46
iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would ...
20
Not hard enough!
First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used.
If you save the key encrypted, a simple breakpoint will let them see the decrypted password. (or understanding the decryption algorithm).
17
When you download an app from the App Store, Apple injects a special 4196 byte long header into the signed binary encrypted with the public key associated with your iTunes account. This public/private key pair is generated when you create your iTunes Account, and transferred to your iOS device when you log in with your iTunes account or Apple ID. This is ...
13
A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/FreeBSD etc, for example. Most reverse engineering tools have a separate view for strings, because those are usually exceptionally useful to reverse engineers. Amirag ...
11
Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's why no "offline" decryption app has been made.
8
I would recommend checking out Frida. It's an open source instrumentation toolkit for iOS, Android, Windows, Mac and Linux.
Check out this tutorial to dive in by building your own debugger in 5 minutes using Frida and Qml. The last part shows how to inject code into the “Yo” app and plot its network connections on Google Maps.
6
You won't be able to rebuild with XCode. You'd need to patch the decrypted app with a hex editor in order to make your desired changes.
See http://www.minecraftforum.net/topic/1363777-how-to-make-mods-for-ios/ for a sample walkthrough.
6
I'm assuming you are talking about beta versions of apps distributed through TestFlight.
While the iOS Distribution profile used to sign the app may not be expired, the profile used on the device in subject to a runtime kernel check which validates that the application expires after 60 days. See this example console log:
Mar 9 08:34:48 ***-iPhone amfid[**...
6
For the first instruction (0x90000008) it matches the opcode below for PC relative addressing instruction.
0x90000008 = 0b10010000000000000000000000001000 so we have op=1 (ADRP), immlo=0, immhi=0 and Rd=8 (X8). The instruction decodes to ADRP X8, #0. This is going take the current page the instruction pointer is at, add 0<<12, and store in register ...
5
In order to remove the iOS app encryption (called FairPlay), you'd need to do one of the following:
Run the app on a physical ARM device and dynamically decrypt it.
Run the app on a virtual ARM device and dynamically decrypt it.
Statically decrypt the app.
Number 1 is the most common approach used, but it's out of the question since you're asking how to ...
5
dumpdecrypted can automate the decryption of the iOS binary. Additionally, there is a tool called iRET that you can use that automates alot of the analysis and reversing for you.
5
Open the binary in IDA View (assembly view). Place the cursor in the line that you want to patch. Click Edit in menu bar > Patch Program > Change bytes.
Switch to "Hex View". Match the assembly mnemonic with the HEX value. This vary with every instruction. For example, cmp [rbp-4], 4 (in X86_64) is shows as 83 7D FC 04.
Press F2 to edit in hex view. Edit ...
4
As far as I know there are no tools for exploring and interacting with .IPA files like Androguard for.APK files, but since the .IPA is essentially a zip, you can unzip and analyze the key components individually.
Key components of the file and associated tools include:
Mach-O
The Mach-O file contains the executable code. This executable is encrypted ...
4
If your iPhone is jailbroken, you can use radare2 on it. You can follow the process to cross-compile it here, or simply grab the latest release from Cydia.
A neat feature of radare2 is that you can run it on your iPhone, and debug/analyse your application remotely, since radare2 instances can communicate, either by spawning the web interface, or with the ...
3
You can use Radare2, IDA Pro or Hopper. You'll need to reverse it and this might take more time than rewriting it. Also have a look at this post: Possibilities for reverse engineering an ipa file to its source
3
Use IDA Pro 6.5 Demo (available for free from http://hex-rays.com)
It supports ObjC by default
3
With a lot of manual correction you can most probably get "a" source code, in assembly language as a first step. That may be all you need to provide whatever support you need to do.
To get "a" source code in Objective-C or in any higher language you will have to analyse the structure of your working assembly program and translate it into the language of ...
3
The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the application in lldb, no slide is applied so the addresses are the same.
Here is an example of it in action from two different Calculator apps running
0x00000200 ...
3
According to the app developer's website, the cards use conductive ink which can interact with the mobile device's capacitive screen.
3
You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few instructions of the function with some instructions to jump to your hook. Your hook then call back to some instructions elsewhere that performs the instructions you ...
3
The command you're trying to use is cycript, not cycrypt. Notice the i instead of your second y. That's why your ssh session fails executing it.
3
You should give the newer theos/theos a try, perhaps it has fixed this bug already.
*.xmi/*.xi support was broken (seems still is), and the lead developer discourages its usage, and including a source file instead of header file is strange anyway. If you just want to separate the hooks into different files, simply put all the *.xm/*.x and into the _FILES ...
3
EDIT: The below applies only to non-jailbroken devices. Jailbreaks usually disable signature checking completely to allow unsigned homebrew software to run.
Apparently only libraries which are listed as dependencies of the executable in the header (LC_LOAD_DYLIB and similar commands) are checked, and those loaded with dlopen are not.
This is mentioned ...
3
AFAIK there is no way to download apps without a device, since the necessary keys are embedded in the CPU and cannot be extracted using software means (this also prevents offline decryption of apps). However, with a jailbroken device it's possible to simulate user input in the App Store app and download the apps automatically (and then decrypt them). Check ...
3
Here’s a port of Apple’s cctools to Linux, it should include lipo:
https://github.com/tpoechtrager/cctools-port
3
This is not really an RE question but anyway...
On x86, the advantage of using dedicated EBP was that the instructions using it are smaller than those using ESP. It also makes it easier for a compiler (or a human when writing assembly) to track accesses to the stack frame - when using ESP you always need to compensate for every stack pointer adjustment.
...
3
I think that the code is supposed to be checking for hooks.
The adr instruction sets x8 to the start of the function so if there was a breakpoint or a jump placed there by a hook library, the byte there would be different from the original value FF.
One possibility is that there is a breakpoint there but the debugger is masking it by showing you the ...
2
This could happen if your breakpoint address is in the "middle" of the opcode, for example if your asm code looks like this:
0x000C: BLX R3
0x000E: LDR R0, [R6]
and you put breakpoint on address 0x00D, in this case the process will get SIGTRAP on other address than 0x000D, but gdb only knows the 0x00D address from the user input so its just throw ...
2
My guess would be that the packer/obfuscator does manual importing by scanning for dylibs in memory or maybe walking the dyld structures. The names in the import list are red herrings, and the fake imports are probably present only to ensure the loading of the required dylibs. you will have to analyze and/or debug the code to figure out how it really works.
2
I was able to achieve this by installing gdbserver on my ipad. Then i ssh into the ipad and attach a remote lldb debugger (xcode tools) to attack breakpoints. A long method but works. There are now tools to debug in same way on android and ios.
Only top voted, non community-wiki answers of a minimum length are eligible
