Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ios]

The operating system by apple for mobile devices

9
votes
2answers
5k views

How difficult is to decompile C++ file?

I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension .cpp. I am also going to create an iOS app which will use the same AES key. Is ...
0
votes
0answers
25 views

How to search heap memory with lldb

Is there a way to search a sequence of bytes in heap memory with lldb? How would you find the memory arenas allocated for heap’s use?
0
votes
0answers
171 views

iOS patching/overwriting free provision expiration date properly

I'm trying to find a way to overwrite the embedded.mobileprovision file to change the expiration date value. This is all done on an app made by me and was prompted by annoyance of a very short ...
2
votes
0answers
33 views

(iOS lldb) Unable to debug past a splash/loading screen

I'm trying to lldb debug this certain iOS application. Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity. However, whenever I try to debug ...
1
vote
0answers
127 views

Patching an ipa (iPhone app) using Hopper Disassembler

I have learned in the past to patch some iOS apps to bypass jailbreak detection. Today, I decided to change the UI elements in the Spotify app on iOS Platform (ios 11). I downloaded a .ipa file of ...
3
votes
0answers
124 views

running iOS debugserver on non-jailbroken devices

There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
0
votes
1answer
101 views

Newbie here: hidden values in assembly? [closed]

So i'm new to the whole reverse engineering thing with only experience in C#. So I wanted to try and change the framerate of applications (eg. this unity game) at an assembly level on iOS ( I have an ...
1
vote
1answer
672 views

iOS entitlements for enable calling to private API

I'd like to analyze iOS private framework that broke commonly used GitHub project called AppLister. Here's some info about the API: Framework : MobileCoreServices.framework. Class: ...
0
votes
1answer
253 views

Getting MobileCoreServices.framework binary in iOS11 [closed]

I'd like to try and fix some open source GitHub project that uses the allApplications from LSApplicationWorkspace call from private API which list all installed application on the device. The method ...
2
votes
1answer
170 views

Why function names are visible in a decompiled iOS app?

While decompiling an iOS app, all function names and object names are visible. Why ? My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
1
vote
0answers
223 views

Functions window empty for some ipa using ida pro

I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it ...
0
votes
1answer
1k views

Download and Decompile an Ios app [closed]

I want to write an automatic process that downloads an ios app and decompile it? I couldn't find any source or method to download an ios app without using any Apple Device.
0
votes
1answer
100 views

How relaunch iOS app once ASLR has been disabled?

On a jailbroken iOS device, I have successfully decrypted an app, and disabled ASLR, thanks to the hundredth of tutorials available. But then, none explain how relaunch the app once ASLR has been ...
0
votes
1answer
235 views

charles proxy only showing portion of requests?

So i wanted to see the endpoints of this android/ios app calles "Bigo Live". Like always, i've set up charles and started trackig. Funnily, it only shows part of the traffic. for example: If i use ...
0
votes
1answer
83 views

Accidently removed cordova platform ios folder [duplicate]

I was trying to uninstall a plugin but accidently ran the command cordova platform remove ios and it removed the app code on my macbook. I don't see anything in trash as well. Is there any way to ...
2
votes
1answer
217 views

How does the 'graphic views' on Hopper Disassembler work?

I would like to understand better what is that information on "graphic views" at the inspector of Hopper Disassembler. I've checked the tutorial but it just skips this section. Thanks.
1
vote
0answers
279 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
0
votes
1answer
54 views

Changing NSUserDefaults of a mac or iOS binary executable

I have an executable of a mac or ios app. This app uses a value stored for a key in NSUserDefaults to change app's flow. It looks something like below code, If( value set in user details ) ...
5
votes
1answer
746 views

getting function address by reading ADRP and ADD instruction values

Hello reverse engineers, I'm analysing a fat Macho-O binary, and it has an ADRP and an ADD instruction in it. I'm talking about these instructions: __text:00000001002E050C ADRP ...
2
votes
0answers
139 views

Analysis Apps for iOS10/64Bit

I need to analyze an iOS app. Since it's iOS 10 64Bit (jailbroken) this time, I'm desperately looking for good analysis tools for injecting, manipulating, anti-anti-jailbreak, tracing, and so on. I ...
1
vote
1answer
142 views

iOS Position-independent code and relocations

I'm reversing few iOS Mach-O application executables these days and all of them use Position-independent code (PIC; the MH_PIC flag is set). I've been expecting a large number of relocation entries (...
1
vote
1answer
244 views

Mach-O : Convert virtual address to file offset on disk

Hello reverse engineers, I am reverse engineering a Mach-O executable for iOS. File says: Mach-O universal binary with 2 architectures: [arm_v7: Mach-O arm_v7 executable] [64-bit architecture=12]. I ...
3
votes
1answer
1k views

How does Apple enforce the expiration of beta apps distributed through TestFlight

A beta app expired after a period of time. But after some investigated on the ipa file, both the certificate and the mobile provisioning profile embedded in the bundle are not expired. How can Apple ...
-3
votes
1answer
829 views

Dumping ipa file on iOS 10.2 [closed]

Is there a way to dump .ipa file on iOS 10.2 (jailbroken) for future reverse-engineering? Tried to use Clutch, it doesn't dump the app. Just exits with 2017-03-13 23:17:24.702 Clutch[2195:100953] ...
1
vote
1answer
79 views

Reverse engineering ARM PIC

I'm starting to learn reverse engineering so I'm trying to reverse sample app, compiled for ARM(iOS) and now I'm looking into code. This section is right before WHILE and right at the beginning of ...
3
votes
1answer
129 views

No LC_UNIXTHREAD segment in iOS application Mach-O

I'm analyzing load commands section of executable Mach-O file in iOS 9.3.3, Twitter app is used for ilustration. # otool -hV Twitter Twitter: Mach header magic cputype cpusubtype caps ...
9
votes
1answer
3k views

How are Apple App Store Apps encrypted?

I know how to decrypt an iOS app use tools. How is this encryption performed? Why can iOS apps only be decrypted on a device? Is there a device-specific key used for encryption?
0
votes
2answers
524 views

Add new subroutine using IDA for ARM binary

I am trying to recreate a patch for an ARM binary. As it shows in attached picture, I have provided the before and after sections of file. In patched file, a new subroutine is added in a cave, and ...
-1
votes
1answer
102 views

Will jailbreaking affect file system accessibility for all apps?

I find that on a jailbroken device I can access /Applications/ in a normal app from app store, although I thought due to the sandbox I shouldn't. Maybe I should write an app to determine what ...
0
votes
1answer
236 views

reversing ios notes file format [closed]

I am trying to understand how to read iOS notes files as they are saved in the NoteStore.sqlite database in the iOS backup. Here are some sample files. Each file is a different note. I want to get ...
1
vote
0answers
55 views

Reverse Engineer an iOS MP4 Bug [duplicate]

Recently I came across and malformed mp4 that when played on the iPhone would crash the device. I am trying to figure out which bits are specifically responsible for the crash. I am wondering if ...
4
votes
1answer
196 views

How can a video file cause an iOS device to crash or hang?

There have been reports of a malformed h264 video file causing iOS devices to hang or crash (I've added the link in plaintext to avoid accidental clickthroughs, play at your own risk: http://www....
1
vote
1answer
235 views

Can a RTMPS stream be authenticated by a cookie?

After performing an mitm attack I discovered that the Nest mobile application appears to use a cookie as authentication to access data. It receives a response that gives an RTMPS address, but it seems ...
1
vote
1answer
2k views

Dylib can run without code sign in iOS?

I learn from somewhere dylib should be signed in iOS, otherwise dyld will refuse to execute it. But when I test the example of this post. The dylib is not signed by default in this project, but it ...
2
votes
1answer
516 views

How are the iOS kernel cache and root filesystem decrypted?

On the iPhone Wiki there are decryption keys for several, but not all, of the iPhone firmwares (root filesystems and kernelcache files). How were these keys found?
1
vote
1answer
335 views

%orig found outside of hook or subclass

I'm using Rpetrich's Theos repository and I'm using tweak.xmi for making tweak on multiple files for easier in management. I can build and run successfully except one thing: I cannot use hookf. ...
0
votes
1answer
215 views

ios jailbreak: command cycrypt not found

I have jail-broken my iPhone with Cydia store. In cydia store I have checked and I see cycrypt has installed. But when I ssh to my iPhone and try to run command cycrypt I receive the following error, ...
1
vote
1answer
467 views

Can this method be hooked in iOS?

Here's IDA: http://pastebin.com/AkU0MDWh Also, would this be written in C to show like this? In comparison to a regular method like: ListRowCell - (id)initWithStyle:(int) reuseIdentifier:(id)
1
vote
1answer
483 views

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
0
votes
1answer
278 views

Mach-O functions pointer

I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
2
votes
3answers
1k views

Any Disassembler for iOS?

Is there any iOS app for arm Disassembling? I mean one that can run on iPhone. Nor IDA or Hopper have any iOS version
1
vote
1answer
221 views

Reverse-engineer digest http authentication

I have an iOS app which uses digest HTTP authentication with nonce which expires every 5 minutes. The client calculates response as following: HA1=MD5(username:realm:password) HA2=MD5(method:...
5
votes
1answer
416 views

Where to start with iOS debugging?

Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an ...
1
vote
1answer
199 views

iOS exploit hunting environment

Suppose, I have a new iPhone 6s with latest iOS, and I want to find vulnerabilities in iOS itself. iPhone is not jailbroken. How do I set up the proper environment for this? What software and/or ...
8
votes
2answers
10k views

Decrypting IPA Binary on OS X

I've been reading this PDF on reverse-engineering iOS applications and have reached slide 39, decrypting the binary. However, I've been attempting to disassemble and explore the binary in OS X 10.9.5 ...
1
vote
1answer
1k views

iOS Detect Function Hooking

I would like to find out if there's a way to detect if a C function is hooked in iOS? So for example let's say I hook SSLHandshake, OSStatus (*orig_SSLHandshake) (SSLContextRef context); OSStatus ...
1
vote
2answers
418 views

Disassemble IOS Kernel Module from jailbroken device?

I have a jailbroken IOS8 device, with an A6X processor. I'd like to pull either the device's kernel or a specific module, and decrypt it to use with a compatible objdump. The IOS kernel modules do ...
2
votes
1answer
248 views

How can I decompile and inspect a Safari Extension?

There is a suspect safari extension on a computer I'm investigating. How can I locate its install location, and possibly read the source code of the extension? Also, is there an easy way to tell if ...
1
vote
1answer
365 views

lldb - breakpoint not reached when attach do process (but executing when set before app running)

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all ...
1
vote
1answer
722 views

Setting Breakpoints at functions decoded by Hopper/IDA Pro in an iOS app

So, its been very interesting to reverse engineer an iOS application and I have made significant improvement into learning how to read disassembly and understand them. Now I was trying to debug the ...