Questions tagged [ios]

The operating system by apple for mobile devices

Filter by
Sorted by
Tagged with
1
vote
1answer
306 views

Reverse-engineer digest http authentication

I have an iOS app which uses digest HTTP authentication with nonce which expires every 5 minutes. The client calculates response as following: HA1=MD5(username:realm:password) HA2=MD5(method:...
4
votes
1answer
503 views

Where to start with iOS debugging?

Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an ...
1
vote
1answer
275 views

iOS exploit hunting environment

Suppose, I have a new iPhone 6s with latest iOS, and I want to find vulnerabilities in iOS itself. iPhone is not jailbroken. How do I set up the proper environment for this? What software and/or ...
11
votes
2answers
13k views

Decrypting IPA Binary on OS X

I've been reading this PDF on reverse-engineering iOS applications and have reached slide 39, decrypting the binary. However, I've been attempting to disassemble and explore the binary in OS X 10.9.5 ...
1
vote
1answer
1k views

iOS Detect Function Hooking

I would like to find out if there's a way to detect if a C function is hooked in iOS? So for example let's say I hook SSLHandshake, OSStatus (*orig_SSLHandshake) (SSLContextRef context); OSStatus ...
1
vote
2answers
455 views

Disassemble IOS Kernel Module from jailbroken device?

I have a jailbroken IOS8 device, with an A6X processor. I'd like to pull either the device's kernel or a specific module, and decrypt it to use with a compatible objdump. The IOS kernel modules do ...
2
votes
1answer
299 views

How can I decompile and inspect a Safari Extension?

There is a suspect safari extension on a computer I'm investigating. How can I locate its install location, and possibly read the source code of the extension? Also, is there an easy way to tell if ...
1
vote
1answer
432 views

lldb - breakpoint not reached when attach do process (but executing when set before app running)

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all ...
1
vote
1answer
859 views

Setting Breakpoints at functions decoded by Hopper/IDA Pro in an iOS app

So, its been very interesting to reverse engineer an iOS application and I have made significant improvement into learning how to read disassembly and understand them. Now I was trying to debug the ...
0
votes
1answer
344 views

Figure out the objective-c code from this snipette

I am very new to the reverse engineering but I am trying to create objective-c code from an ARM assembly for iOS. I have come a very long way but now I am stuck at a point. Can anyone please tell me ...
11
votes
2answers
3k views

Generating Snapchat Snaptags (“QR” Codes)

For those that haven't seen, Snapchat now has a special type of image based code that allows you to quickly add friends by pointing the camera at the screen, similar to a QR code, called "Snaptags". ...
4
votes
2answers
4k views

Decrypt iOS standard encryption without device

In order to remove the encryption from an iOS binary on the App Store, it first has to be executed on a ARM capable device. Is there a way to do this without access to a device?
3
votes
1answer
86 views

Special ink for iPhone (or other mobile) screen for interaction

Last night I was playing Monopoly Zapped with the kids and I because quite intrigued as to how it worked. Basically, you interact with a tablet (or phone) whenever you want to do something... buy ...
3
votes
1answer
299 views

iOS Obfuscated Import Table

I'm looking at an Apple iOS binary file which is heavily protected and I trying to figure out if there's a way to get some of the information back. When I open the binary in IDA I see this in the ...
2
votes
1answer
529 views

Convert Mach-O VM Address To File Offset

this maybe total no brainer but i'm really new to this and i'd really appreciate some help! Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully ...
2
votes
1answer
349 views

Search through compressed/binary plist files in an IPA

I'm working on an iOS target. I'm effectively interested in running the program and its metadata through strings. I've noticed a simple grep does not return expected results and I suspect its because ...
2
votes
0answers
2k views

Recovering .ipa file for TestFlight app on iOS 8 (not jailbroken)

Normally if I want to see the binary and resources for an app, I connect my iPhone to my Macbook, sync with iTunes, and then all of my apps are in /Users/cybergibbons/Music/iTunes/iTunes Media/Mobile ...
-1
votes
1answer
2k views

Reversing iOS games with LLDB and IDA on arm64

Cracked the game with clutch and set watchpoint on the value address, when the value changes it breaks just fine but when i go to that binary address in IDA it shows me different instruction, here's ...
2
votes
0answers
612 views

How to dump iPhone arm64 memory? [closed]

Since GDB is no longer supported on arm64 devices i can't figure any alternative except lldb with debugserver, but unfortunately i can't dump memory with read command always giving me different errors,...
0
votes
0answers
841 views

How does iOS hash and salt passwords on its secondary-storage?

I bought a used iPhone from someone, but I accidentally got a lock screen on the phone and can't figure out what the passcode is. Long story short, how does iOS hash the passcodes for entry, what kind ...
3
votes
2answers
3k views

In iOS, how can I find all hooked functions in substrate tweak

I'm trying to reverse a compiled tweak. As a first step, I want to find out all the functions it hooks. I can find all the calls to substrate framework functions, but I didn't figure out which ...
-3
votes
1answer
1k views

objective-c: getting source code from binary [duplicate]

I posted a question a few time ago but answers were not clear to me and the topic was closed because apparently the request was not clear: SO I clarify it: One upon a time a wrote a obj-c app but now ...
41
votes
1answer
79k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
4
votes
2answers
3k views

Can not continue debugging after SIGTRAP

I am trying to debug an iOS app with gdb and when I hit a breakpoint I get this error, and can not continue. Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to process 190 thread ...
2
votes
4answers
3k views

Reverse engineering from binary or ipa [closed]

I lost the code of an app I wrote some years ago...the game structure was pretty cool and would be good to have it back... So can I reverse a binary into...something? I mean at least class tree... I'...
4
votes
2answers
15k views

Disassemble, edit and re-assembly iOS ipa apps

I'm trying to get jailbreak statistics for a University project related to security in mobile devices. My purpose is to disassemble, add a sample code and re-assemble to obtain a runnable iOS app ...
5
votes
1answer
384 views

AndroGuard equivalent for iOS

I am doing a research project where I want to look at apps that create or extends certain classes. For Android I am using the Androguard project which provide a large set of great tools for inspecting ...
58
votes
7answers
103k views

Possibilities for reverse engineering an ipa file to its source

I browsed a lot, but can't find any resources for reverse engineering an ipa file (iPhone application). Is there any method to reverse engineer an ipa file to its source? I've tried to rename it to ...