17
votes
How are Apple App Store Apps encrypted?
When you download an app from the App Store, Apple injects a special 4196 byte long header into the signed binary encrypted with the public key associated with your iTunes account. This public/...
- 605
12
votes
How difficult is to decompile C++ file?
A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
- 10.9k
11
votes
Accepted
Decrypting IPA Binary on OS X
Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's ...
- 36.2k
8
votes
Accepted
getting function address by reading ADRP and ADD instruction values
For the first instruction (0x90000008) it matches the opcode below for PC relative addressing instruction.
0x90000008 = 0b10010000000000000000000000001000 so we have op=1 (ADRP), immlo=0, immhi=0 and ...
- 1,331
6
votes
How does Apple enforce the expiration of beta apps distributed through TestFlight
I'm assuming you are talking about beta versions of apps distributed through TestFlight.
While the iOS Distribution profile used to sign the app may not be expired, the profile used on the device in ...
- 605
5
votes
Accepted
how should i change an instruction to NOP in IDA?
NOTE: I'm assuming you're using IDA 7.X, although this should work equally well for 6.X versions.
The option you're looking for is called Patch Program. For your specific question, you'd do the ...
- 905
5
votes
Accepted
Using IDA Pro, How can I just "edit" values, Rather than patching Offsets,
Open the binary in IDA View (assembly view). Place the cursor in the line that you want to patch. Click Edit in menu bar > Patch Program > Change bytes.
Switch to "Hex View". Match the assembly ...
- 1,549
4
votes
Any Disassembler for iOS?
If your iPhone is jailbroken, you can use radare2 on it. You can follow the process to cross-compile it here, or simply grab the latest release from Cydia.
A neat feature of radare2 is that you can ...
- 2,506
4
votes
OTOOL alternative for linux
I am in a similar position carrying out iOS related work on an Ubuntu host.
The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which ...
- 167
4
votes
Accepted
Lipo alternate for linux
Here’s a port of Apple’s cctools to Linux, it should include lipo:
https://github.com/tpoechtrager/cctools-port
- 36.2k
4
votes
Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff
I think that the code is supposed to be checking for hooks.
The adr instruction sets x8 to the start of the function so if there was a breakpoint or a jump placed there by a hook library, the byte ...
- 36.2k
3
votes
Accepted
Mach-O : Convert virtual address to file offset on disk
The offsets in the LC_SEGMENT command are counted from the beginning of the Mach-O header in the file. Normally the Mach-O header is at file offset 0, however OS X and iOS support so-called "fat" ...
- 36.2k
3
votes
Dylib can run without code sign in iOS?
EDIT: The below applies only to non-jailbroken devices. Jailbreaks usually disable signature checking completely to allow unsigned homebrew software to run.
Apparently only libraries which are listed ...
- 36.2k
3
votes
%orig found outside of hook or subclass
You should give the newer theos/theos a try, perhaps it has fixed this bug already.
*.xmi/*.xi support was broken (seems still is), and the lead developer discourages its usage, and including a ...
- 456
3
votes
Accepted
ios jailbreak: command cycrypt not found
The command you're trying to use is cycript, not cycrypt. Notice the i instead of your second y. That's why your ssh session fails executing it.
- 11.7k
3
votes
Can this method be hooked in iOS?
You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few ...
- 146
3
votes
lldb - breakpoint not reached when attach do process (but executing when set before app running)
The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the ...
- 1,331
3
votes
Accepted
iOS Position-independent code and relocations
The Mach-O format does support relocations but they appear rarely outside of the object files; usually linker does pretty good job using PIC addressing inside the final linked module.
As for imports ...
- 36.2k
3
votes
Download and Decompile an Ios app
AFAIK there is no way to download apps without a device, since the necessary keys are embedded in the CPU and cannot be extracted using software means (this also prevents offline decryption of apps). ...
- 36.2k
3
votes
Accepted
Mach-O ARM64 using literal values instead of a frame pointer (BP) register
This is not really an RE question but anyway...
On x86, the advantage of using dedicated EBP was that the instructions using it are smaller than those using ESP. It also makes it easier for a ...
- 36.2k
3
votes
Change iOS app binary file
All apps and binaries that are executed on Apple platforms need to be signed by key/certificate issued by Apple. By modifying a single byte in the app binaries, you have invalidated this signature and ...
- 885
2
votes
Decrypt iOS standard encryption without device
My answer What you can actually do is to look for "cracked IPA apps", which basically mean they are decrypted (FairPlay encryption removed). There are many sites like this one (AppAddict).
Note
I ...
2
votes
Accepted
Setting Breakpoints at functions decoded by Hopper/IDA Pro in an iOS app
I was able to achieve this by installing gdbserver on my ipad. Then i ssh into the ipad and attach a remote lldb debugger (xcode tools) to attack breakpoints. A long method but works. There are now ...
2
votes
Find cryptography used by iOS applications by analyzing ARM assembly in IDA?
FindCrypt and IDASignsrch are both plugins used to scan the binary itself for cryptographic algorithm signatures. Non of them try to map API functions (and certainly not for iOS).
They work by ...
- 11.7k
2
votes
Where to start with iOS debugging?
In iOS all sandboxing and security are handled by the AppleMobileFileIntegrity Kernel Extension
As wat i know with Pod-Gizmo board you can pass the amfi_get_out_of_my_way boot-arg and with this arg ...
- 136
2
votes
Accepted
No LC_UNIXTHREAD segment in iOS application Mach-O
Since a few versions ago, LC_UNIXTHREAD has been deprecated in favor of the new command, LC_MAIN.
#define LC_MAIN (0x28|LC_REQ_DYLD) /* replacement for LC_UNIXTHREAD */
struct entry_point_command {
...
- 36.2k
2
votes
How can I decompile and inspect a Safari Extension?
Safari extensions are just xar archives (according to this)
Open an terminal and unpack like:
xar -xf 'TheExtensionName.safariextz'
The javascript (or other) code might still be obfuscated.
- 141
2
votes
Accepted
How are the iOS kernel cache and root filesystem decrypted?
AFAIK these keys are calculated by the bootrom code using the GID (model-specific) key which is disabled afterwards (IIRC) and cannot be used even if you have kernel code execution. So you need to ...
- 36.2k
2
votes
Accepted
Will jailbreaking affect file system accessibility for all apps?
Let me try to break down what you're asking.
I find when use a jailbreak device I can access /Applications/.
Yes, that's correct. A jailbroken device can access an iOS device's root file system ...
- 605
Only top scored, non community-wiki answers of a minimum length are eligible