Questions tagged [ios]
The operating system by apple for mobile devices
133 questions
7
votes
1
answer
363
views
Reverse engineer compressed iOS app file
I want to find out the compression method used by an iOS app used for music notation to store its files. The files of its OSX counterpart are zipped files. You cannot create files in the iOS app, but ...
- 71
0
votes
0
answers
132
views
Is it possible to somehow derive the decryption key for iOS app binaries?
While disassembling an IPA downloaded directly from the App Store CDN, I noticed that the binary had an unusually large entropy. Looking this occurrence up confirmed my suspicion that it was encrypted,...
0
votes
1
answer
167
views
Dumping available XPC interface and methods
I'm reading this article, and it says:
The following functions are exposed over XPC to the caller:
@protocol _TtP4main21ForkLiftHelperProtcol_
- (void)changePermissions:(NSString *)arg1 permissions:(...
- 123
1
vote
0
answers
737
views
How are strokes stored in the Goodnotes file format?
I have been trying to reverse engineer the .goodnotes file format (a note taking app for iOS devices) and so far have discovered this:
A .goodnotes file is simply a zip archive, an example file ...
- 11
2
votes
2
answers
828
views
Attempting to reverse engineer an iOS OTA payload-like archival format
Apple's announcement of macOS Big Sur had meant the release of the developer beta. In an attempt to create the appbundle from Apple's softwarecatalog, I attempted to study the contents of ...
2
votes
1
answer
278
views
Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff
I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it.
Pretext:
...
- 21
1
vote
0
answers
137
views
finding specific string in ios dyld_shared_cache
Im trying to find the library inside a dyld cache that contains a specific string.
I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the ...
- 11
1
vote
0
answers
55
views
Theos Tweak compilation errors [closed]
While attempting to build a Theos tweak, even a templated one created by Theos, I will encounter the following error
bash: line 1: 4665 Done swift --version
4667 Broken pipe:...
- 183
1
vote
1
answer
272
views
IDA - ObjC - Meaning of _BYTE and dword_0?
This is my first experience disassembling/reverse engineering, and am having a bit of difficulty keeping up. For reference, I'm trying to uncover the inner workings of a pretty good library in my ...
1
vote
1
answer
126
views
Mach-O ARM64 using literal values instead of a frame pointer (BP) register
I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM ...
- 35
2
votes
1
answer
7k
views
Using IDA Pro, How can I just "edit" values, Rather than patching Offsets,
I dont understand how people are finding offsets, So I want to know if there's a simple and easy method of just "patching values"
I've been surfing the internet looking for VERY in depth ...
- 253
6
votes
1
answer
961
views
How does IPA decryption works?
All IPAs being downloaded from AppStore gets encrypted on servers as part of FairPlay DRM. But decryption is accomplished on local device. As far as I know there is some hardware module which contains ...
- 161
4
votes
1
answer
3k
views
Lipo alternate for linux
Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
- 243
9
votes
2
answers
15k
views
OTOOL alternative for linux
I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine.
Currently on Mac, ...
- 243
1
vote
1
answer
9k
views
how should i change an instruction to NOP in IDA?
I am new with IDA assembler and i used to work with hopper app.
the problem is i can't change instruction in IDA from something like CBNZ to NOP.
is there any button to do this? i can't find anything ...
- 23
1
vote
1
answer
857
views
How to identify which iOS kernelcache is installed?
I've an iPhone7 running iOS11.3 (15E216). The ipsw for this build version contains two separate kernelcache files named kernelcache.release.iphone9 and kernelcache.release.iphone10. Neither file is an ...
- 166
9
votes
2
answers
7k
views
How difficult is to decompile C++ file?
I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension .cpp.
I am also going to create an iOS app which will use the same AES key. Is ...
- 91
2
votes
0
answers
254
views
(iOS lldb) Unable to debug past a splash/loading screen
I'm trying to lldb debug this certain iOS application.
Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity.
However, whenever I try to debug ...
- 121
1
vote
0
answers
799
views
Patching an ipa (iPhone app) using Hopper Disassembler
I have learned in the past to patch some iOS apps to bypass jailbreak detection. Today, I decided to change the UI elements in the Spotify app on iOS Platform (ios 11). I downloaded a .ipa file of ...
7
votes
0
answers
350
views
running iOS debugserver on non-jailbroken devices
There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
- 506
0
votes
1
answer
356
views
Newbie here: hidden values in assembly? [closed]
So i'm new to the whole reverse engineering thing with only experience in C#. So I wanted to try and change the framerate of applications (eg. this unity game) at an assembly level on iOS ( I have an ...
2
votes
1
answer
2k
views
iOS entitlements for enable calling to private API
I'd like to analyze iOS private framework that broke commonly used GitHub project called AppLister. Here's some info about the API:
Framework : MobileCoreServices.framework.
Class: ...
- 293
1
vote
1
answer
749
views
Getting MobileCoreServices.framework binary in iOS11 [closed]
I'd like to try and fix some open source GitHub project that uses the allApplications from LSApplicationWorkspace call from private API which list all installed application on the device.
The method ...
- 293
2
votes
1
answer
443
views
Why function names are visible in a decompiled iOS app?
While decompiling an iOS app, all function names and object names are visible. Why ?
My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
- 121
1
vote
0
answers
856
views
Functions window empty for some ipa using ida pro
I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it ...
- 243
1
vote
1
answer
3k
views
Download and Decompile an Ios app [closed]
I want to write an automatic process that downloads an ios app and decompile it?
I couldn't find any source or method to download an ios app without using any Apple Device.
- 111
0
votes
1
answer
300
views
How relaunch iOS app once ASLR has been disabled?
On a jailbroken iOS device, I have successfully decrypted an app, and disabled ASLR, thanks to the hundredth of tutorials available.
But then, none explain how relaunch the app once ASLR has been ...
0
votes
1
answer
2k
views
charles proxy only showing portion of requests?
So i wanted to see the endpoints of this android/ios app calles "Bigo Live".
Like always, i've set up charles and started trackig.
Funnily, it only shows part of the traffic. for example: If i use ...
- 1
0
votes
1
answer
147
views
Accidently removed cordova platform ios folder [duplicate]
I was trying to uninstall a plugin but accidently ran the command cordova platform remove ios and it removed the app code on my macbook.
I don't see anything in trash as well. Is there any way to ...
4
votes
1
answer
546
views
How does the 'graphic views' on Hopper Disassembler work?
I would like to understand better what is that information on "graphic views" at the inspector of Hopper Disassembler. I've checked the tutorial but it just skips this section.
Thanks.
- 143
3
votes
0
answers
664
views
Is there an existing tool to reverse engineer Xamarin AOTDATA files?
I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
- 1,258
1
vote
1
answer
673
views
Changing NSUserDefaults of a mac or iOS binary executable
I have an executable of a mac or ios app. This app uses a value stored for a key in NSUserDefaults to change app's flow.
It looks something like below code,
If( value set in user details )
...
- 145
6
votes
1
answer
5k
views
getting function address by reading ADRP and ADD instruction values
Hello reverse engineers,
I'm analysing a fat Macho-O binary, and it has an ADRP and an ADD instruction in it.
I'm talking about these instructions:
__text:00000001002E050C ADRP ...
- 95
2
votes
0
answers
176
views
Analysis Apps for iOS10/64Bit
I need to analyze an iOS app. Since it's iOS 10 64Bit (jailbroken) this time, I'm desperately looking for good analysis tools for injecting, manipulating, anti-anti-jailbreak, tracing, and so on. I ...
2
votes
1
answer
538
views
iOS Position-independent code and relocations
I'm reversing few iOS Mach-O application executables these days and all of them use Position-independent code (PIC; the MH_PIC flag is set). I've been expecting a large number of relocation entries (...
- 143
3
votes
1
answer
892
views
Mach-O : Convert virtual address to file offset on disk
Hello reverse engineers,
I am reverse engineering a Mach-O executable for iOS.
File says: Mach-O universal binary with 2 architectures: [arm_v7: Mach-O arm_v7 executable] [64-bit architecture=12].
I ...
- 95
3
votes
1
answer
3k
views
How does Apple enforce the expiration of beta apps distributed through TestFlight
A beta app expired after a period of time. But after some investigated on the ipa file, both the certificate and the mobile provisioning profile embedded in the bundle are not expired.
How can Apple ...
- 281
-3
votes
1
answer
2k
views
Dumping ipa file on iOS 10.2 [closed]
Is there a way to dump .ipa file on iOS 10.2 (jailbroken) for future reverse-engineering? Tried to use Clutch, it doesn't dump the app. Just exits with
2017-03-13 23:17:24.702 Clutch[2195:100953] ...
- 11
1
vote
1
answer
142
views
Reverse engineering ARM PIC
I'm starting to learn reverse engineering so I'm trying to reverse sample app, compiled for ARM(iOS) and now I'm looking into code.
This section is right before WHILE and right at the beginning of ...
- 25
2
votes
1
answer
507
views
No LC_UNIXTHREAD segment in iOS application Mach-O
I'm analyzing load commands section of executable Mach-O file in iOS 9.3.3, Twitter app is used for ilustration.
# otool -hV Twitter
Twitter:
Mach header
magic cputype cpusubtype caps ...
- 23
13
votes
1
answer
7k
views
How are Apple App Store Apps encrypted?
I know how to decrypt an iOS app use tools.
How is this encryption performed? Why can iOS apps only be decrypted on a device? Is there a device-specific key used for encryption?
- 281
0
votes
2
answers
1k
views
Add new subroutine using IDA for ARM binary
I am trying to recreate a patch for an ARM binary. As it shows in attached picture, I have provided the before and after sections of file. In patched file, a new subroutine is added in a cave, and ...
- 11
-1
votes
1
answer
129
views
Will jailbreaking affect file system accessibility for all apps?
I find that on a jailbroken device I can access /Applications/ in a normal app from app store, although I thought due to the sandbox I shouldn't.
Maybe I should write an app to determine what ...
- 281
0
votes
1
answer
532
views
reversing ios notes file format [closed]
I am trying to understand how to read iOS notes files as they are saved in the NoteStore.sqlite database in the iOS backup.
Here are some sample files. Each file is a different note.
I want to get ...
- 3
1
vote
0
answers
60
views
Reverse Engineer an iOS MP4 Bug [duplicate]
Recently I came across and malformed mp4 that when played on the iPhone would crash the device. I am trying to figure out which bits are specifically responsible for the crash. I am wondering if ...
- 131
4
votes
1
answer
278
views
How can a video file cause an iOS device to crash or hang?
There have been reports of a malformed h264 video file causing iOS devices to hang or crash (I've added the link in plaintext to avoid accidental clickthroughs, play at your own risk: http://www....
- 615
1
vote
1
answer
461
views
Can a RTMPS stream be authenticated by a cookie?
After performing an mitm attack I discovered that the Nest mobile application appears to use a cookie as authentication to access data. It receives a response that gives an RTMPS address, but it seems ...
- 11
2
votes
1
answer
5k
views
Dylib can run without code sign in iOS?
I learn from somewhere dylib should be signed in iOS, otherwise dyld will refuse to execute it.
But when I test the example of this post. The dylib is not signed by default in this project, but it ...
- 281
2
votes
1
answer
855
views
How are the iOS kernel cache and root filesystem decrypted?
On the iPhone Wiki there are decryption keys for several, but not all, of the iPhone firmwares (root filesystems and kernelcache files). How were these keys found?
- 303
1
vote
1
answer
618
views
%orig found outside of hook or subclass
I'm using Rpetrich's Theos repository and I'm using tweak.xmi for making tweak on multiple files for easier in management.
I can build and run successfully except one thing: I cannot use hookf. ...
- 143