I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and IDAScope but none of them accurately analyze the cryptography. More specifically for iOS, developers use cryptography by using Apple's Common Crypto library. I have found calls made to methods in the library but what I really need are the function arguments for these methods that specify which crypt alg is used, length of the key, initialization vectors, etc. Backtracking to get the function arguments seems too complicated so is there any other way I can go about getting this information? Thanks for any help.
4
-
"I have found calls made to methods in the library but what I really need are the function arguments for these methods that specify which crypt alg is used, length of the key, initialization vectors, etc. Backtracking to get the function arguments seems too complicated" - If by "backtracing" you mean following cross-references to the cryptographic library functions, then 1) you're lucky that those cross-references exist and 2) it's the best way to find the arguments passed to those functions.– Jason GeffnerJul 8, 2016 at 14:08
-
Sorry, there were no cross references. I meant starting from the call to the method and going backward in the disassembly to try to figure out what registers were loaded with before the call was made. However, this has turned out to be more difficult than I thought, especially in static analysis– EccmmsJul 8, 2016 at 14:15
-
1"I meant starting from the call to the method and going backward in the disassembly to try to figure out what registers were loaded with before the call was made." - Yes, that's the correct way to find out what function arguments are passed to the cryptographic library functions.– Jason GeffnerJul 8, 2016 at 15:01
-
2Read up on Objective C internals - particularly message passing. blog.zynamics.com/2010/04/27/objective-c-reversing-i reverse.put.as/wp-content/uploads/2011/06/…. Perhaps do some debugging jeffhui.net/2014/03-reverse-engineering-objective-c.html– Vitaly OsipovJul 9, 2016 at 6:37
Add a comment
|
1 Answer
FindCrypt and IDASignsrch are both plugins used to scan the binary itself for cryptographic algorithm signatures. Non of them try to map API functions (and certainly not for iOS). They work by searching for specific constants and structures nearly always used for specific cryptographic related initialization and hardcoded values.
IDAScope Is a tool that can label functions based on the APIs they're using, so it kind of does what you're looking for but is limited to windows executables and APIs.
