Hot answers tagged

47 votes

Decompiling iPhone App

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device ...
user avatar
20 votes

How difficult is to decompile C++ file?

Not hard enough! First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used. If you save the key ...
user avatar
  • 693
17 votes

How are Apple App Store Apps encrypted?

When you download an app from the App Store, Apple injects a special 4196 byte long header into the signed binary encrypted with the public key associated with your iTunes account. This public/...
user avatar
  • 605
13 votes

How difficult is to decompile C++ file?

A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
user avatar
  • 10.5k
11 votes
Accepted

Decrypting IPA Binary on OS X

Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's ...
user avatar
  • 34.6k
10 votes

What are the possibilities for reverse engineering an IPA file to its source?

I would recommend checking out Frida. It's an open source instrumentation toolkit for iOS, Android, Windows, Mac and Linux. Check out this tutorial to dive in by building your own debugger in 5 ...
user avatar
8 votes
Accepted

getting function address by reading ADRP and ADD instruction values

For the first instruction (0x90000008) it matches the opcode below for PC relative addressing instruction. 0x90000008 = 0b10010000000000000000000000001000 so we have op=1 (ADRP), immlo=0, immhi=0 and ...
user avatar
  • 1,321
6 votes

How does Apple enforce the expiration of beta apps distributed through TestFlight

I'm assuming you are talking about beta versions of apps distributed through TestFlight. While the iOS Distribution profile used to sign the app may not be expired, the profile used on the device in ...
user avatar
  • 605
5 votes

What are the possibilities for reverse engineering an IPA file to its source?

dumpdecrypted can automate the decryption of the iOS binary. Additionally, there is a tool called iRET that you can use that automates alot of the analysis and reversing for you.
user avatar
  • 51
5 votes

Decrypt iOS standard encryption without device

In order to remove the iOS app encryption (called FairPlay), you'd need to do one of the following: Run the app on a physical ARM device and dynamically decrypt it. Run the app on a virtual ARM ...
user avatar
5 votes
Accepted

Using IDA Pro, How can I just "edit" values, Rather than patching Offsets,

Open the binary in IDA View (assembly view). Place the cursor in the line that you want to patch. Click Edit in menu bar > Patch Program > Change bytes. Switch to "Hex View". Match the assembly ...
user avatar
  • 1,439
4 votes

Any Disassembler for iOS?

If your iPhone is jailbroken, you can use radare2 on it. You can follow the process to cross-compile it here, or simply grab the latest release from Cydia. A neat feature of radare2 is that you can ...
user avatar
  • 2,486
3 votes

objective-c: getting source code from binary

With a lot of manual correction you can most probably get "a" source code, in assembly language as a first step. That may be all you need to provide whatever support you need to do. To get "a" ...
user avatar
3 votes

%orig found outside of hook or subclass

You should give the newer theos/theos a try, perhaps it has fixed this bug already. *.xmi/*.xi support was broken (seems still is), and the lead developer discourages its usage, and including a ...
user avatar
  • 446
3 votes
Accepted

ios jailbreak: command cycrypt not found

The command you're trying to use is cycript, not cycrypt. Notice the i instead of your second y. That's why your ssh session fails executing it.
user avatar
  • 11.3k
3 votes

Can this method be hooked in iOS?

You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few ...
user avatar
3 votes

lldb - breakpoint not reached when attach do process (but executing when set before app running)

The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the ...
user avatar
  • 1,321
3 votes
Accepted

Special ink for iPhone (or other mobile) screen for interaction

According to the app developer's website, the cards use conductive ink which can interact with the mobile device's capacitive screen.
user avatar
3 votes

Dylib can run without code sign in iOS?

EDIT: The below applies only to non-jailbroken devices. Jailbreaks usually disable signature checking completely to allow unsigned homebrew software to run. Apparently only libraries which are listed ...
user avatar
  • 34.6k
3 votes

Download and Decompile an Ios app

AFAIK there is no way to download apps without a device, since the necessary keys are embedded in the CPU and cannot be extracted using software means (this also prevents offline decryption of apps). ...
user avatar
  • 34.6k
3 votes
Accepted

Lipo alternate for linux

Here’s a port of Apple’s cctools to Linux, it should include lipo: https://github.com/tpoechtrager/cctools-port
user avatar
  • 34.6k
3 votes
Accepted

Mach-O ARM64 using literal values instead of a frame pointer (BP) register

This is not really an RE question but anyway... On x86, the advantage of using dedicated EBP was that the instructions using it are smaller than those using ESP. It also makes it easier for a ...
user avatar
  • 34.6k
3 votes

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I think that the code is supposed to be checking for hooks. The adr instruction sets x8 to the start of the function so if there was a breakpoint or a jump placed there by a hook library, the byte ...
user avatar
  • 34.6k
3 votes

Change iOS app binary file

All apps and binaries that are executed on Apple platforms need to be signed by key/certificate issued by Apple. By modifying a single byte in the app binaries, you have invalidated this signature and ...
user avatar
  • 525
2 votes
Accepted

Can not continue debugging after SIGTRAP

This could happen if your breakpoint address is in the "middle" of the opcode, for example if your asm code looks like this: 0x000C: BLX R3 0x000E: LDR R0, [R6] and you put breakpoint on address ...
user avatar
2 votes

iOS Obfuscated Import Table

My guess would be that the packer/obfuscator does manual importing by scanning for dylibs in memory or maybe walking the dyld structures. The names in the import list are red herrings, and the fake ...
user avatar
  • 34.6k
2 votes
Accepted

Setting Breakpoints at functions decoded by Hopper/IDA Pro in an iOS app

I was able to achieve this by installing gdbserver on my ipad. Then i ssh into the ipad and attach a remote lldb debugger (xcode tools) to attack breakpoints. A long method but works. There are now ...
user avatar
2 votes

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

FindCrypt and IDASignsrch are both plugins used to scan the binary itself for cryptographic algorithm signatures. Non of them try to map API functions (and certainly not for iOS). They work by ...
user avatar
  • 11.3k
2 votes

Decrypt iOS standard encryption without device

My answer What you can actually do is to look for "cracked IPA apps", which basically mean they are decrypted (FairPlay encryption removed). There are many sites like this one (AppAddict). Note I ...
user avatar
2 votes

Where to start with iOS debugging?

In iOS all sandboxing and security are handled by the AppleMobileFileIntegrity Kernel Extension As wat i know with Pod-Gizmo board you can pass the amfi_get_out_of_my_way boot-arg and with this arg ...
user avatar
  • 136

Only top scored, non community-wiki answers of a minimum length are eligible