) = objc_msgSend (v1," initWithObjects: ", v2, v3, v4, v5, v6, v7, v8, 0); v9 = objc_msgSend ("PreferenceManager", "sharedInstance"); v10 = objc_msgSend (v9, "getArrayValue: defaultVal: ", & cfs_aRecenttasksave, 0); v11 = objc_msgSend (v10," mutableCopy "); * (_ DWORD *) (a1 + 100) = v11; if (! V11) {v12 = objc_msgSend ("NSMutableArray", "alloc"); * (_ DWORD *) (a1 + 100) = objc_msgSend (v12, "init ");} v13 = objc_msgSend ("NSMutableArray", "alloc"); * (_ DWORD *) (a1 + 104) = objc_msgSend (v13, "initWithArray:", * (_ DWORD *) (a1 + 96); v14 = objc_msgSend (* (void **) (a1 + 100), "count"); while (1) {v14 = (char *) v14-1; if (signed int) v14 <0) break; v15 = objc_msgSend (* (void **) (a1 + 100 ), "ObjectAtIndex:", v14); if (! (Unsigned _ int8) objc_msgSend (void *) a1, "isdefadir dir:", v15) {v37 = 0; v16 = objc_msgSend ("NSFileManager", "defaultManager "); v17 = objc_msgSend (* (void **) (a1 + 100), "objectAtIndex:", v14); if (unsigned _ int8) objc_msgSend (v16, "fileExistsAtPath: isDirectory: ", v17, & v37) {if (v37) {v18 = * (void **) (a1 + 104); v19 = objc_msgSend (* (void **) (a1 + 100), "objectAtIndex:", v14); objc_msgSe Nd (v18, "addObject:", v19) ;}}} objc_msgSend (void *) a1, "removeAllItems"); v36 = 0; v35 = 0; v33 = * (void **) (a1 + 104); v32 = objc_msgSend (* (void **) (a1 + 104), "countByEnumeratingWithState: objects: count :", & v35, & v34, 16); if (v32) {v31 = * DWORD2 (v35); do {v20 = 0; do {if (* DWORD2 (v35 )! = V31) objc_enumerationMutation (v33); v21 = * (_ DWORD *) (DWORD1 (v35) + 4 * v20); v22 = * (_ DWORD *) (DWORD1 (v35) + 4 * v20); v23 = objc_msgSend ("NSFileManager", "defaultManager"); v24 = objc_msgSend (v23, "displayNameAtPath:", v21); objc_msgSend (void *) a1, "addItemWithTitle:", v24); v25 = v20; v26 = objc_msgSend (void *) a1, "lastItem"); objc_msgSend (v26, "setToolTip :", v22); v27 = objc_msgSend ("NSWor Kspace "," sharedWorkspace "); v28 = objc_msgSend (v27," iconForFile: ", v22); // crash here !!! Objc_msgSend (v28, "setSize:", 1098907648,109 8907648); objc_msgSend (v26, "setImage:", v28); objc_msgSend (v26, "setTarget:", a1 ); objc_msgSend (v26, "setAction:", "selectItem:"); v20 = v25 + 1;} while (v25 + 1 <(unsigned int) v32 ); v32 = objc_msgSend (v33, "countByEnumeratingWithState: objects: count:", & v35, & v34, 16);} while (v32);} result = * (_ DWORD *) v30; if (* (_ DWORD *) v30! = V38) _ stack_chk_fail (); return result ;}