Questions tagged [ios]
The operating system by apple for mobile devices
133 questions
0
votes
0
answers
27
views
Is a macOS System Call Tracing & Visualization Tool Useful?
I’m a beginner in reverse engineering and thinking of building a tool to trace and visualize system calls on macOS. The idea is to make something simpler than DTrace or Instruments, with an intuitive ...
- 13
0
votes
0
answers
48
views
How the 'Secure Application ROM (SAROM)' works ? and how can be decrypted?
There is a protection product that i'm interested in analyzing and breaking it called SAROM that encrypts sensitive information that stored in the client-side such as API Keys/hardcoded stuff. I tried ...
- 137
0
votes
0
answers
37
views
Recreating a custom bplist-derivative data type
I am trying to recreate a custom file type used by an iOS app. I analyzed its binary (image below)
and it seems to be a bplist00, however I can't inspect it with any tools like plutil. Plutil returns ...
- 1
0
votes
1
answer
104
views
Function calls to unmapped memory
I'm examining an iOS framework (extracted from a dyld shared cache) and there are a lot of branch-link instructions to functions which don't exist. For example,
bl #-0x50e7e04
Performing the ...
0
votes
1
answer
50
views
Location of CoreMedia framework
I've been attempting to dive into mediaserverd which runs on iOS. Pulling the binary and running otool -L on it reveals, unsurprisingly, that it's linked against /System/Library/Frameworks/CoreMedia....
0
votes
0
answers
125
views
Hooking a Swift method with frida on iOS to inspect DSA signing arguments
I have an iOS app that is sending a DSA signature with certain requests. Initially, I would just like to be able to hook the method performing the signing and dump the arguments.
In ghidra, I can see ...
- 187
0
votes
0
answers
111
views
Searching for a byte pattern and then hooking all instances of it using frida on iOS
I'm using a frida script to scan for a certain byte pattern when I launch an iOS app.
I can log each offset and confirm these are correct by also printing out the instructions at those locations and ...
- 187
0
votes
0
answers
39
views
Analyzing USB traffic coming from XCode -> iPhone via USBC/Lightning cable
I tried posting this on stack overflow with no luck, hoping I can get some more answers here.
have an app running on my iPhone via XCode by way of USBC -> Lightning cable. I would like to analyze ...
- 133
0
votes
0
answers
122
views
Reverse engineering Objective-C blocks
I'm highly experienced with objective-c reverse engineering, but every time I encounter a block representation in the decompiler, right before it is passed as an argument to a function, I can ...
2
votes
1
answer
345
views
MachO chained fixups parsing
I'm wondering how the info stored in the chained fixups in the Mach-O file is used to resolve binding and rebases?
My question originated from wanting to parse all the Objective-C classes inside a ...
- 185
0
votes
1
answer
301
views
Extracting obj-c class list from a machO
I'm trying to analyze and get the full list of selectors and their related classes in objective-c by first reading the __objc_classlist section and getting pointers to the struct objc_class list to ...
- 185
1
vote
0
answers
83
views
Is a jailbroken iPhone is necessary to extract the ipa of a pre-installed app like iMessage?
My research notes: https://docs.google.com/document/d/1Y-2SZX4s1E1Mq9yWHZMMBzW3BJTfUuMl-YYXoZlY73w/edit?usp=sharing
From my research, I have come to the understanding that in order to extract the ipa ...
- 21
1
vote
1
answer
358
views
Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?
In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf
Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
- 21
1
vote
0
answers
244
views
Get all names of functions from an iOS-App binary (headless)
Setup:
I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
2
votes
1
answer
383
views
Deobfuscating IOS dll file (I think arm64)
I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes.
I have ...
4
votes
0
answers
712
views
Decoding the Apple vendor tag in the 802.11 beacon
Background
Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a ...
- 41
2
votes
0
answers
92
views
Reverse Engineer Using Class-dump
I have tried to look into the class-dump of a decompiled ipa file, can I assume that only : TtCC29XYZ18JailbreakDetection12RuntimeClass is of remarkable because it has - (long long)...
- 161
4
votes
1
answer
70
views
Trying to use Cycript to access element in the current windpws
I am using cycript,but I have tried some of these commands and not sure where I went wrong.
cy# UIApp.windows[0]
#"<UIWindow: 0x102d0b2d0; frame = (0 0; 320 568); gestureRecognizers = <...
- 161
3
votes
0
answers
59
views
db section in hopper
There is a db section in hopper, which cause the code not being able to go to control follow graph mode
Do advise what cause this issue:
; Section __cstring
; Range: [0x10000a2c0; ...
- 161
3
votes
1
answer
117
views
Hopper - no CFG leaving procedure at this address
Where is it that, when I am at a procedure with a lot of db, hopper will not show the control flow graph.
How do I make the db change to a regular assembly symbol like mov,add,ret etc.
What cause the ...
- 161
2
votes
0
answers
142
views
Input file (Hello_World) is neither a Mach-O file nor a fat archive: Class-dump
I am trying to use class-dump in iPhone 14.3. However, there is an error. Can you advise?
ANT-iPhone:/var/containers/Bundle/Application/61669A90-8CF9-4991-943F-5E9F097A3A5B/Hello_World.app root# otool ...
- 161
1
vote
0
answers
457
views
// This file does not contain any Objective-C runtime information
I am trying to reverse engineer a file with class-dump but it says objective-c header is not found. This is clearly an objective C file.
2023-03-03 22:26:21.789 class-dump[5565:85760] Unknown load ...
- 161
2
votes
1
answer
4k
views
Decompile and Re-compile iOS app (.ipa file)
As a part of college project, I have to showcase how I can get ios app from jailbroken devices and reverse-engineer it. In the first part of slide, I am showing how we can get the IPA file from ...
- 211
3
votes
0
answers
205
views
Solved: Unable to hook Apple binary on iOS 14.x with Frida
I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to ...
- 31
3
votes
1
answer
93
views
Does anyone know the purpose of the malware,ios,social_engineering file on iOS
I have a jailbroken iPhone, and I noticed that it contains a file called social_engineering,ios,url_expression at the path:
/private/var/mobile/Library/Caches/com.apple.Safari.SafeBrowsing/Google/...
- 131
2
votes
0
answers
164
views
Access a XREFs with frida
I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
- 51
2
votes
1
answer
567
views
frida hook `loc_*` or `sub_*`
Is it possible to hook a sub_... object in Frida ? I disassembled an arm64 executable, when running the app on my iPhone, I can see a lot of classes also in the disassembled executable, but I can't ...
- 51
0
votes
0
answers
78
views
Reading variables modified by pass by reference
Reading arguments as well as return values is pretty trivial when utilizing Frida. But is there any way to read data that is modified through pass by reference. I am attempting to read some data in an ...
- 101
1
vote
1
answer
789
views
Frida script returning different instruction at address compared to entering commands in repl
I have an iOS device on 14.2 and am using frida 15.2.2 on Ubuntu 18.04.
If I launch an app via frida, in the repl I can get the base address of the module, add an offset to that address, and print the ...
- 187
3
votes
1
answer
275
views
IOS ASLR address calculation with delta offset (ARM64)
I am learning LLDB to debug ios apps, I have a jailbroken iPhone IOS 14.3 and a debugserver.
Screenshot of start connect to remote process:
Sections of my process(image dump sections hidenseek):
...
- 71
2
votes
0
answers
353
views
how to find a string in memory having ARM instructions ARDP and LDR?
hello, I disassembled the request sent to the game server, I need to change the symbol, but I don’t know its memory address. Help me understand the ADRP and LDR instructions, I need to understand what ...
- 71
2
votes
1
answer
151
views
strange arm construct in objective-c application
I was reversing the objective-c application and stumbled upon an assembler construction that I don't understand:
This is call of some function with SP register (+ 0x18 offset) as parameter. (Picture1)....
- 21
3
votes
0
answers
178
views
Trying to understand a simple compiled PSI binary file
I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (...
- 253
3
votes
2
answers
406
views
Is iOS 15 kernel cache encrypted?
I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
user41084
0
votes
0
answers
72
views
iOS unknown library sending ssl pinned request
Here is my problem:
I am trying to access to a ssl pinned request sent by an action I am doing on an iPhone. The action I am making sends two requests:
The first one is ssl pinned, sent by a pre-...
- 51
1
vote
1
answer
648
views
Create instance of iOS class that contains a . with frida
I am trying to create an instance of a class of an iOS app using Frida.
In the past I have successfully done this using a command such as:
var instance = ObjC.chooseSync(ObjC.classes.TestClass)[0];
...
- 187
2
votes
0
answers
832
views
Backtrace HTTP request over few modules when using FRIDA
I am in the process of reverse engineering an IOS IPA using HOPPER and FRIDA. First, I started with POSTMAN, which records the app's HTTP requests. What I find interesting is that the app uses a so-...
- 21
1
vote
0
answers
1k
views
How to get variable value during IDA (Hex-Rays Decompiler) debugging?
I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below.
Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class.
How to get ...
- 11
1
vote
1
answer
445
views
Change iOS app binary file
I want to manipulate iOS binary file and change two strings in it. I used hex editor to search and change these strings. But after the binary file is uploaded and replaced with the origin app's binary ...
1
vote
0
answers
302
views
Int64 parsing from args in Frida-trace for iOS binaries
I'm using frida-trace to log some methods and I've come across the following.
onEnter(log, args, state) {
log(`-[Somefunction somefield64:${args[2]}]`)
}
somefield64 returns what I believe to ...
- 111
0
votes
2
answers
171
views
How to calculate the value needed to branch two points in IDA pro?
I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
0
votes
1
answer
490
views
Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?
I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a.
I want to check some logic in `xx. ...
- 1
1
vote
1
answer
614
views
Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida
I am trying to understand the usage of calls to CC_MD5 in an iOS application.
From Apple's man page I can see that when it is called it requires 3 arguments:
extern unsigned char *
CC_MD5(const void *...
- 187
2
votes
1
answer
3k
views
Read and write to register with Frida
I have an instruction that looks like this in Ghidra:
100168ff0 e9 13 00 32 orr w9,wzr,#0x1f
Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what ...
- 187
2
votes
0
answers
79
views
Attempting to understand non-XZ file signatures within PBZX chunks
After my previous question from nearly a year ago directing me to the YAA format to make sense of the chunks that could be decompressed, this time we're dealing with the chunks that made pbzx tell us ...
2
votes
0
answers
262
views
How to find how a hash in generated in an iOS app
I'm currently working on an iOS app to replicate a signature which looks to be generated with a MD5 hash. I'm currently using Frida, but haven't had any luck replicating it. I've used the script to ...
- 21
1
vote
1
answer
134
views
How can I make more space for a bigger string in Hopper disassembler?
I made an iOS app that simply changes the background color when I tap the button. the goal is to change the color with Hopper. I successfully changed the color from blue to red but I cannot change ...
- 31
1
vote
1
answer
135
views
Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions
I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
- 63
1
vote
1
answer
112
views
What kind of random algorithm is used in this game?
I am playing a game for iOS that uses a deck of 48 cards and I would like to reverse engineer the kind of algorithm that is used to generate the random deck of cards such that I can predict which card ...
- 19
2
votes
1
answer
2k
views
Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated
I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
- 21