2

I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and IDAScope but none of them accurately analyze the cryptography. More specifically for iOS, developers use cryptography by using Apple's Common Crypto library. I have found calls made to methods in the library but what I really need are the function arguments for these methods that specify which crypt alg is used, length of the key, initialization vectors, etc. Backtracking to get the function arguments seems too complicated so is there any other way I can go about getting this information? Thanks for any help.

4
  • "I have found calls made to methods in the library but what I really need are the function arguments for these methods that specify which crypt alg is used, length of the key, initialization vectors, etc. Backtracking to get the function arguments seems too complicated" - If by "backtracing" you mean following cross-references to the cryptographic library functions, then 1) you're lucky that those cross-references exist and 2) it's the best way to find the arguments passed to those functions. Jul 8, 2016 at 14:08
  • Sorry, there were no cross references. I meant starting from the call to the method and going backward in the disassembly to try to figure out what registers were loaded with before the call was made. However, this has turned out to be more difficult than I thought, especially in static analysis
    – Eccmms
    Jul 8, 2016 at 14:15
  • 1
    "I meant starting from the call to the method and going backward in the disassembly to try to figure out what registers were loaded with before the call was made." - Yes, that's the correct way to find out what function arguments are passed to the cryptographic library functions. Jul 8, 2016 at 15:01
  • 2
    Read up on Objective C internals - particularly message passing. blog.zynamics.com/2010/04/27/objective-c-reversing-i reverse.put.as/wp-content/uploads/2011/06/…. Perhaps do some debugging jeffhui.net/2014/03-reverse-engineering-objective-c.html Jul 9, 2016 at 6:37

1 Answer 1

2

FindCrypt and IDASignsrch are both plugins used to scan the binary itself for cryptographic algorithm signatures. Non of them try to map API functions (and certainly not for iOS). They work by searching for specific constants and structures nearly always used for specific cryptographic related initialization and hardcoded values.

IDAScope Is a tool that can label functions based on the APIs they're using, so it kind of does what you're looking for but is limited to windows executables and APIs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.