Skip to main content

Questions tagged [ios]

The operating system by apple for mobile devices

Filter by
Sorted by
Tagged with
71 votes
7 answers
144k views

What are the possibilities for reverse engineering an IPA file to its source?

I browsed a lot, but can't find any resources for reverse engineering an IPA file (iPhone application). Is there any method to reverse engineer an IPA file to its source? I've tried to rename it to ...
BlueBerry - Vignesh4303's user avatar
42 votes
1 answer
94k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
user94584392's user avatar
13 votes
1 answer
7k views

How are Apple App Store Apps encrypted?

I know how to decrypt an iOS app use tools. How is this encryption performed? Why can iOS apps only be decrypted on a device? Is there a device-specific key used for encryption?
Karl's user avatar
  • 281
11 votes
2 answers
21k views

Decrypting IPA Binary on OS X

I've been reading this PDF on reverse-engineering iOS applications and have reached slide 39, decrypting the binary. However, I've been attempting to disassemble and explore the binary in OS X 10.9.5 ...
Patrick Roberts's user avatar
11 votes
1 answer
4k views

Generating Snapchat Snaptags ("QR" Codes)

For those that haven't seen, Snapchat now has a special type of image based code that allows you to quickly add friends by pointing the camera at the screen, similar to a QR code, called "Snaptags". ...
Tyrone's user avatar
  • 111
9 votes
2 answers
7k views

How difficult is to decompile C++ file?

I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension .cpp. I am also going to create an iOS app which will use the same AES key. Is ...
Daniel Foo's user avatar
9 votes
2 answers
15k views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
Rohit saraf's user avatar
7 votes
1 answer
363 views

Reverse engineer compressed iOS app file

I want to find out the compression method used by an iOS app used for music notation to store its files. The files of its OSX counterpart are zipped files. You cannot create files in the iOS app, but ...
Dimitris's user avatar
7 votes
0 answers
350 views

running iOS debugserver on non-jailbroken devices

There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
3asm_'s user avatar
  • 506
6 votes
1 answer
5k views

getting function address by reading ADRP and ADD instruction values

Hello reverse engineers, I'm analysing a fat Macho-O binary, and it has an ADRP and an ADD instruction in it. I'm talking about these instructions: __text:00000001002E050C ADRP ...
exploiter's user avatar
6 votes
2 answers
23k views

Disassemble, edit and re-assembly iOS ipa apps

I'm trying to get jailbreak statistics for a University project related to security in mobile devices. My purpose is to disassemble, add a sample code and re-assemble to obtain a runnable iOS app ...
swoken's user avatar
  • 63
6 votes
1 answer
501 views

AndroGuard equivalent for iOS

I am doing a research project where I want to look at apps that create or extends certain classes. For Android I am using the Androguard project which provide a large set of great tools for inspecting ...
Christoffer Reijer's user avatar
6 votes
1 answer
961 views

How does IPA decryption works?

All IPAs being downloaded from AppStore gets encrypted on servers as part of FairPlay DRM. But decryption is accomplished on local device. As far as I know there is some hardware module which contains ...
AseN's user avatar
  • 161
4 votes
2 answers
7k views

Decrypt iOS standard encryption without device

In order to remove the encryption from an iOS binary on the App Store, it first has to be executed on a ARM capable device. Is there a way to do this without access to a device?
Nederealm's user avatar
  • 277
4 votes
1 answer
3k views

Lipo alternate for linux

Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
Rohit saraf's user avatar
4 votes
1 answer
278 views

How can a video file cause an iOS device to crash or hang?

There have been reports of a malformed h264 video file causing iOS devices to hang or crash (I've added the link in plaintext to avoid accidental clickthroughs, play at your own risk: http://www....
JAL's user avatar
  • 615
4 votes
1 answer
741 views

Where to start with iOS debugging?

Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an ...
Starwarsfan2099's user avatar
4 votes
3 answers
8k views

Can not continue debugging after SIGTRAP

I am trying to debug an iOS app with gdb and when I hit a breakpoint I get this error, and can not continue. Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to process 190 thread ...
Nikola C's user avatar
  • 143
4 votes
1 answer
546 views

How does the 'graphic views' on Hopper Disassembler work?

I would like to understand better what is that information on "graphic views" at the inspector of Hopper Disassembler. I've checked the tutorial but it just skips this section. Thanks.
Bruno Muniz's user avatar
4 votes
0 answers
712 views

Decoding the Apple vendor tag in the 802.11 beacon

Background Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a ...
thewade's user avatar
  • 41
4 votes
1 answer
70 views

Trying to use Cycript to access element in the current windpws

I am using cycript,but I have tried some of these commands and not sure where I went wrong. cy# UIApp.windows[0] #"<UIWindow: 0x102d0b2d0; frame = (0 0; 320 568); gestureRecognizers = <...
A O's user avatar
  • 161
3 votes
1 answer
3k views

How does Apple enforce the expiration of beta apps distributed through TestFlight

A beta app expired after a period of time. But after some investigated on the ipa file, both the certificate and the mobile provisioning profile embedded in the bundle are not expired. How can Apple ...
Karl's user avatar
  • 281
3 votes
3 answers
3k views

Any Disassembler for iOS?

Is there any iOS app for arm Disassembling? I mean one that can run on iPhone. Nor IDA or Hopper have any iOS version
DineroM34's user avatar
3 votes
1 answer
892 views

Mach-O : Convert virtual address to file offset on disk

Hello reverse engineers, I am reverse engineering a Mach-O executable for iOS. File says: Mach-O universal binary with 2 architectures: [arm_v7: Mach-O arm_v7 executable] [64-bit architecture=12]. I ...
exploiter's user avatar
3 votes
1 answer
97 views

Special ink for iPhone (or other mobile) screen for interaction

Last night I was playing Monopoly Zapped with the kids and I because quite intrigued as to how it worked. Basically, you interact with a tablet (or phone) whenever you want to do something... buy ...
El Guapo's user avatar
  • 133
3 votes
1 answer
93 views

Does anyone know the purpose of the malware,ios,social_engineering file on iOS

I have a jailbroken iPhone, and I noticed that it contains a file called social_engineering,ios,url_expression at the path: /private/var/mobile/Library/Caches/com.apple.Safari.SafeBrowsing/Google/...
user2279952's user avatar
3 votes
1 answer
275 views

IOS ASLR address calculation with delta offset (ARM64)

I am learning LLDB to debug ios apps, I have a jailbroken iPhone IOS 14.3 and a debugserver. Screenshot of start connect to remote process: Sections of my process(image dump sections hidenseek): ...
qazwsx135's user avatar
3 votes
1 answer
344 views

iOS Obfuscated Import Table

I'm looking at an Apple iOS binary file which is heavily protected and I trying to figure out if there's a way to get some of the information back. When I open the binary in IDA I see this in the ...
d123's user avatar
  • 201
3 votes
2 answers
815 views

Convert Mach-O VM Address To File Offset

this maybe total no brainer but i'm really new to this and i'd really appreciate some help! Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully ...
Malte's user avatar
  • 183
3 votes
1 answer
117 views

Hopper - no CFG leaving procedure at this address

Where is it that, when I am at a procedure with a lot of db, hopper will not show the control flow graph. How do I make the db change to a regular assembly symbol like mov,add,ret etc. What cause the ...
A O's user avatar
  • 161
3 votes
2 answers
4k views

In iOS, how can I find all hooked functions in substrate tweak

I'm trying to reverse a compiled tweak. As a first step, I want to find out all the functions it hooks. I can find all the calls to substrate framework functions, but I didn't figure out which ...
c c's user avatar
  • 141
3 votes
0 answers
59 views

db section in hopper

There is a db section in hopper, which cause the code not being able to go to control follow graph mode Do advise what cause this issue: ; Section __cstring ; Range: [0x10000a2c0; ...
A O's user avatar
  • 161
3 votes
0 answers
205 views

Solved: Unable to hook Apple binary on iOS 14.x with Frida

I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to ...
AGreen BHM's user avatar
3 votes
0 answers
178 views

Trying to understand a simple compiled PSI binary file

I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (...
Mister SirCode's user avatar
3 votes
2 answers
406 views

Is iOS 15 kernel cache encrypted?

I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
user avatar
3 votes
0 answers
664 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
MrSynAckSter's user avatar
  • 1,258
3 votes
0 answers
3k views

Recovering .ipa file for TestFlight app on iOS 8 (not jailbroken)

Normally if I want to see the binary and resources for an app, I connect my iPhone to my Macbook, sync with iTunes, and then all of my apps are in /Users/cybergibbons/Music/iTunes/iTunes Media/Mobile ...
Cybergibbons's user avatar
  • 1,762
2 votes
4 answers
7k views

Reverse engineering from binary or ipa [closed]

I lost the code of an app I wrote some years ago...the game structure was pretty cool and would be good to have it back... So can I reverse a binary into...something? I mean at least class tree... I'...
Michele's user avatar
  • 123
2 votes
1 answer
7k views

Using IDA Pro, How can I just "edit" values, Rather than patching Offsets,

I dont understand how people are finding offsets, So I want to know if there's a simple and easy method of just "patching values" I've been surfing the internet looking for VERY in depth ...
Mister SirCode's user avatar
2 votes
1 answer
278 views

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it. Pretext: ...
Max Chee's user avatar
2 votes
1 answer
538 views

iOS Position-independent code and relocations

I'm reversing few iOS Mach-O application executables these days and all of them use Position-independent code (PIC; the MH_PIC flag is set). I've been expecting a large number of relocation entries (...
MazeGen's user avatar
  • 143
2 votes
1 answer
5k views

Dylib can run without code sign in iOS?

I learn from somewhere dylib should be signed in iOS, otherwise dyld will refuse to execute it. But when I test the example of this post. The dylib is not signed by default in this project, but it ...
Karl's user avatar
  • 281
2 votes
1 answer
560 views

lldb - breakpoint not reached when attach do process (but executing when set before app running)

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all ...
Michal Zaborowski's user avatar
2 votes
1 answer
383 views

Deobfuscating IOS dll file (I think arm64)

I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes. I have ...
NOT Mike Oxmall epic duel's user avatar
2 votes
1 answer
507 views

No LC_UNIXTHREAD segment in iOS application Mach-O

I'm analyzing load commands section of executable Mach-O file in iOS 9.3.3, Twitter app is used for ilustration. # otool -hV Twitter Twitter: Mach header magic cputype cpusubtype caps ...
karfi's user avatar
  • 23
2 votes
1 answer
855 views

How are the iOS kernel cache and root filesystem decrypted?

On the iPhone Wiki there are decryption keys for several, but not all, of the iPhone firmwares (root filesystems and kernelcache files). How were these keys found?
Brennan Vincent's user avatar
2 votes
1 answer
696 views

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
Eccmms's user avatar
  • 97
2 votes
1 answer
460 views

How can I decompile and inspect a Safari Extension?

There is a suspect safari extension on a computer I'm investigating. How can I locate its install location, and possibly read the source code of the extension? Also, is there an easy way to tell if ...
makerofthings7's user avatar
2 votes
1 answer
1k views

Setting Breakpoints at functions decoded by Hopper/IDA Pro in an iOS app

So, its been very interesting to reverse engineer an iOS application and I have made significant improvement into learning how to read disassembly and understand them. Now I was trying to debug the ...
Satinder Rana's user avatar
2 votes
1 answer
345 views

MachO chained fixups parsing

I'm wondering how the info stored in the chained fixups in the Mach-O file is used to resolve binding and rebases? My question originated from wanting to parse all the Objective-C classes inside a ...
Jorayen's user avatar
  • 185