Questions tagged [ios]

The operating system by apple for mobile devices

Filter by
Sorted by
Tagged with
0 votes
1 answer
39 views

Is iOS 15 kernel cache encrypted?

I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
user avatar
0 votes
0 answers
20 views

iOS unknown library sending ssl pinned request

Here is my problem: I am trying to access to a ssl pinned request sent by an action I am doing on an iPhone. The action I am making sends two requests: The first one is ssl pinned, sent by a pre-...
user avatar
  • 1
1 vote
1 answer
41 views

Create instance of iOS class that contains a . with frida

I am trying to create an instance of a class of an iOS app using Frida. In the past I have successfully done this using a command such as: var instance = ObjC.chooseSync(ObjC.classes.TestClass)[0]; ...
user avatar
  • 95
1 vote
0 answers
42 views

Backtrace HTTP request over few modules when using FRIDA

I am in the process of reverse engineering an IOS IPA using HOPPER and FRIDA. First, I started with POSTMAN, which records the app's HTTP requests. What I find interesting is that the app uses a so-...
user avatar
1 vote
0 answers
91 views

How to get variable value during IDA (Hex-Rays Decompiler) debugging?

I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below. Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class. How to get ...
user avatar
  • 11
0 votes
0 answers
23 views

Change function implementation

I have a Mach-O 64-bit dynamically linked shared library (ARM64), wrote in Swift/Objective-C language for iOS. Is theoretically possible to open this file in Ghidra or IDA reverse tool, change some ...
user avatar
0 votes
0 answers
34 views

Is there any way to extract sandbox bundles since the implementation of monolithic kernelcaches?

I'm trying to obtain the same result that joker -K <bundle> <kernelcache> used to obtain. I tried using jtool2, but it appears that when I'm trying to extract a bundle nothing happens when ...
user avatar
  • 1
1 vote
1 answer
79 views

Change iOS app binary file

I want to manipulate iOS binary file and change two strings in it. I used hex editor to search and change these strings. But after the binary file is uploaded and replaced with the origin app's binary ...
user avatar
1 vote
0 answers
107 views

Int64 parsing from args in Frida-trace for iOS binaries

I'm using frida-trace to log some methods and I've come across the following. onEnter(log, args, state) { log(`-[Somefunction somefield64:${args[2]}]`) } somefield64 returns what I believe to ...
user avatar
  • 111
0 votes
2 answers
62 views

How to calculate the value needed to branch two points in IDA pro?

I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
user avatar
0 votes
1 answer
151 views

Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?

I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a. I want to check some logic in `xx. ...
user avatar
1 vote
1 answer
168 views

Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida

I am trying to understand the usage of calls to CC_MD5 in an iOS application. From Apple's man page I can see that when it is called it requires 3 arguments: extern unsigned char * CC_MD5(const void *...
user avatar
  • 95
2 votes
1 answer
480 views

Read and write to register with Frida

I have an instruction that looks like this in Ghidra: 100168ff0 e9 13 00 32 orr w9,wzr,#0x1f Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what ...
user avatar
  • 95
2 votes
0 answers
45 views

Attempting to understand non-XZ file signatures within PBZX chunks

After my previous question from nearly a year ago directing me to the YAA format to make sense of the chunks that could be decompressed, this time we're dealing with the chunks that made pbzx tell us ...
user avatar
2 votes
0 answers
63 views

How to find how a hash in generated in an iOS app

I'm currently working on an iOS app to replicate a signature which looks to be generated with a MD5 hash. I'm currently using Frida, but haven't had any luck replicating it. I've used the script to ...
user avatar
  • 21
0 votes
0 answers
59 views

How can i make more space for a bigger string in Hopper disassembler?

i made an ios app which simply change the background color when i tap the button. the goal is to change the color with hopper. I successfully changed the color from blue to red but i cannot change ...
user avatar
1 vote
1 answer
111 views

Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions

I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
user avatar
  • 63
1 vote
1 answer
90 views

What kind of random algorithm is used in this game?

I am playing a game for iOS that uses a deck of 48 cards and I would like to reverse engineer the kind of algorithm that is used to generate the random deck of cards such that I can predict which card ...
user avatar
2 votes
1 answer
505 views

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
user avatar
  • 21
4 votes
1 answer
192 views

Reverse engineer compressed iOS app file

I want to find out the compression method used by an iOS app used for music notation to store its files. The files of its OSX counterpart are zipped files. You cannot create files in the iOS app, but ...
user avatar
0 votes
0 answers
30 views

Is it possible to somehow derive the decryption key for iOS app binaries?

While disassembling an IPA downloaded directly from the App Store CDN, I noticed that the binary had an unusually large entropy. Looking this occurrence up confirmed my suspicion that it was encrypted,...
user avatar
0 votes
1 answer
54 views

Dumping available XPC interface and methods

I'm reading this article, and it says: The following functions are exposed over XPC to the caller: @protocol _TtP4main21ForkLiftHelperProtcol_ - (void)changePermissions:(NSString *)arg1 permissions:(...
user avatar
  • 113
1 vote
0 answers
325 views

How are strokes stored in the Goodnotes file format?

I have been trying to reverse engineer the .goodnotes file format (a note taking app for iOS devices) and so far have discovered this: A .goodnotes file is simply a zip archive, an example file ...
user avatar
2 votes
2 answers
521 views

Attempting to reverse engineer an iOS OTA payload-like archival format

Apple's announcement of macOS Big Sur had meant the release of the developer beta. In an attempt to create the appbundle from Apple's softwarecatalog, I attempted to study the contents of ...
user avatar
2 votes
1 answer
161 views

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it. Pretext: ...
user avatar
1 vote
0 answers
56 views

finding specific string in ios dyld_shared_cache

Im trying to find the library inside a dyld cache that contains a specific string. I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the ...
user avatar
1 vote
0 answers
44 views

Theos Tweak compilation errors [closed]

While attempting to build a Theos tweak, even a templated one created by Theos, I will encounter the following error bash: line 1: 4665 Done swift --version 4667 Broken pipe:...
user avatar
  • 153
1 vote
1 answer
138 views

IDA - ObjC - Meaning of _BYTE and dword_0?

This is my first experience disassembling/reverse engineering, and am having a bit of difficulty keeping up. For reference, I'm trying to uncover the inner workings of a pretty good library in my ...
user avatar
1 vote
1 answer
61 views

Mach-O ARM64 using literal values instead of a frame pointer (BP) register

I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM ...
user avatar
  • 25
2 votes
1 answer
3k views

Using IDA Pro, How can I just "edit" values, Rather than patching Offsets,

I dont understand how people are finding offsets, So I want to know if there's a simple and easy method of just "patching values" I've been surfing the internet looking for VERY in depth ...
user avatar
6 votes
1 answer
490 views

How does IPA decryption works?

All IPAs being downloaded from AppStore gets encrypted on servers as part of FairPlay DRM. But decryption is accomplished on local device. As far as I know there is some hardware module which contains ...
user avatar
  • 161
3 votes
1 answer
2k views

Lipo alternate for linux

Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
user avatar
5 votes
2 answers
8k views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
user avatar
-1 votes
1 answer
6k views

how should i change an instruction to NOP in IDA?

I am new with IDA assembler and i used to work with hopper app. the problem is i can't change instruction in IDA from something like CBNZ to NOP. is there any button to do this? i can't find anything ...
user avatar
  • 3
1 vote
1 answer
588 views

How to identify which iOS kernelcache is installed?

I've an iPhone7 running iOS11.3 (15E216). The ipsw for this build version contains two separate kernelcache files named kernelcache.release.iphone9 and kernelcache.release.iphone10. Neither file is an ...
user avatar
  • 166
9 votes
2 answers
7k views

How difficult is to decompile C++ file?

I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension .cpp. I am also going to create an iOS app which will use the same AES key. Is ...
user avatar
2 votes
0 answers
225 views

(iOS lldb) Unable to debug past a splash/loading screen

I'm trying to lldb debug this certain iOS application. Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity. However, whenever I try to debug ...
user avatar
1 vote
0 answers
598 views

Patching an ipa (iPhone app) using Hopper Disassembler

I have learned in the past to patch some iOS apps to bypass jailbreak detection. Today, I decided to change the UI elements in the Spotify app on iOS Platform (ios 11). I downloaded a .ipa file of ...
user avatar
4 votes
0 answers
250 views

running iOS debugserver on non-jailbroken devices

There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
user avatar
  • 446
0 votes
1 answer
229 views

Newbie here: hidden values in assembly? [closed]

So i'm new to the whole reverse engineering thing with only experience in C#. So I wanted to try and change the framerate of applications (eg. this unity game) at an assembly level on iOS ( I have an ...
user avatar
1 vote
1 answer
1k views

iOS entitlements for enable calling to private API

I'd like to analyze iOS private framework that broke commonly used GitHub project called AppLister. Here's some info about the API: Framework : MobileCoreServices.framework. Class: ...
user avatar
  • 273
1 vote
1 answer
658 views

Getting MobileCoreServices.framework binary in iOS11 [closed]

I'd like to try and fix some open source GitHub project that uses the allApplications from LSApplicationWorkspace call from private API which list all installed application on the device. The method ...
user avatar
  • 273
2 votes
1 answer
326 views

Why function names are visible in a decompiled iOS app?

While decompiling an iOS app, all function names and object names are visible. Why ? My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
user avatar
1 vote
0 answers
708 views

Functions window empty for some ipa using ida pro

I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it ...
user avatar
1 vote
1 answer
3k views

Download and Decompile an Ios app [closed]

I want to write an automatic process that downloads an ios app and decompile it? I couldn't find any source or method to download an ios app without using any Apple Device.
user avatar
0 votes
1 answer
244 views

How relaunch iOS app once ASLR has been disabled?

On a jailbroken iOS device, I have successfully decrypted an app, and disabled ASLR, thanks to the hundredth of tutorials available. But then, none explain how relaunch the app once ASLR has been ...
user avatar
0 votes
1 answer
1k views

charles proxy only showing portion of requests?

So i wanted to see the endpoints of this android/ios app calles "Bigo Live". Like always, i've set up charles and started trackig. Funnily, it only shows part of the traffic. for example: If i use ...
user avatar
  • 1
0 votes
1 answer
142 views

Accidently removed cordova platform ios folder [duplicate]

I was trying to uninstall a plugin but accidently ran the command cordova platform remove ios and it removed the app code on my macbook. I don't see anything in trash as well. Is there any way to ...
user avatar
3 votes
1 answer
446 views

How does the 'graphic views' on Hopper Disassembler work?

I would like to understand better what is that information on "graphic views" at the inspector of Hopper Disassembler. I've checked the tutorial but it just skips this section. Thanks.
user avatar
3 votes
0 answers
546 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
user avatar
  • 1,196