Which methods/calls perform the disk I/O operations and how to find them?

Question

1. Which methods and system calls should I hook into, so I can replace 'how' an OS X app (the target) reads and writes to/from the HD?.
2. How may I determine that list of functions or system calls?.

Adding more context: This is a final project and I'm looking for advise. The goal is to alter the behavior of an OS X app, adding it data encryption and decryption capabilities.

3. Which tools could I use to achieve my goal, and why?

For instance, assume the target app is Text Edit. Instead of saving "hello world" as plain text in a .txt file in the HD, it'll save: "ifmmnXxnpme". Opening the file will show the original text.

Answer 1

I think its better to get more realistic or at least conscious of what you want to do.

---

The lowest level in software is a kernel module on top of the storage modules, that "encrypt" the data.
In Windows you can stack drivers, so conceptually you simply intercept the call for a read/write, edit it and pass it down the driver stack.
Under BSD there is an equivalent mechanism surely, but I don't know precisely what it is.

I don't think you want to dig into kernel programming.

---

At the lowest level from an user space application point of view, there are the system calls.
The system calls used to write and read are respectively the number 3 and 4 (see here ), in BSD derived OS, like OS X, they becomes 2000003h and 2000004h (see here ).
This IA32e specific since you are using Apple computers.

Files can be read/written by memory mapping them, so you would need to hijack the system call sys_mmap too.
This is more complex as you need to detect page faults or any mechanism used to implement file mapping.

To hijack system calls you need a kernel module again.

---

The next upper level of abstraction is the runtime, that probably is the Obj C runtime (up to data, Swift still use Obj C runtime AFAIK).

An Obj C application use the Cocoa Framework and can read/write to file with calls like [NSData dataWithContentOfFile: myFileName] or [myData writeToFile: myFileName atomically:myAtomicalBehavior] .
There are plenty of Cocoa methods that write to or read from file, but internally the framework will use few methods from the Obj C runtime. I'm not an expert of the internals of Cocoa, so you need to take a debugger and look what the invocation chain is.

Once you have found the "low level" methods that read or write to files you can use method swizzling .

If the target app load your code as part of a library, this is really simple, otherwise you need more clever techniques (like infecting or manipulating the memory of the other process directly). You can google around for more info.

Again to be honest this is still a lot of work, although manageable.
You may consider to simply hijack a limited set of Cocoa methods, for example the writeToFile of NSData or similar for NSString and consider the project a work in progress demo.

---

A similar question has been asked and answered here .