Questions tagged [ios]
The operating system by apple for mobile devices
133 questions
3
votes
2
answers
406
views
Is iOS 15 kernel cache encrypted?
I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
CommunityBot
- 1
1
vote
1
answer
358
views
Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?
In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf
Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
CommunityBot
- 1
0
votes
1
answer
301
views
Extracting obj-c class list from a machO
I'm trying to analyze and get the full list of selectors and their related classes in objective-c by first reading the __objc_classlist section and getting pointers to the struct objc_class list to ...
CommunityBot
- 1
9
votes
2
answers
15k
views
OTOOL alternative for linux
I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine.
Currently on Mac, ...
- 187
0
votes
0
answers
27
views
Is a macOS System Call Tracing & Visualization Tool Useful?
I’m a beginner in reverse engineering and thinking of building a tool to trace and visualize system calls on macOS. The idea is to make something simpler than DTrace or Instruments, with an intuitive ...
- 13
0
votes
0
answers
48
views
How the 'Secure Application ROM (SAROM)' works ? and how can be decrypted?
There is a protection product that i'm interested in analyzing and breaking it called SAROM that encrypts sensitive information that stored in the client-side such as API Keys/hardcoded stuff. I tried ...
- 137
0
votes
0
answers
37
views
Recreating a custom bplist-derivative data type
I am trying to recreate a custom file type used by an iOS app. I analyzed its binary (image below)
and it seems to be a bplist00, however I can't inspect it with any tools like plutil. Plutil returns ...
- 1
0
votes
1
answer
104
views
Function calls to unmapped memory
I'm examining an iOS framework (extracted from a dyld shared cache) and there are a lot of branch-link instructions to functions which don't exist. For example,
bl #-0x50e7e04
Performing the ...
0
votes
1
answer
50
views
Location of CoreMedia framework
I've been attempting to dive into mediaserverd which runs on iOS. Pulling the binary and running otool -L on it reveals, unsurprisingly, that it's linked against /System/Library/Frameworks/CoreMedia....
0
votes
0
answers
125
views
Hooking a Swift method with frida on iOS to inspect DSA signing arguments
I have an iOS app that is sending a DSA signature with certain requests. Initially, I would just like to be able to hook the method performing the signing and dump the arguments.
In ghidra, I can see ...
- 187
0
votes
0
answers
111
views
Searching for a byte pattern and then hooking all instances of it using frida on iOS
I'm using a frida script to scan for a certain byte pattern when I launch an iOS app.
I can log each offset and confirm these are correct by also printing out the instructions at those locations and ...
- 187
0
votes
0
answers
39
views
Analyzing USB traffic coming from XCode -> iPhone via USBC/Lightning cable
I tried posting this on stack overflow with no luck, hoping I can get some more answers here.
have an app running on my iPhone via XCode by way of USBC -> Lightning cable. I would like to analyze ...
- 133
0
votes
0
answers
122
views
Reverse engineering Objective-C blocks
I'm highly experienced with objective-c reverse engineering, but every time I encounter a block representation in the decompiler, right before it is passed as an argument to a function, I can ...
2
votes
1
answer
345
views
MachO chained fixups parsing
I'm wondering how the info stored in the chained fixups in the Mach-O file is used to resolve binding and rebases?
My question originated from wanting to parse all the Objective-C classes inside a ...
- 1,459
1
vote
0
answers
83
views
Is a jailbroken iPhone is necessary to extract the ipa of a pre-installed app like iMessage?
My research notes: https://docs.google.com/document/d/1Y-2SZX4s1E1Mq9yWHZMMBzW3BJTfUuMl-YYXoZlY73w/edit?usp=sharing
From my research, I have come to the understanding that in order to extract the ipa ...
- 21
7
votes
1
answer
363
views
Reverse engineer compressed iOS app file
I want to find out the compression method used by an iOS app used for music notation to store its files. The files of its OSX counterpart are zipped files. You cannot create files in the iOS app, but ...
CommunityBot
- 1
2
votes
1
answer
151
views
strange arm construct in objective-c application
I was reversing the objective-c application and stumbled upon an assembler construction that I don't understand:
This is call of some function with SP register (+ 0x18 offset) as parameter. (Picture1)....
CommunityBot
- 1
1
vote
0
answers
244
views
Get all names of functions from an iOS-App binary (headless)
Setup:
I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
3
votes
1
answer
117
views
Hopper - no CFG leaving procedure at this address
Where is it that, when I am at a procedure with a lot of db, hopper will not show the control flow graph.
How do I make the db change to a regular assembly symbol like mov,add,ret etc.
What cause the ...
CommunityBot
- 1
2
votes
1
answer
383
views
Deobfuscating IOS dll file (I think arm64)
I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes.
I have ...
- 1,223
4
votes
0
answers
712
views
Decoding the Apple vendor tag in the 802.11 beacon
Background
Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a ...
- 41
2
votes
0
answers
92
views
Reverse Engineer Using Class-dump
I have tried to look into the class-dump of a decompiled ipa file, can I assume that only : TtCC29XYZ18JailbreakDetection12RuntimeClass is of remarkable because it has - (long long)...
- 161
4
votes
1
answer
70
views
Trying to use Cycript to access element in the current windpws
I am using cycript,but I have tried some of these commands and not sure where I went wrong.
cy# UIApp.windows[0]
#"<UIWindow: 0x102d0b2d0; frame = (0 0; 320 568); gestureRecognizers = <...
2
votes
0
answers
142
views
Input file (Hello_World) is neither a Mach-O file nor a fat archive: Class-dump
I am trying to use class-dump in iPhone 14.3. However, there is an error. Can you advise?
ANT-iPhone:/var/containers/Bundle/Application/61669A90-8CF9-4991-943F-5E9F097A3A5B/Hello_World.app root# otool ...
- 269
3
votes
0
answers
59
views
db section in hopper
There is a db section in hopper, which cause the code not being able to go to control follow graph mode
Do advise what cause this issue:
; Section __cstring
; Range: [0x10000a2c0; ...
- 161
1
vote
0
answers
457
views
// This file does not contain any Objective-C runtime information
I am trying to reverse engineer a file with class-dump but it says objective-c header is not found. This is clearly an objective C file.
2023-03-03 22:26:21.789 class-dump[5565:85760] Unknown load ...
- 161
2
votes
1
answer
4k
views
Decompile and Re-compile iOS app (.ipa file)
As a part of college project, I have to showcase how I can get ios app from jailbroken devices and reverse-engineer it. In the first part of slide, I am showing how we can get the IPA file from ...
- 211
7
votes
0
answers
350
views
running iOS debugserver on non-jailbroken devices
There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
- 161
3
votes
1
answer
93
views
Does anyone know the purpose of the malware,ios,social_engineering file on iOS
I have a jailbroken iPhone, and I noticed that it contains a file called social_engineering,ios,url_expression at the path:
/private/var/mobile/Library/Caches/com.apple.Safari.SafeBrowsing/Google/...
CommunityBot
- 1
1
vote
1
answer
2k
views
Reversing iOS games with LLDB and IDA on arm64
Cracked the game with clutch and set watchpoint on the value address, when the value changes it breaks just fine but when i go to that binary address in IDA it shows me different instruction, here's ...
- 1
1
vote
1
answer
134
views
How can I make more space for a bigger string in Hopper disassembler?
I made an iOS app that simply changes the background color when I tap the button. the goal is to change the color with Hopper. I successfully changed the color from blue to red but I cannot change ...
- 131
3
votes
2
answers
815
views
Convert Mach-O VM Address To File Offset
this maybe total no brainer but i'm really new to this and i'd really appreciate some help!
Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully ...
3
votes
0
answers
205
views
Solved: Unable to hook Apple binary on iOS 14.x with Frida
I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to ...
- 31
3
votes
1
answer
275
views
IOS ASLR address calculation with delta offset (ARM64)
I am learning LLDB to debug ios apps, I have a jailbroken iPhone IOS 14.3 and a debugserver.
Screenshot of start connect to remote process:
Sections of my process(image dump sections hidenseek):
...
- 131
2
votes
1
answer
567
views
frida hook `loc_*` or `sub_*`
Is it possible to hook a sub_... object in Frida ? I disassembled an arm64 executable, when running the app on my iPhone, I can see a lot of classes also in the disassembled executable, but I can't ...
- 51
2
votes
0
answers
164
views
Access a XREFs with frida
I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
- 51
71
votes
7
answers
144k
views
What are the possibilities for reverse engineering an IPA file to its source?
I browsed a lot, but can't find any resources for reverse engineering an IPA file (iPhone application). Is there any method to reverse engineer an IPA file to its source? I've tried to rename it to ...
1
vote
1
answer
789
views
Frida script returning different instruction at address compared to entering commands in repl
I have an iOS device on 14.2 and am using frida 15.2.2 on Ubuntu 18.04.
If I launch an app via frida, in the repl I can get the base address of the module, add an offset to that address, and print the ...
CommunityBot
- 1
0
votes
0
answers
78
views
Reading variables modified by pass by reference
Reading arguments as well as return values is pretty trivial when utilizing Frida. But is there any way to read data that is modified through pass by reference. I am attempting to read some data in an ...
- 101
1
vote
1
answer
9k
views
how should i change an instruction to NOP in IDA?
I am new with IDA assembler and i used to work with hopper app.
the problem is i can't change instruction in IDA from something like CBNZ to NOP.
is there any button to do this? i can't find anything ...
- 1
2
votes
0
answers
353
views
how to find a string in memory having ARM instructions ARDP and LDR?
hello, I disassembled the request sent to the game server, I need to change the symbol, but I don’t know its memory address. Help me understand the ADRP and LDR instructions, I need to understand what ...
- 71
3
votes
0
answers
178
views
Trying to understand a simple compiled PSI binary file
I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (...
- 461
1
vote
1
answer
112
views
What kind of random algorithm is used in this game?
I am playing a game for iOS that uses a deck of 48 cards and I would like to reverse engineer the kind of algorithm that is used to generate the random deck of cards such that I can predict which card ...
- 19
0
votes
0
answers
72
views
iOS unknown library sending ssl pinned request
Here is my problem:
I am trying to access to a ssl pinned request sent by an action I am doing on an iPhone. The action I am making sends two requests:
The first one is ssl pinned, sent by a pre-...
- 51
1
vote
1
answer
648
views
Create instance of iOS class that contains a . with frida
I am trying to create an instance of a class of an iOS app using Frida.
In the past I have successfully done this using a command such as:
var instance = ObjC.chooseSync(ObjC.classes.TestClass)[0];
...
- 1,223
2
votes
1
answer
7k
views
Using IDA Pro, How can I just "edit" values, Rather than patching Offsets,
I dont understand how people are finding offsets, So I want to know if there's a simple and easy method of just "patching values"
I've been surfing the internet looking for VERY in depth ...
- 253
2
votes
0
answers
832
views
Backtrace HTTP request over few modules when using FRIDA
I am in the process of reverse engineering an IOS IPA using HOPPER and FRIDA. First, I started with POSTMAN, which records the app's HTTP requests. What I find interesting is that the app uses a so-...
- 21
1
vote
0
answers
1k
views
How to get variable value during IDA (Hex-Rays Decompiler) debugging?
I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below.
Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class.
How to get ...
- 11
1
vote
1
answer
445
views
Change iOS app binary file
I want to manipulate iOS binary file and change two strings in it. I used hex editor to search and change these strings. But after the binary file is uploaded and replaced with the origin app's binary ...
- 1,132
1
vote
0
answers
302
views
Int64 parsing from args in Frida-trace for iOS binaries
I'm using frida-trace to log some methods and I've come across the following.
onEnter(log, args, state) {
log(`-[Somefunction somefield64:${args[2]}]`)
}
somefield64 returns what I believe to ...
- 1,132