Level 1

4 points

Please translate this route executable

I Copied an executable below that I found inside my iMac's sbin folder under the name "route". I understand that the file itself is a perfectly normal part of the system but what I find odd is what's inside it... I've compared the text portion of that executable to other computers and cannot find another even close to what I have here, there is no mention of black holes whatsoever. I've talked to one other person who said that it appears to be an attempt to rewrite the routing tables and change my network interface but he ultimately directed me here. Anything you can tell me about this would be greatly appreciated, i need to verify that is or is not Apple code with Apple before anything else. By the way, I'm not paranoid, I have good reason to suspect mischief here. I'll just leave it at that.

H__PAGEZEROÿ__TEXT@@__text__TEXTº`,ºÄ__stubs__TEXT3n3Ä__stub_helper__TEXTå4rå4Ä_ _cstring__TEXT7T7__unwind_info__TEXTT?†T?(__DATA@ @__nl_symbol_ptr__DATA@@=__got__DATA@ @?__la_symbol_ptr__DATA0@Ë0@C__data__DATA B` B__bss__DATAÄG(__common__DATA®J‰H__LINKEDIT`0P∞""Ä0PP`pPpT ÿTD[»

PBYÄ /usr/lib/dyldpËy/1R±6‡+ãßÕ$

(Ä8Ω/usr/lib/libSystem.B.dylib

addblackholechangecloningdeletedstexpireflushgatewaygenmaskgethosthopcountifacei nterfaceifaifpinetinet6isolinkllinfolocklockrestmaskmonitormtunetnetmasknostatic osiprefixlenproto1proto2recvpiperejectrttrttvarsasendpipessthreshstaticx25xnsxre solveifscopebad keyword: %susage: route [-dnqtv] command [[modifiers] args]

nqdtv/dev/nullsocketmust be root to alter routing tableroute-sysctl-estimatemalloc failedroute-sysctl-getwrite to routing socketgot only %d for rlen

%-20.20s default%u.%u.%u.%uinvalid(%d) %x%u%u.%u%u.%u.%uaf %d:bad interface nameinvalid mask: %s%s %s %s: gateway %s (%s): %s

getifaddrsinternal error%s: %s

bad address: %sprefixlen not supported in this af

%s: bad value

actual retrieval of interface table

got message of size %d on %suwriting to routing socket: %sread from routing socketRTM_ADD: Add RouteRTM_DELETE: Delete RouteRTM_CHANGE: Change Metrics or flagsRTM_GET: Report MetricsRTM_LOSING: Kernel Suspects PartitioningRTM_REDIRECT: Told to use different routeRTM_MISS: Lookup failed on this addressRTM_LOCK: fix specified metricsRTM_OLDADD: caused by SIOCADDRTRTM_OLDDEL: caused by SIOCDELRTRTM_RESOLVE: Route created by cloningRTM_NEWADDR: address being added to ifaceRTM_DELADDR: address being removed from ifaceRTM_IFINFO: iface status changeRTM_NEWMADDR: new multicast group membership on ifaceRTM_DELMADDR: multicast group membership removed from ifacerouting message version %d not understood

%s: len %d, if# %d, flags:metric %d, flags:pid: %ld, seq %d, errno %d, ifscope %d, ifref, flags: route to: %s

routing message version %d not understoodmessage length mismatch, in packet %d, returned %dmessage indicates error %ddestination: %s

mask: %s

gateway: %s

interface: %.*s

flags:

recvpipe sendpipe ssthresh rtt,msec rttvar hopcount mtu expire%8u%c %8d%c

sockaddrs:

locks: inits:

sockaddrs: %s%s: link %s; %s: inet %s; 064128not in tableentry in userouting table overflowdoneExamining routing table from sysctl00—Xa

ºHH3HTG,!

¿£„„Î"ù#%€(G)*≈*+\+!ú4¶4∞4∫4ƒ4Œ4ÿ4‚4Ï4ˆ45

555(525<5F5P5Z5d5n5x5Ç5å5ñ5†5™5¥5æ5»5“5‹5Ê55˙5666"6,666@6J6T6^6h6r6|6Ü6ê6ö6§6Æ6 ∏6¬6Ã6÷6‡6Í6Ù677777$7(7/757 =7

I7N7

pksentrttvarrttssthreshsendpiperecvpipeexpirehopcountmtuUPGATEWAYHOSTREJECTDYNAM ICMODIFIEDDONEDELCLONE CLONING

XRESOLVE

LLINFOSTATIC

BLACKHOLEb016PROTO2PROTO1PRCLONINGWASCLONEDPROTO3b024PINNEDLOCALBROADCASTMULTICA STIFSCOPECONDEMNEDIFREFPROXYROUTERUPBROADCASTDEBUGLOOPBACKPTPb6RUNNINGNOARP PPROMISC

ALLMULTI

OACTIVESIMPLEX

LINK0LINK1LINK2MULTICASTDSTGATEWAYNETMASKGENMASKIFPIFAAUTHORBRD"0`=AÄ-p(`@___sta ck_chk_guardQrê@___stderrpê@___stdoutpê@_optindê@dyld_stub_binderÄ–ˇˇˇˇˇˇˇˇêr0@_ __bzeroêr8@___errorêr@@___memcpy_chkêrH@___memmove_chkêrP@___snprintf_chkêrX@___ stack_chk_failêr`@___strlcpy_chkêrh@_atoiêrp@_bcopyêrx@_ctimeêrÄ@_errêrà@_errxêr ê@_exitêrò@_fflushêr†@_fprintfêr®@_freeaddrinfoêr∞@_freeifaddrsêr∏@_fwriteêr¿@_g ai_strerrorêr»@_getaddrinfoêr–@_geteuidêrÿ@_gethostbyaddrêr‡@_gethostbynameêrË@_ gethostnameêr@_getifaddrsêr¯@_getnameinfoêrÄ@_getnetbyaddrêrà@_getnetbynameêrê@ _getoptêrò@_getpidêr†@_if_nametoindexêr®@_indexêr∞@_inet_addrêr∏@_inet_lnaofêr¿@ _inet_networkêr»@_inet_ntoaêr–@_link_addrêrÿ@_link_ntoaêr‡@_mallocêrË@_memcpyêr @_memsetêr¯@_openêrÄ@_printfêrà@_putcêrê@_putcharêrò@_putsêr†@_readêr®@_setuidêr ∞@_shutdownêr∏@_socketêr¿@_strchrêr»@_strcmpêr–@_strerrorêrÿ@_strlenêr‡@_strncpy êrË@_strtoulêr@_sysctlêr¯@_timeêrÄ@_warnêrà@_warnxêrê@_writeê__mh_execute_heade rº

@AB__mh_execute_header___bzero___error___memcpy_chk___memmove_chk___snprintf_chk ___stack_chk_fail___stack_chk_guard___stderrp___stdoutp___strlcpy_chk_atoi_bcopy _ctime_err_errx_exit_fflush_fprintf_freeaddrinfo_freeifaddrs_fwrite_gai_strerror _getaddrinfo_geteuid_gethostbyaddr_gethostbyname_gethostname_getifaddrs_getnamei nfo_getnetbyaddr_getnetbyname_getopt_getpid_if_nametoindex_index_inet_addr_inet_ lnaof_inet_network_inet_ntoa_link_addr_link_ntoa_malloc_memcpy_memset_open_optin d_printf_putc_putchar_puts_read_setuid_shutdown_socket_strchr_strcmp_strerror_st rlen_strncpy_strtoul_sysctl_time_warn_warnx_writedyld_stub_binderradr://5614542˙ ﬁ¿M$D˙ﬁ‡h0]‡com.apple.rout

iMac, iOS 9.3.2

Posted on Jun 4, 2016 9:22 PM

30 replies

ManSinha

Level 6

12,183 points

Jun 5, 2016 8:53 AM in response to Clogan75

The only thing on that Etrecheck report that jumps out is little snitch - I would remove it

Clogan75 Author

Level 1

4 points

Jun 5, 2016 9:02 AM in response to ManSinha

YYes, I will. I just recently installed it.

Clogan75 Author

Level 1

4 points

Jun 5, 2016 9:40 AM in response to Clogan75

Etresoft... Do you have any insight? Perhaps someone could point me to another resource that could help me understand standard source code vs deviations from?i really to verify with Apple that this wasnt installed on my computer when I bought it before I move on to the next level.

lkrupp

Level 7

22,633 points

Jun 5, 2016 9:42 AM in response to Clogan75

If you are concerned that someone has hacked or altered files on your computer your best course of action would be to completely erase your hard drive and reinstall from scratch, after backing up your important data files of course.

Clogan75 Author

Level 1

4 points

Jun 5, 2016 9:49 AM in response to lkrupp

Thank you for your reply, I'm right in the middle of a legal action so I don't want to do that just yet, Im looking to verify and find out what was done to my computer right now but will when this is all over. Can you offer any insight here? I need to verify with Apple that this is not "stock" per say before I submit it for forensic analysis.

wwhat does a "stock" route file look like?

MadMacs0

Level 5

5,233 points

Jun 5, 2016 10:26 AM in response to ManSinha

ManSinha wrote:

The only thing on that Etrecheck report that jumps out is little snitch - I would remove it

I'm not sure why you would say that. LS is a great firewall tool for revealing any nefarious communications being made to and from his computer.

MadMacs0

Level 5

5,233 points

Jun 5, 2016 10:29 AM in response to Clogan75

Upload those two files to VirusTotal and see what it has to say.

Clogan75 Author

Level 1

4 points

Jun 5, 2016 1:54 PM in response to MadMacs0

TThere does not appear to be a virus, can someone please direct me to the proper Apple resource, I really need to verify this with Apple.

red_menace

Level 6

17,066 points

Jun 5, 2016 2:03 PM in response to Clogan75

Use the Contact link at the bottom of any Apple page.

etresoft

Level 9

56,680 points

Jun 5, 2016 2:30 PM in response to Clogan75

Clogan75 wrote:

IM involved in a complicated legal battle at the moment with a group of people that have fantastic resources, in a related incident, I had a home intrusion a while ago and a security camera recorded a man at my computer for almost twenty minutes. does this appear to be a hack?

Hello again Clogan75,

And you are still using this machine, and typing your passwords into it? Oh well...

I don't see anything too unusual about your EtreCheck report. It doesn't report any adware, malware, or key loggers. The most unusual part about it is how well your old 2009 machine is running El Capitan. If you can find out who that person was and what he did to your machine, maybe hire him as a computer technician. He was probably just looking for something valuable. In theory, of course, someone with physical access could install all kinds of nasty stuff, perhaps into firmware locations where you would never find it. There might be dozens of people who know how to do that in the whole world. I doubt there is anything to worry about. If you suspect that you were targeted for some reason, then don't ask us, ask the head of your security staff. If you don't have any personal security staff, then you probably weren't targeted.

In any event, you can investigate binaries by pasting the text content into a web forum. Luckily, you and I both haven't upgraded to 10.11.4. If you run the following commands, you can verify the validity of your executable. Here is the output from my Terminal:

/tmp $ cksum /sbin/route

3433290611 33344 /sbin/route

/tmp $ codesign -vv -R="anchor apple" /sbin/route

/sbin/route: valid on disk

/sbin/route: satisfies its Designated Requirement

/sbin/route: explicit requirement satisfied

/tmp $

MadMacs0

Level 5

5,233 points

Jun 5, 2016 4:38 PM in response to etresoft

etresoft wrote:

Luckily, you and I both haven't upgraded to 10.11.4. If you run the following commands, you can verify the validity of your executable.

FYI, I get identical results from the newer system I'm currently running.

Clogan75 Author

Level 1

4 points

Jun 5, 2016 5:59 PM in response to MadMacs0

I understand that you come across paranoid people who misunderstand but your comments here are naive, I assure you that I am the target of men with ill intent. I do not question the files validity, I'm sure the arguments are met. I would like to try posting this to another forum where I can obtain further information about Apples use of black holes, could you please offer some direction, I would greatly appreciate it.

red_menace

Level 6

17,066 points

Jun 5, 2016 7:27 PM in response to Clogan75

I think you are reading way too much into the names of variables or text constants or whatever that are used in the executable. Taking a look at the man page, "blackhole" looks to just be a command line modifier flag to "silently discard pkts (during updates)".

Regardless of the text symbols used, you are not likely to find many forums that Apple engineers are members of. You are going to have to contact Apple directly for the kind of detail you are looking for.

Edit: changed link to Apple's (retired) documentation library

MadMacs0

Level 5

5,233 points

Jun 5, 2016 9:23 PM in response to Clogan75

My reply was to Etresoft, but since you are apparently no longer attempting to verify the validity of the route executable, I would agree that there isn't much more we users can offer you.

Clogan75 wrote:

I would like to try posting this to another forum where I can obtain further information about Apples use of black holes, could you please offer some direction, I would greatly appreciate it.

There is no publicly available Apple forum for such a discussion. You might be able to engage an Apple Engineer eventually by joining the Apple Developer Program, although even that is a long shot. As others have mentioned, you can attempt to get answers by navigating the AppleCare maze, but be prepared to spend at least a day getting to the appropriate level for technical answers such as these. If you are asking for proprietary information, then it may be impossible.

Clogan75 Author

Level 1

4 points

Jun 6, 2016 5:05 AM in response to MadMacs0

Thank you all for your help, I will try AppleCare. If anyone happens to know where I could locate a "stock" route script I would greatly appreciate it.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Please translate this route executable