Questions tagged [ios]

The operating system by apple for mobile devices

Filter by
Sorted by
Tagged with
58
votes
7answers
103k views

Possibilities for reverse engineering an ipa file to its source

I browsed a lot, but can't find any resources for reverse engineering an ipa file (iPhone application). Is there any method to reverse engineer an ipa file to its source? I've tried to rename it to ...
41
votes
1answer
79k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
11
votes
2answers
12k views

Decrypting IPA Binary on OS X

I've been reading this PDF on reverse-engineering iOS applications and have reached slide 39, decrypting the binary. However, I've been attempting to disassemble and explore the binary in OS X 10.9.5 ...
11
votes
2answers
3k views

Generating Snapchat Snaptags (“QR” Codes)

For those that haven't seen, Snapchat now has a special type of image based code that allows you to quickly add friends by pointing the camera at the screen, similar to a QR code, called "Snaptags". ...
9
votes
2answers
6k views

How difficult is to decompile C++ file?

I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension .cpp. I am also going to create an iOS app which will use the same AES key. Is ...
9
votes
1answer
4k views

How are Apple App Store Apps encrypted?

I know how to decrypt an iOS app use tools. How is this encryption performed? Why can iOS apps only be decrypted on a device? Is there a device-specific key used for encryption?
5
votes
1answer
1k views

getting function address by reading ADRP and ADD instruction values

Hello reverse engineers, I'm analysing a fat Macho-O binary, and it has an ADRP and an ADD instruction in it. I'm talking about these instructions: __text:00000001002E050C ADRP ...
5
votes
1answer
384 views

AndroGuard equivalent for iOS

I am doing a research project where I want to look at apps that create or extends certain classes. For Android I am using the Androguard project which provide a large set of great tools for inspecting ...
4
votes
2answers
4k views

Decrypt iOS standard encryption without device

In order to remove the encryption from an iOS binary on the App Store, it first has to be executed on a ARM capable device. Is there a way to do this without access to a device?
4
votes
2answers
14k views

Disassemble, edit and re-assembly iOS ipa apps

I'm trying to get jailbreak statistics for a University project related to security in mobile devices. My purpose is to disassemble, add a sample code and re-assemble to obtain a runnable iOS app ...
4
votes
1answer
495 views

Where to start with iOS debugging?

Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an ...
4
votes
2answers
3k views

Can not continue debugging after SIGTRAP

I am trying to debug an iOS app with gdb and when I hit a breakpoint I get this error, and can not continue. Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to process 190 thread ...
4
votes
1answer
216 views

How can a video file cause an iOS device to crash or hang?

There have been reports of a malformed h264 video file causing iOS devices to hang or crash (I've added the link in plaintext to avoid accidental clickthroughs, play at your own risk: http://www....
4
votes
0answers
193 views

running iOS debugserver on non-jailbroken devices

There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
3
votes
1answer
2k views

How does Apple enforce the expiration of beta apps distributed through TestFlight

A beta app expired after a period of time. But after some investigated on the ipa file, both the certificate and the mobile provisioning profile embedded in the bundle are not expired. How can Apple ...
3
votes
1answer
86 views

Special ink for iPhone (or other mobile) screen for interaction

Last night I was playing Monopoly Zapped with the kids and I because quite intrigued as to how it worked. Basically, you interact with a tablet (or phone) whenever you want to do something... buy ...
3
votes
1answer
298 views

iOS Obfuscated Import Table

I'm looking at an Apple iOS binary file which is heavily protected and I trying to figure out if there's a way to get some of the information back. When I open the binary in IDA I see this in the ...
3
votes
2answers
3k views

In iOS, how can I find all hooked functions in substrate tweak

I'm trying to reverse a compiled tweak. As a first step, I want to find out all the functions it hooks. I can find all the calls to substrate framework functions, but I didn't figure out which ...
3
votes
1answer
111 views

How does IPA decryption works?

All IPAs being downloaded from AppStore gets encrypted on servers as part of FairPlay DRM. But decryption is accomplished on local device. As far as I know there is some hardware module which contains ...
2
votes
4answers
3k views

Reverse engineering from binary or ipa [closed]

I lost the code of an app I wrote some years ago...the game structure was pretty cool and would be good to have it back... So can I reverse a binary into...something? I mean at least class tree... I'...
2
votes
3answers
2k views

Any Disassembler for iOS?

Is there any iOS app for arm Disassembling? I mean one that can run on iPhone. Nor IDA or Hopper have any iOS version
2
votes
1answer
189 views

No LC_UNIXTHREAD segment in iOS application Mach-O

I'm analyzing load commands section of executable Mach-O file in iOS 9.3.3, Twitter app is used for ilustration. # otool -hV Twitter Twitter: Mach header magic cputype cpusubtype caps ...
2
votes
1answer
297 views

How can I decompile and inspect a Safari Extension?

There is a suspect safari extension on a computer I'm investigating. How can I locate its install location, and possibly read the source code of the extension? Also, is there an easy way to tell if ...
2
votes
1answer
235 views

Why function names are visible in a decompiled iOS app?

While decompiling an iOS app, all function names and object names are visible. Why ? My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
2
votes
1answer
577 views

How are the iOS kernel cache and root filesystem decrypted?

On the iPhone Wiki there are decryption keys for several, but not all, of the iPhone firmwares (root filesystems and kernelcache files). How were these keys found?
2
votes
1answer
527 views

Convert Mach-O VM Address To File Offset

this maybe total no brainer but i'm really new to this and i'd really appreciate some help! Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully ...
2
votes
1answer
345 views

Search through compressed/binary plist files in an IPA

I'm working on an iOS target. I'm effectively interested in running the program and its metadata through strings. I've noticed a simple grep does not return expected results and I suspect its because ...
2
votes
0answers
85 views

(iOS lldb) Unable to debug past a splash/loading screen

I'm trying to lldb debug this certain iOS application. Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity. However, whenever I try to debug ...
2
votes
1answer
311 views

How does the 'graphic views' on Hopper Disassembler work?

I would like to understand better what is that information on "graphic views" at the inspector of Hopper Disassembler. I've checked the tutorial but it just skips this section. Thanks.
2
votes
0answers
398 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
2
votes
0answers
157 views

Analysis Apps for iOS10/64Bit

I need to analyze an iOS app. Since it's iOS 10 64Bit (jailbroken) this time, I'm desperately looking for good analysis tools for injecting, manipulating, anti-anti-jailbreak, tracing, and so on. I ...
2
votes
0answers
2k views

Recovering .ipa file for TestFlight app on iOS 8 (not jailbroken)

Normally if I want to see the binary and resources for an app, I connect my iPhone to my Macbook, sync with iTunes, and then all of my apps are in /Users/cybergibbons/Music/iTunes/iTunes Media/Mobile ...
2
votes
0answers
609 views

How to dump iPhone arm64 memory? [closed]

Since GDB is no longer supported on arm64 devices i can't figure any alternative except lldb with debugserver, but unfortunately i can't dump memory with read command always giving me different errors,...
1
vote
1answer
63 views

Using IDA Pro, How can I just “edit” values, Rather than patching Offsets,

Im a part of the iOSGods community, and they make lots of cheats, but they dont really do the best at teching other people how to do that. Those people never reply to my help support topics on ...
1
vote
1answer
417 views

%orig found outside of hook or subclass

I'm using Rpetrich's Theos repository and I'm using tweak.xmi for making tweak on multiple files for easier in management. I can build and run successfully except one thing: I cannot use hookf. ...
1
vote
1answer
589 views

Can this method be hooked in iOS?

Here's IDA: http://pastebin.com/AkU0MDWh Also, would this be written in C to show like this? In comparison to a regular method like: ListRowCell - (id)initWithStyle:(int) reuseIdentifier:(id)
1
vote
1answer
253 views

iOS Position-independent code and relocations

I'm reversing few iOS Mach-O application executables these days and all of them use Position-independent code (PIC; the MH_PIC flag is set). I've been expecting a large number of relocation entries (...
1
vote
1answer
3k views

Dylib can run without code sign in iOS?

I learn from somewhere dylib should be signed in iOS, otherwise dyld will refuse to execute it. But when I test the example of this post. The dylib is not signed by default in this project, but it ...
1
vote
1answer
431 views

lldb - breakpoint not reached when attach do process (but executing when set before app running)

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all ...
1
vote
1answer
199 views

Lipo alternate for linux

Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
1
vote
1answer
153 views

How to identify which iOS kernelcache is installed?

I've an iPhone7 running iOS11.3 (15E216). The ipsw for this build version contains two separate kernelcache files named kernelcache.release.iphone9 and kernelcache.release.iphone10. Neither file is an ...
1
vote
1answer
1k views

iOS entitlements for enable calling to private API

I'd like to analyze iOS private framework that broke commonly used GitHub project called AppLister. Here's some info about the API: Framework : MobileCoreServices.framework. Class: ...
1
vote
1answer
410 views

Mach-O : Convert virtual address to file offset on disk

Hello reverse engineers, I am reverse engineering a Mach-O executable for iOS. File says: Mach-O universal binary with 2 architectures: [arm_v7: Mach-O arm_v7 executable] [64-bit architecture=12]. I ...
1
vote
1answer
94 views

Reverse engineering ARM PIC

I'm starting to learn reverse engineering so I'm trying to reverse sample app, compiled for ARM(iOS) and now I'm looking into code. This section is right before WHILE and right at the beginning of ...
1
vote
1answer
273 views

Can a RTMPS stream be authenticated by a cookie?

After performing an mitm attack I discovered that the Nest mobile application appears to use a cookie as authentication to access data. It receives a response that gives an RTMPS address, but it seems ...
1
vote
1answer
570 views

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
1
vote
1answer
302 views

Reverse-engineer digest http authentication

I have an iOS app which uses digest HTTP authentication with nonce which expires every 5 minutes. The client calculates response as following: HA1=MD5(username:realm:password) HA2=MD5(method:...
1
vote
1answer
268 views

iOS exploit hunting environment

Suppose, I have a new iPhone 6s with latest iOS, and I want to find vulnerabilities in iOS itself. iPhone is not jailbroken. How do I set up the proper environment for this? What software and/or ...
1
vote
1answer
1k views

iOS Detect Function Hooking

I would like to find out if there's a way to detect if a C function is hooked in iOS? So for example let's say I hook SSLHandshake, OSStatus (*orig_SSLHandshake) (SSLContextRef context); OSStatus ...
1
vote
1answer
842 views

Setting Breakpoints at functions decoded by Hopper/IDA Pro in an iOS app

So, its been very interesting to reverse engineer an iOS application and I have made significant improvement into learning how to read disassembly and understand them. Now I was trying to debug the ...