23:43:17 Ryan: ja?
23:43:22 Joe: ?
23:43:32 Ryan: you said you pasted a command, i said i didnt see it, you signed off :)
23:43:41 Joe: dtrace -s <script>
23:43:46 Ryan: BZ doesn't know a solution, not sure dtrace is the right tool for the job
23:43:55 Joe: I think DTrace can do it
23:44:09 Ryan: says there may not be any probes for hotkey
23:44:19 Joe: hm
23:44:24 Joe: you mean fbt might not find them
23:46:08 Ryan: sudo dtrace -l | grep [Kk]ey ?
23:46:14 Joe: nah
23:46:29 Joe: -l gives you a list of providers
23:46:39 Joe: not probes
23:47:31 Ryan: List all probes matching probe s
23:48:31 Joe: hm
23:48:32 Joe: true
23:48:34 Joe: my bad
23:48:42 Ryan: provider is fbt?
23:48:47 Joe: yes
23:48:51 Joe: function bounds tracing
23:49:00 Ryan: so entry, return, as i see
23:49:09 Joe: provider:module:function:name
23:56:16 Joe: hm
23:56:19 Joe: fbt is only kernel functions
23:56:21 Joe: damn
23:59:32 Joe: I'm trying to find where it dispatches the hotkey notifications for symbolic hotkeys
23:59:45 Ryan: interesting
00:00:10 Ryan: need to run IDA on the entire OS at once and print out a very high resolution poster ;)
00:00:15 Joe: hehe
00:00:18 Joe: would be neat
00:01:53 Ryan: have you RE'd DMG yet?
00:01:57 Joe: no
00:02:03 Ryan: i mean it's basically just filesystem data with a wrapper, so not very complex
00:02:03 Joe: DMG is a public format, no?
00:02:06 Ryan: apparently not
00:02:11 Ryan: it can't be very difficult
00:02:16 Joe: others have done it
00:02:18 Ryan: i know
00:02:23 Ryan: macdrive reads it, some windows apps do
00:02:31 Ryan: but i haven't seen... i'll keep looking
00:02:37 Ryan: but if there's a hash in it i want to try to crack DMGs
00:02:51 Ryan: or craft a DMG that encrypts with two passwords :D
00:02:54 Ryan: err decrypts
00:03:02 Ryan: that'd be hawt
00:03:17 Joe: I think it's login window doing the display stuff
00:03:22 Joe: pid32::CGS*Event*:entry {
	
}

00:03:56 Ryan: no probes
00:04:08 Joe: well, pid32 is whatever your loginwindow pid is
00:05:01 Ryan: nein
00:05:12 Ryan: pid67::CGS*Event*:entry {

}

00:05:22 Joe: dtrace -s <script>
00:05:22 Joe: ?
00:05:27 Ryan: does nothing
00:05:29 Ryan: no probes
00:05:33 Joe: lies
00:05:39 Joe: works here
00:05:56 Ryan: $ cat fark
#!/usr/sbin/dtrace

pid67::CGS*Event*:entry {

}

$ ps -A | grep loginwindow
   67 ??         0:01.71 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow console
  739 ttys000    0:00.00 grep loginwindow

00:06:04 Joe: Last login: Thu Dec 27 00:05:41 on ttys002
Lappy:~ joe$ sudo dtrace -s test.d 
dtrace: script 'test.d' matched 86 probes
CPU     ID                    FUNCTION:NAME
  0  24584 CGSGetNextEventRecordFromMessage:entry 
  0  24556      CGSGetNextEventRecord:entry 
  0  24557       CGSDecodeEventRecord:entry 

00:06:30 Joe: Lappy:~ joe$ cat test.d 
pid32::CGS*Event*:entry {
	
}

00:07:50 Ryan: dork you never said the -s flag ;-P
00:07:59 Joe: I've said this many many times
00:08:10 Ryan: not once!
00:08:14 Joe: yes I have
00:08:23 Joe: dtrace -s <script>
00:08:27 Joe: I've pasted that quite a few times
00:08:31 Joe: that SPECIFIC LINE
00:09:13 Ryan: Joe Ranieri
11:26 PM



make a new text file
and use dtrace on that
sudo dtrace
and the file
00:09:18 Ryan: only time you ever said the command
00:09:29 Joe: 23:43:22 Joe: ?
23:43:32 Ryan: you said you pasted a command, i said i didnt see it, you signed off :)
23:43:41 Joe: dtrace -s <script>
23:43:46 Ryan: BZ doesn't know a solution, not sure dtrace is the right tool for the job

00:09:37 Joe: 00:05:22 Joe: dtrace -s <script>
00:05:22 Joe: ?
00:05:27 Ryan: does nothing
00:05:29 Ryan: no probes

00:09:45 Joe: plus about three times when I was under Windows
00:09:51 Ryan: lies, they never went through
00:09:53 Ryan: i can send you my logs ;-P
00:09:57 Joe: lol
00:10:01 Ryan: (that ^ was under windows btw)
00:10:12 Ryan: it was either getting eaten by some software or you're fibbing
00:10:23 Joe: well, did you get the log I just pasted?
00:10:30 Ryan: between which two messages
00:10:40 Joe: only time you ever said the command


00:10:47 Joe: and "lies, they never went through"
00:11:00 Ryan: no all i see is "plus about three times when iw as under windows"
00:11:02 Ryan: put it on pastebin