Skip to main content

Questions tagged [ios]

The operating system by apple for mobile devices

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

Recreating a custom bplist-derivative data type

I am trying to recreate a custom file type used by an iOS app. I analyzed its binary (image below) and it seems to be a bplist00, however I can't inspect it with any tools like plutil. Plutil returns ...
StarWolf's user avatar
0 votes
1 answer
99 views

Function calls to unmapped memory

I'm examining an iOS framework (extracted from a dyld shared cache) and there are a lot of branch-link instructions to functions which don't exist. For example, bl #-0x50e7e04 Performing the ...
August Vrubel's user avatar
0 votes
1 answer
50 views

Location of CoreMedia framework

I've been attempting to dive into mediaserverd which runs on iOS. Pulling the binary and running otool -L on it reveals, unsurprisingly, that it's linked against /System/Library/Frameworks/CoreMedia....
August Vrubel's user avatar
0 votes
0 answers
114 views

Hooking a Swift method with frida on iOS to inspect DSA signing arguments

I have an iOS app that is sending a DSA signature with certain requests. Initially, I would just like to be able to hook the method performing the signing and dump the arguments. In ghidra, I can see ...
Jon's user avatar
  • 177
0 votes
0 answers
104 views

Searching for a byte pattern and then hooking all instances of it using frida on iOS

I'm using a frida script to scan for a certain byte pattern when I launch an iOS app. I can log each offset and confirm these are correct by also printing out the instructions at those locations and ...
Jon's user avatar
  • 177
0 votes
0 answers
38 views

Analyzing USB traffic coming from XCode -> iPhone via USBC/Lightning cable

I tried posting this on stack overflow with no luck, hoping I can get some more answers here. have an app running on my iPhone via XCode by way of USBC -> Lightning cable. I would like to analyze ...
Joshua Terrill's user avatar
0 votes
0 answers
103 views

Reverse engineering Objective-C blocks

I'm highly experienced with objective-c reverse engineering, but every time I encounter a block representation in the decompiler, right before it is passed as an argument to a function, I can ...
jony cachez's user avatar
2 votes
1 answer
319 views

MachO chained fixups parsing

I'm wondering how the info stored in the chained fixups in the Mach-O file is used to resolve binding and rebases? My question originated from wanting to parse all the Objective-C classes inside a ...
Jorayen's user avatar
  • 185
0 votes
1 answer
268 views

Extracting obj-c class list from a machO

I'm trying to analyze and get the full list of selectors and their related classes in objective-c by first reading the __objc_classlist section and getting pointers to the struct objc_class list to ...
Jorayen's user avatar
  • 185
1 vote
0 answers
83 views

Is a jailbroken iPhone is necessary to extract the ipa of a pre-installed app like iMessage?

My research notes: https://docs.google.com/document/d/1Y-2SZX4s1E1Mq9yWHZMMBzW3BJTfUuMl-YYXoZlY73w/edit?usp=sharing From my research, I have come to the understanding that in order to extract the ipa ...
rasputin's user avatar
1 vote
1 answer
334 views

Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?

In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
rasputin's user avatar
1 vote
0 answers
240 views

Get all names of functions from an iOS-App binary (headless)

Setup: I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
Kühlhausvogel's user avatar
2 votes
1 answer
354 views

Deobfuscating IOS dll file (I think arm64)

I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes. I have ...
NOT Mike Oxmall epic duel's user avatar
4 votes
0 answers
617 views

Decoding the Apple vendor tag in the 802.11 beacon

Background Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a ...
thewade's user avatar
  • 41
2 votes
0 answers
88 views

Reverse Engineer Using Class-dump

I have tried to look into the class-dump of a decompiled ipa file, can I assume that only : TtCC29XYZ18JailbreakDetection12RuntimeClass is of remarkable because it has - (long long)...
A O's user avatar
  • 161
4 votes
1 answer
70 views

Trying to use Cycript to access element in the current windpws

I am using cycript,but I have tried some of these commands and not sure where I went wrong. cy# UIApp.windows[0] #"<UIWindow: 0x102d0b2d0; frame = (0 0; 320 568); gestureRecognizers = <...
A O's user avatar
  • 161
3 votes
0 answers
57 views

db section in hopper

There is a db section in hopper, which cause the code not being able to go to control follow graph mode Do advise what cause this issue: ; Section __cstring ; Range: [0x10000a2c0; ...
A O's user avatar
  • 161
3 votes
1 answer
115 views

Hopper - no CFG leaving procedure at this address

Where is it that, when I am at a procedure with a lot of db, hopper will not show the control flow graph. How do I make the db change to a regular assembly symbol like mov,add,ret etc. What cause the ...
A O's user avatar
  • 161
2 votes
0 answers
129 views

Input file (Hello_World) is neither a Mach-O file nor a fat archive: Class-dump

I am trying to use class-dump in iPhone 14.3. However, there is an error. Can you advise? ANT-iPhone:/var/containers/Bundle/Application/61669A90-8CF9-4991-943F-5E9F097A3A5B/Hello_World.app root# otool ...
A O's user avatar
  • 161
1 vote
0 answers
419 views

// This file does not contain any Objective-C runtime information

I am trying to reverse engineer a file with class-dump but it says objective-c header is not found. This is clearly an objective C file. 2023-03-03 22:26:21.789 class-dump[5565:85760] Unknown load ...
A O's user avatar
  • 161
2 votes
1 answer
4k views

Decompile and Re-compile iOS app (.ipa file)

As a part of college project, I have to showcase how I can get ios app from jailbroken devices and reverse-engineer it. In the first part of slide, I am showing how we can get the IPA file from ...
node_analyser's user avatar
3 votes
0 answers
202 views

Solved: Unable to hook Apple binary on iOS 14.x with Frida

I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to ...
AGreen BHM's user avatar
3 votes
1 answer
90 views

Does anyone know the purpose of the malware,ios,social_engineering file on iOS

I have a jailbroken iPhone, and I noticed that it contains a file called social_engineering,ios,url_expression at the path: /private/var/mobile/Library/Caches/com.apple.Safari.SafeBrowsing/Google/...
user2279952's user avatar
2 votes
0 answers
162 views

Access a XREFs with frida

I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
hmngwn's user avatar
  • 51
2 votes
1 answer
547 views

frida hook `loc_*` or `sub_*`

Is it possible to hook a sub_... object in Frida ? I disassembled an arm64 executable, when running the app on my iPhone, I can see a lot of classes also in the disassembled executable, but I can't ...
hmngwn's user avatar
  • 51
0 votes
0 answers
78 views

Reading variables modified by pass by reference

Reading arguments as well as return values is pretty trivial when utilizing Frida. But is there any way to read data that is modified through pass by reference. I am attempting to read some data in an ...
Matt's user avatar
  • 101
1 vote
1 answer
772 views

Frida script returning different instruction at address compared to entering commands in repl

I have an iOS device on 14.2 and am using frida 15.2.2 on Ubuntu 18.04. If I launch an app via frida, in the repl I can get the base address of the module, add an offset to that address, and print the ...
Jon's user avatar
  • 177
3 votes
1 answer
265 views

IOS ASLR address calculation with delta offset (ARM64)

I am learning LLDB to debug ios apps, I have a jailbroken iPhone IOS 14.3 and a debugserver. Screenshot of start connect to remote process: Sections of my process(image dump sections hidenseek): ...
qazwsx135's user avatar
2 votes
0 answers
343 views

how to find a string in memory having ARM instructions ARDP and LDR?

hello, I disassembled the request sent to the game server, I need to change the symbol, but I don’t know its memory address. Help me understand the ADRP and LDR instructions, I need to understand what ...
qazwsx135's user avatar
2 votes
1 answer
147 views

strange arm construct in objective-c application

I was reversing the objective-c application and stumbled upon an assembler construction that I don't understand: This is call of some function with SP register (+ 0x18 offset) as parameter. (Picture1)....
CABAL's user avatar
  • 21
3 votes
0 answers
159 views

Trying to understand a simple compiled PSI binary file

I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (...
Mister SirCode's user avatar
3 votes
2 answers
391 views

Is iOS 15 kernel cache encrypted?

I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
user avatar
0 votes
0 answers
72 views

iOS unknown library sending ssl pinned request

Here is my problem: I am trying to access to a ssl pinned request sent by an action I am doing on an iPhone. The action I am making sends two requests: The first one is ssl pinned, sent by a pre-...
hmngwn's user avatar
  • 51
1 vote
1 answer
636 views

Create instance of iOS class that contains a . with frida

I am trying to create an instance of a class of an iOS app using Frida. In the past I have successfully done this using a command such as: var instance = ObjC.chooseSync(ObjC.classes.TestClass)[0]; ...
Jon's user avatar
  • 177
2 votes
0 answers
826 views

Backtrace HTTP request over few modules when using FRIDA

I am in the process of reverse engineering an IOS IPA using HOPPER and FRIDA. First, I started with POSTMAN, which records the app's HTTP requests. What I find interesting is that the app uses a so-...
Kai Schiffer's user avatar
1 vote
0 answers
1k views

How to get variable value during IDA (Hex-Rays Decompiler) debugging?

I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below. Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class. How to get ...
Yiiff's user avatar
  • 11
1 vote
1 answer
444 views

Change iOS app binary file

I want to manipulate iOS binary file and change two strings in it. I used hex editor to search and change these strings. But after the binary file is uploaded and replaced with the origin app's binary ...
Hojat Sajadinia's user avatar
1 vote
0 answers
302 views

Int64 parsing from args in Frida-trace for iOS binaries

I'm using frida-trace to log some methods and I've come across the following. onEnter(log, args, state) { log(`-[Somefunction somefield64:${args[2]}]`) } somefield64 returns what I believe to ...
phwd's user avatar
  • 111
0 votes
2 answers
169 views

How to calculate the value needed to branch two points in IDA pro?

I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
t0astym4rsh's user avatar
0 votes
1 answer
479 views

Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?

I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a. I want to check some logic in `xx. ...
KHacker's user avatar
1 vote
1 answer
603 views

Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida

I am trying to understand the usage of calls to CC_MD5 in an iOS application. From Apple's man page I can see that when it is called it requires 3 arguments: extern unsigned char * CC_MD5(const void *...
Jon's user avatar
  • 177
2 votes
1 answer
3k views

Read and write to register with Frida

I have an instruction that looks like this in Ghidra: 100168ff0 e9 13 00 32 orr w9,wzr,#0x1f Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what ...
Jon's user avatar
  • 177
2 votes
0 answers
75 views

Attempting to understand non-XZ file signatures within PBZX chunks

After my previous question from nearly a year ago directing me to the YAA format to make sense of the chunks that could be decompressed, this time we're dealing with the chunks that made pbzx tell us ...
Kittywhiskers Van Gogh's user avatar
2 votes
0 answers
259 views

How to find how a hash in generated in an iOS app

I'm currently working on an iOS app to replicate a signature which looks to be generated with a MD5 hash. I'm currently using Frida, but haven't had any luck replicating it. I've used the script to ...
Mat's user avatar
  • 21
1 vote
1 answer
131 views

How can I make more space for a bigger string in Hopper disassembler?

I made an iOS app that simply changes the background color when I tap the button. the goal is to change the color with Hopper. I successfully changed the color from blue to red but I cannot change ...
BtPython's user avatar
1 vote
1 answer
135 views

Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions

I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
iSeeker's user avatar
  • 63
1 vote
1 answer
112 views

What kind of random algorithm is used in this game?

I am playing a game for iOS that uses a deck of 48 cards and I would like to reverse engineer the kind of algorithm that is used to generate the random deck of cards such that I can predict which card ...
Mechakhan's user avatar
2 votes
1 answer
2k views

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
Kojud's user avatar
  • 21
7 votes
1 answer
361 views

Reverse engineer compressed iOS app file

I want to find out the compression method used by an iOS app used for music notation to store its files. The files of its OSX counterpart are zipped files. You cannot create files in the iOS app, but ...
Dimitris's user avatar
0 votes
0 answers
129 views

Is it possible to somehow derive the decryption key for iOS app binaries?

While disassembling an IPA downloaded directly from the App Store CDN, I noticed that the binary had an unusually large entropy. Looking this occurrence up confirmed my suspicion that it was encrypted,...
Angelo DeLuca's user avatar