Shortnote

Snapz Pro X is a marvelous application as an alternative OSX application to fraps. The older version you will find around included a license by David Polis that worked with version of Snapz Pro X previous to 2.2.3. The new version includes a modal window that locks the user in an endless loop and seemingly unable to exit.

Since this one is a little more mean, we load up the Snapz Pro X binary in GDB and perform a backtrace after stepping once into the assembly:

(gdb) start
Function "main" not defined.
Make breakpoint pending on future shared library load? (y or [n]) 
Starting program: /Applications/Snapz Pro X/Snapz Pro X.app/Contents/MacOS/Snapz Pro X 
Reading symbols for shared libraries . done

At this point we get a modal window that does not go away so we send SIGKILL to the Snapz Pro X process in order to detach GDB.

Program received signal SIGKILL, Killed.
0x92635afa in mach_msg_trap ()
(gdb)

Now we run the backtrace to see where that SIGKILL signal was received by Snapz Pro X:

(gdb) bt
#0  0x92635afa in mach_msg_trap ()
#1  0x92636267 in mach_msg ()
#2  0x9014c2df in __CFRunLoopRun ()
#3  0x9014b3c4 in CFRunLoopRunSpecific ()
#4  0x9014b1f1 in CFRunLoopRunInMode ()
#5  0x99e53e04 in RunCurrentEventLoopInMode ()
#6  0x99e53bb9 in ReceiveNextEventCommon ()
#7  0x99fdc084 in _AcquireNextEvent ()
#8  0x99fd2181 in _RunAppModalLoop ()
#9  0x99fd25a5 in RunAppModalLoopForWindow ()
#10 0x0000bdae in ?? ()
#11 0x00002b39 in ?? ()
#12 0x00002a68 in ?? ()

Right, so this seems pretty clear, Snapz Pro X seems stuck in an endless loop with a modal window showing. This is exactly the behavior that we have noticed previously.

We disassemble the binary and search for that modal window with something that looks like a loop. Around address 0xbd3d we find the following loop:

                                       ; Basic Block Input Regs: ebp -  Killed Regs: eax ecx edx esi
0000bd3d 8BB530FEFFFF                    mov        esi, dword [ss:ebp-0x208+var_56]      ; XREF=0xbdd5
0000bd43 8D0CDD00000000                  lea        ecx, dword [ds:0x0+ebx*8]
0000bd4a 8B9524FEFFFF                    mov        edx, dword [ss:ebp-0x208+var_44]
0000bd50 8B8520FEFFFF                    mov        eax, dword [ss:ebp-0x208+var_40]
0000bd56 33840D78FEFFFF                  xor        eax, dword [ss:ebp+ecx-0x208+var_128]
0000bd5d 33540E04                        xor        edx, dword [ds:esi+ecx+0x4]
0000bd61 2578EFDFFB                      and        eax, 0xFBDFEF78
0000bd66 81E2F7FEBD07                    and        edx, 0x7BDFEF7
0000bd6c 89D1                            mov        ecx, edx
0000bd6e 09C1                            or         ecx, eax
0000bd70 7559                            jne        0xBDCB
                                       ; Basic Block Input Regs: ebp -  Killed Regs: eax ecx edx esp esi
0000bd72 8B15B8E20500                    mov        edx, dword [ds:0x5E2B8]
0000bd78 8BB570FEFFFF                    mov        esi, dword [ss:ebp-0x208+var_120]
0000bd7e 8B02                            mov        eax, dword [ds:edx]
0000bd80 89352CE00500                    mov        dword [ds:0x5E02C], esi
0000bd86 890424                          mov        dword [ss:esp], eax
0000bd89 E863F40900                      call       imp___jump_table__ShowWindow
0000bd8e 8B0DB8E20500                    mov        ecx, dword [ds:0x5E2B8]
0000bd94 8B01                            mov        eax, dword [ds:ecx]
0000bd96 890424                          mov        dword [ss:esp], eax
0000bd99 E881F30900                      call       imp___jump_table__SelectWindow
0000bd9e 8B35B8E20500                    mov        esi, dword [ds:0x5E2B8]
0000bda4 8B06                            mov        eax, dword [ds:esi]
0000bda6 890424                          mov        dword [ss:esp], eax
0000bda9 E8FEF20900                      call       imp___jump_table__RunAppModalLoopForWindow
0000bdae C7042401000000                  mov        dword [ss:esp], 0x1
0000bdb5 E864F40900                      call       imp___jump_table__SysBeep
0000bdba C70424D0070000                  mov        dword [ss:esp], 0x7D0
0000bdc1 E85DF40900                      call       imp___jump_table__SystemWait
0000bdc6 E856EC0900                      call       imp___jump_table__ExitToShell
                                       ; Basic Block Input Regs: <nothing> -  Killed Regs: ebx ebp
0000bdcb 43                              inc        ebx                                   ; XREF=0xbd70
0000bdcc FF8570FEFFFF                    inc        dword [ss:ebp-0x208+var_120]
0000bdd2 83FB28                          cmp        ebx, 0x28
0000bdd5 0F8562FFFFFF                    jne        0xBD3D

In the body, we have the RunAppModalLoopForWindow call, then at the end we find jne 0xBD3D which brings us back to 0xBD3D at the start, before the modal window call.

We also find at 0xbd70 a jne over the RunAppModalLoopForWindow which looks interesting becuse if that jump succeeds then the window call never occurs. Thus, we change the jne into a jmp:

0000bd3d 8BB530FEFFFF                    mov        esi, dword [ss:ebp+0xFFFFFFFFFFFFFE30] ; XREF=0xbdd5
0000bd43 8D0CDD00000000                  lea        ecx, dword [ds:0x0+ebx*8]
0000bd4a 8B9524FEFFFF                    mov        edx, dword [ss:ebp+0xFFFFFFFFFFFFFE24]
0000bd50 8B8520FEFFFF                    mov        eax, dword [ss:ebp+0xFFFFFFFFFFFFFE20]
0000bd56 33840D78FEFFFF                  xor        eax, dword [ss:ebp+ecx+0xFFFFFFFFFFFFFE78]
0000bd5d 33540E04                        xor        edx, dword [ds:esi+ecx+0x4]
0000bd61 2578EFDFFB                      and        eax, 0xFBDFEF78
0000bd66 81E2F7FEBD07                    and        edx, 0x7BDFEF7
0000bd6c 89D1                            mov        ecx, edx
0000bd6e 09C1                            or         ecx, eax
0000bd70 E956000000                      jmp        0xBDCB
0000bd75 90                              nop        
0000bd76 90                              nop        
0000bd77 90                              nop        

After that, when we run Snapz Pro X, we get no window modal and the application loads just fine. Enjoy your 2.3.3.