Questions tagged [ios]
The operating system by apple for mobile devices
123
questions
0
votes
1
answer
46
views
Extracting obj-c class list from a machO
I'm trying to analyze and get the full list of selectors and their related classes in objective-c by first reading the __objc_classlist section and getting pointers to the struct objc_class list to ...
- 153
1
vote
0
answers
27
views
Is a jailbroken iPhone is necessary to extract the ipa of a pre-installed app like iMessage?
My research notes: https://docs.google.com/document/d/1Y-2SZX4s1E1Mq9yWHZMMBzW3BJTfUuMl-YYXoZlY73w/edit?usp=sharing
From my research, I have come to the understanding that in order to extract the ipa ...
- 11
0
votes
1
answer
62
views
Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?
In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf
Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
- 11
1
vote
0
answers
156
views
Get all names of functions from an iOS-App binary (headless)
Setup:
I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
2
votes
1
answer
154
views
Deobfuscating IOS dll file (I think arm64)
I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes.
I have ...
3
votes
0
answers
257
views
Decoding the Apple vendor tag in the 802.11 beacon
Background
Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a ...
- 31
2
votes
0
answers
68
views
Reverse Engineer Using Class-dump
I have tried to look into the class-dump of a decompiled ipa file, can I assume that only : TtCC29XYZ18JailbreakDetection12RuntimeClass is of remarkable because it has - (long long)...
- 161
4
votes
1
answer
57
views
Trying to use Cycript to access element in the current windpws
I am using cycript,but I have tried some of these commands and not sure where I went wrong.
cy# UIApp.windows[0]
#"<UIWindow: 0x102d0b2d0; frame = (0 0; 320 568); gestureRecognizers = <...
- 161
3
votes
0
answers
33
views
db section in hopper
There is a db section in hopper, which cause the code not being able to go to control follow graph mode
Do advise what cause this issue:
; Section __cstring
; Range: [0x10000a2c0; ...
- 161
3
votes
1
answer
84
views
Hopper - no CFG leaving procedure at this address
Where is it that, when I am at a procedure with a lot of db, hopper will not show the control flow graph.
How do I make the db change to a regular assembly symbol like mov,add,ret etc.
What cause the ...
- 161
2
votes
0
answers
66
views
Input file (Hello_World) is neither a Mach-O file nor a fat archive: Class-dump
I am trying to use class-dump in iPhone 14.3. However, there is an error. Can you advise?
ANT-iPhone:/var/containers/Bundle/Application/61669A90-8CF9-4991-943F-5E9F097A3A5B/Hello_World.app root# otool ...
- 161
1
vote
0
answers
226
views
// This file does not contain any Objective-C runtime information
I am trying to reverse engineer a file with class-dump but it says objective-c header is not found. This is clearly an objective C file.
2023-03-03 22:26:21.789 class-dump[5565:85760] Unknown load ...
- 161
2
votes
1
answer
1k
views
Decompile and Re-compile iOS app (.ipa file)
As a part of college project, I have to showcase how I can get ios app from jailbroken devices and reverse-engineer it. In the first part of slide, I am showing how we can get the IPA file from ...
- 211
3
votes
0
answers
166
views
Solved: Unable to hook Apple binary on iOS 14.x with Frida
I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to ...
- 31
3
votes
1
answer
70
views
Does anyone know the purpose of the malware,ios,social_engineering file on iOS
I have a jailbroken iPhone, and I noticed that it contains a file called social_engineering,ios,url_expression at the path:
/private/var/mobile/Library/Caches/com.apple.Safari.SafeBrowsing/Google/...
- 131
2
votes
0
answers
99
views
Access a XREFs with frida
I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
- 51
2
votes
1
answer
273
views
frida hook `loc_*` or `sub_*`
Is it possible to hook a sub_... object in Frida ? I disassembled an arm64 executable, when running the app on my iPhone, I can see a lot of classes also in the disassembled executable, but I can't ...
- 51
0
votes
0
answers
62
views
Reading variables modified by pass by reference
Reading arguments as well as return values is pretty trivial when utilizing Frida. But is there any way to read data that is modified through pass by reference. I am attempting to read some data in an ...
- 101
1
vote
1
answer
427
views
Frida script returning different instruction at address compared to entering commands in repl
I have an iOS device on 14.2 and am using frida 15.2.2 on Ubuntu 18.04.
If I launch an app via frida, in the repl I can get the base address of the module, add an offset to that address, and print the ...
- 167
3
votes
1
answer
177
views
IOS ASLR address calculation with delta offset (ARM64)
I am learning LLDB to debug ios apps, I have a jailbroken iPhone IOS 14.3 and a debugserver.
Screenshot of start connect to remote process:
Sections of my process(image dump sections hidenseek):
...
- 71
2
votes
0
answers
227
views
how to find a string in memory having ARM instructions ARDP and LDR?
hello, I disassembled the request sent to the game server, I need to change the symbol, but I don’t know its memory address. Help me understand the ADRP and LDR instructions, I need to understand what ...
- 71
2
votes
1
answer
136
views
strange arm construct in objective-c application
I was reversing the objective-c application and stumbled upon an assembler construction that I don't understand:
This is call of some function with SP register (+ 0x18 offset) as parameter. (Picture1)....
- 21
3
votes
0
answers
86
views
Trying to understand a simple compiled PSI binary file
I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (...
- 253
3
votes
2
answers
278
views
Is iOS 15 kernel cache encrypted?
I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
user41084
0
votes
0
answers
59
views
iOS unknown library sending ssl pinned request
Here is my problem:
I am trying to access to a ssl pinned request sent by an action I am doing on an iPhone. The action I am making sends two requests:
The first one is ssl pinned, sent by a pre-...
- 51
1
vote
1
answer
453
views
Create instance of iOS class that contains a . with frida
I am trying to create an instance of a class of an iOS app using Frida.
In the past I have successfully done this using a command such as:
var instance = ObjC.chooseSync(ObjC.classes.TestClass)[0];
...
- 167
2
votes
0
answers
567
views
Backtrace HTTP request over few modules when using FRIDA
I am in the process of reverse engineering an IOS IPA using HOPPER and FRIDA. First, I started with POSTMAN, which records the app's HTTP requests. What I find interesting is that the app uses a so-...
- 21
1
vote
0
answers
622
views
How to get variable value during IDA (Hex-Rays Decompiler) debugging?
I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below.
Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class.
How to get ...
- 11
1
vote
1
answer
330
views
Change iOS app binary file
I want to manipulate iOS binary file and change two strings in it. I used hex editor to search and change these strings. But after the binary file is uploaded and replaced with the origin app's binary ...
1
vote
0
answers
263
views
Int64 parsing from args in Frida-trace for iOS binaries
I'm using frida-trace to log some methods and I've come across the following.
onEnter(log, args, state) {
log(`-[Somefunction somefield64:${args[2]}]`)
}
somefield64 returns what I believe to ...
- 111
0
votes
2
answers
129
views
How to calculate the value needed to branch two points in IDA pro?
I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
0
votes
1
answer
380
views
Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?
I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a.
I want to check some logic in `xx. ...
- 1
1
vote
1
answer
509
views
Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida
I am trying to understand the usage of calls to CC_MD5 in an iOS application.
From Apple's man page I can see that when it is called it requires 3 arguments:
extern unsigned char *
CC_MD5(const void *...
- 167
2
votes
1
answer
2k
views
Read and write to register with Frida
I have an instruction that looks like this in Ghidra:
100168ff0 e9 13 00 32 orr w9,wzr,#0x1f
Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what ...
- 167
2
votes
0
answers
63
views
Attempting to understand non-XZ file signatures within PBZX chunks
After my previous question from nearly a year ago directing me to the YAA format to make sense of the chunks that could be decompressed, this time we're dealing with the chunks that made pbzx tell us ...
2
votes
0
answers
193
views
How to find how a hash in generated in an iOS app
I'm currently working on an iOS app to replicate a signature which looks to be generated with a MD5 hash. I'm currently using Frida, but haven't had any luck replicating it. I've used the script to ...
- 21
1
vote
1
answer
115
views
How can I make more space for a bigger string in Hopper disassembler?
I made an iOS app that simply changes the background color when I tap the button. the goal is to change the color with Hopper. I successfully changed the color from blue to red but I cannot change ...
- 31
1
vote
1
answer
126
views
Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions
I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
- 63
1
vote
1
answer
105
views
What kind of random algorithm is used in this game?
I am playing a game for iOS that uses a deck of 48 cards and I would like to reverse engineer the kind of algorithm that is used to generate the random deck of cards such that I can predict which card ...
- 19
2
votes
1
answer
2k
views
Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated
I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
- 21
7
votes
1
answer
303
views
Reverse engineer compressed iOS app file
I want to find out the compression method used by an iOS app used for music notation to store its files. The files of its OSX counterpart are zipped files. You cannot create files in the iOS app, but ...
- 71
0
votes
0
answers
87
views
Is it possible to somehow derive the decryption key for iOS app binaries?
While disassembling an IPA downloaded directly from the App Store CDN, I noticed that the binary had an unusually large entropy. Looking this occurrence up confirmed my suspicion that it was encrypted,...
0
votes
1
answer
116
views
Dumping available XPC interface and methods
I'm reading this article, and it says:
The following functions are exposed over XPC to the caller:
@protocol _TtP4main21ForkLiftHelperProtcol_
- (void)changePermissions:(NSString *)arg1 permissions:(...
- 123
1
vote
0
answers
570
views
How are strokes stored in the Goodnotes file format?
I have been trying to reverse engineer the .goodnotes file format (a note taking app for iOS devices) and so far have discovered this:
A .goodnotes file is simply a zip archive, an example file ...
- 11
2
votes
2
answers
697
views
Attempting to reverse engineer an iOS OTA payload-like archival format
Apple's announcement of macOS Big Sur had meant the release of the developer beta. In an attempt to create the appbundle from Apple's softwarecatalog, I attempted to study the contents of ...
2
votes
1
answer
223
views
Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff
I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it.
Pretext:
...
- 21
1
vote
0
answers
98
views
finding specific string in ios dyld_shared_cache
Im trying to find the library inside a dyld cache that contains a specific string.
I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the ...
- 11
1
vote
0
answers
49
views
Theos Tweak compilation errors [closed]
While attempting to build a Theos tweak, even a templated one created by Theos, I will encounter the following error
bash: line 1: 4665 Done swift --version
4667 Broken pipe:...
- 193
1
vote
1
answer
212
views
IDA - ObjC - Meaning of _BYTE and dword_0?
This is my first experience disassembling/reverse engineering, and am having a bit of difficulty keeping up. For reference, I'm trying to uncover the inner workings of a pretty good library in my ...
1
vote
1
answer
112
views
Mach-O ARM64 using literal values instead of a frame pointer (BP) register
I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM ...
- 35