How were payload injection offsets determined?

[tsujp]

Hello once again @koekeishiya!

I've been scouring the Issues tab for about an hour now and I cannot find the thread I (think I) saw a few months ago where someone asked how you figured out the offsets and what not for the scripting payload injection into Dock.app. You mentioned someone having a good guide and linked it too I believe.

I'm looking to do some hacking on Yabai now and I am wondering if that thread exists (I'm very sure it does but I cannot find it) and was wondering if you had some material or guidance on reverse engineering these things to figure out what you have with regards to injecting code into macOS processes, and Dock.app.

[tsujp]

Oh my goodness the second I posted this I realised I didn't do a search for reverse offset on the Issues tab, and sure enough I found it!

#971

[koekeishiya]

I don't think I really have more notes than what is written in that issue.

[tsujp]

Roger. I'll leave this up and/or suggest you do too if only for more search terms to match against for others who may hunt for the same information as I was?

[tsujp]

I don't think I really have more notes than what is written in that issue.

Also, a thank you for the explanation too on that Issue thread by the way :)