Hot answers tagged

17 votes

How are Apple App Store Apps encrypted?

When you download an app from the App Store, Apple injects a special 4196 byte long header into the signed binary encrypted with the public key associated with your iTunes account. This public/...
JAL's user avatar
  • 605
12 votes

How difficult is to decompile C++ file?

A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
0xC0000022L's user avatar
  • 10.9k
11 votes
Accepted

Decrypting IPA Binary on OS X

Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's ...
Igor Skochinsky's user avatar
  • 36.5k
8 votes
Accepted

getting function address by reading ADRP and ADD instruction values

For the first instruction (0x90000008) it matches the opcode below for PC relative addressing instruction. 0x90000008 = 0b10010000000000000000000000001000 so we have op=1 (ADRP), immlo=0, immhi=0 and ...
cimarron's user avatar
  • 1,331
6 votes

How does Apple enforce the expiration of beta apps distributed through TestFlight

I'm assuming you are talking about beta versions of apps distributed through TestFlight. While the iOS Distribution profile used to sign the app may not be expired, the profile used on the device in ...
JAL's user avatar
  • 605
5 votes
Accepted

how should i change an instruction to NOP in IDA?

NOTE: I'm assuming you're using IDA 7.X, although this should work equally well for 6.X versions. The option you're looking for is called Patch Program. For your specific question, you'd do the ...
hairlessbear's user avatar
5 votes
Accepted

Using IDA Pro, How can I just "edit" values, Rather than patching Offsets,

Open the binary in IDA View (assembly view). Place the cursor in the line that you want to patch. Click Edit in menu bar > Patch Program > Change bytes. Switch to "Hex View". Match the assembly ...
Biswapriyo's user avatar
  • 1,559
4 votes

Any Disassembler for iOS?

If your iPhone is jailbroken, you can use radare2 on it. You can follow the process to cross-compile it here, or simply grab the latest release from Cydia. A neat feature of radare2 is that you can ...
jvoisin's user avatar
  • 2,516
4 votes

OTOOL alternative for linux

I am in a similar position carrying out iOS related work on an Ubuntu host. The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which ...
Jon's user avatar
  • 167
4 votes
Accepted

Lipo alternate for linux

Here’s a port of Apple’s cctools to Linux, it should include lipo: https://github.com/tpoechtrager/cctools-port
Igor Skochinsky's user avatar
  • 36.5k
4 votes

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I think that the code is supposed to be checking for hooks. The adr instruction sets x8 to the start of the function so if there was a breakpoint or a jump placed there by a hook library, the byte ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes
Accepted

iOS Position-independent code and relocations

The Mach-O format does support relocations but they appear rarely outside of the object files; usually linker does pretty good job using PIC addressing inside the final linked module. As for imports ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes
Accepted

Mach-O : Convert virtual address to file offset on disk

The offsets in the LC_SEGMENT command are counted from the beginning of the Mach-O header in the file. Normally the Mach-O header is at file offset 0, however OS X and iOS support so-called "fat" ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes

Dylib can run without code sign in iOS?

EDIT: The below applies only to non-jailbroken devices. Jailbreaks usually disable signature checking completely to allow unsigned homebrew software to run. Apparently only libraries which are listed ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes

%orig found outside of hook or subclass

You should give the newer theos/theos a try, perhaps it has fixed this bug already. *.xmi/*.xi support was broken (seems still is), and the lead developer discourages its usage, and including a ...
kennytm's user avatar
  • 466
3 votes
Accepted

ios jailbreak: command cycrypt not found

The command you're trying to use is cycript, not cycrypt. Notice the i instead of your second y. That's why your ssh session fails executing it.
NirIzr's user avatar
  • 11.8k
3 votes

Can this method be hooked in iOS?

You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few ...
planetbeing's user avatar
3 votes

lldb - breakpoint not reached when attach do process (but executing when set before app running)

The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the ...
cimarron's user avatar
  • 1,331
3 votes

Download and Decompile an Ios app

AFAIK there is no way to download apps without a device, since the necessary keys are embedded in the CPU and cannot be extracted using software means (this also prevents offline decryption of apps). ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes
Accepted

Mach-O ARM64 using literal values instead of a frame pointer (BP) register

This is not really an RE question but anyway... On x86, the advantage of using dedicated EBP was that the instructions using it are smaller than those using ESP. It also makes it easier for a ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes

Change iOS app binary file

All apps and binaries that are executed on Apple platforms need to be signed by key/certificate issued by Apple. By modifying a single byte in the app binaries, you have invalidated this signature and ...
Robert's user avatar
  • 1,032
2 votes
Accepted

Setting Breakpoints at functions decoded by Hopper/IDA Pro in an iOS app

I was able to achieve this by installing gdbserver on my ipad. Then i ssh into the ipad and attach a remote lldb debugger (xcode tools) to attack breakpoints. A long method but works. There are now ...
Satinder Rana's user avatar
2 votes

Where to start with iOS debugging?

In iOS all sandboxing and security are handled by the AppleMobileFileIntegrity Kernel Extension As wat i know with Pod-Gizmo board you can pass the amfi_get_out_of_my_way boot-arg and with this arg ...
Karim H's user avatar
  • 136
2 votes

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

FindCrypt and IDASignsrch are both plugins used to scan the binary itself for cryptographic algorithm signatures. Non of them try to map API functions (and certainly not for iOS). They work by ...
NirIzr's user avatar
  • 11.8k
2 votes
Accepted

How are the iOS kernel cache and root filesystem decrypted?

AFAIK these keys are calculated by the bootrom code using the GID (model-specific) key which is disabled afterwards (IIRC) and cannot be used even if you have kernel code execution. So you need to ...
Igor Skochinsky's user avatar
  • 36.5k
2 votes
Accepted

Will jailbreaking affect file system accessibility for all apps?

Let me try to break down what you're asking. I find when use a jailbreak device I can access /Applications/. Yes, that's correct. A jailbroken device can access an iOS device's root file system ...
JAL's user avatar
  • 605
2 votes
Accepted

reversing ios notes file format

You are right about the 14th byte being the length on (some) short notes, like your file 4: 00000000 08 00 12 d6 02 08 00 10 00 1a cf 02 12 1b 54 68 ..............Th 00000010 69 73 20 6e 6f 74 65 ...
Guntram Blohm's user avatar
2 votes

How can a video file cause an iOS device to crash or hang?

I've been looking into this same issue and although I have not found exactly what is causing the problem. I have tried to use ffmpeg to find a little info. When running: ffmpeg -v error -i IMG_0942....
MikeSchem's user avatar
  • 131
2 votes
Accepted

Changing NSUserDefaults of a mac or iOS binary executable

The values are stored in a plist file under ~/Library/Preferences (or ~/Library/Containers/.../ if sandboxed). You can find more information about it from Apple's documentation. The easiest way to ...
cimarron's user avatar
  • 1,331

Only top scored, non community-wiki answers of a minimum length are eligible