65
If the IPA file is straight from iTunes/iPhone (without any modification), the code section in the binary (as indicated by the Info.plist) is encrypted with FairPlay (Apple's proprietary DRM). If you are unsure, you can check whether the cryptid bit is set with otool (see this page).
otool -arch armv7 -l thebinary | grep crypt
(where thebinary is the ...
42
iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would ...
22
After decrypting an IPA file on a jailbroken iDevice, you can use a much more affordable alternative to IDA Pro called Hopper - the mult-platform disassembler for < $100.
http://www.hopperapp.com/
It has support for analyzing iOS executables (among others) and even comes with the ability to convert ARM assembly to pseudo-C.
20
Not hard enough!
First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used.
If you save the key encrypted, a simple breakpoint will let them see the decrypted password. (or understanding the decryption algorithm).
15
When you download an app from the App Store, Apple injects a special 4196 byte long header into the signed binary encrypted with the public key associated with your iTunes account. This public/private key pair is generated when you create your iTunes Account, and transferred to your iOS device when you log in with your iTunes account or Apple ID. This is ...
13
A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/FreeBSD etc, for example. Most reverse engineering tools have a separate view for strings, because those are usually exceptionally useful to reverse engineers. Amirag ...
11
Other users have done a good job with the elements of this question that are specific to the IPA format. As for obtaining the source code to a binary object, please see this answer as for why this may be more difficult than you expect (as compared to, say, bytecode language decompilation).
10
If you have a jailbroken iDevice, AppSec Labs' iNalyzer can automate some of this process for you as well as provide you with a great way to review an iOS application.adding the appropriate repo
You can install iNalyzer from Cydia after adding the appropriate repo.
In my experience, it's easiest to work with the iNalyzer created project files (that you ...
10
Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's why no "offline" decryption app has been made.
7
I would recommend checking out Frida. It's an open source instrumentation toolkit for iOS, Android, Windows, Mac and Linux.
Check out this tutorial to dive in by building your own debugger in 5 minutes using Frida and Qml. The last part shows how to inject code into the “Yo” app and plot its network connections on Google Maps.
6
You won't be able to rebuild with XCode. You'd need to patch the decrypted app with a hex editor in order to make your desired changes.
See http://www.minecraftforum.net/topic/1363777-how-to-make-mods-for-ios/ for a sample walkthrough.
6
I'm assuming you are talking about beta versions of apps distributed through TestFlight.
While the iOS Distribution profile used to sign the app may not be expired, the profile used on the device in subject to a runtime kernel check which validates that the application expires after 60 days. See this example console log:
Mar 9 08:34:48 ***-iPhone amfid[**...
5
In order to remove the iOS app encryption (called FairPlay), you'd need to do one of the following:
Run the app on a physical ARM device and dynamically decrypt it.
Run the app on a virtual ARM device and dynamically decrypt it.
Statically decrypt the app.
Number 1 is the most common approach used, but it's out of the question since you're asking how to ...
5
dumpdecrypted can automate the decryption of the iOS binary. Additionally, there is a tool called iRET that you can use that automates alot of the analysis and reversing for you.
5
For the first instruction (0x90000008) it matches the opcode below for PC relative addressing instruction.
0x90000008 = 0b10010000000000000000000000001000 so we have op=1 (ADRP), immlo=0, immhi=0 and Rd=8 (X8). The instruction decodes to ADRP X8, #0. This is going take the current page the instruction pointer is at, add 0<<12, and store in register ...
4
As far as I know there are no tools for exploring and interacting with .IPA files like Androguard for.APK files, but since the .IPA is essentially a zip, you can unzip and analyze the key components individually.
Key components of the file and associated tools include:
Mach-O
The Mach-O file contains the executable code. This executable is encrypted ...
4
If your iPhone is jailbroken, you can use radare2 on it. You can follow the process to cross-compile it here, or simply grab the latest release from Cydia.
A neat feature of radare2 is that you can run it on your iPhone, and debug/analyse your application remotely, since radare2 instances can communicate, either by spawning the web interface, or with the ...
4
Open the binary in IDA View (assembly view). Place the cursor in the line that you want to patch. Click Edit in menu bar > Patch Program > Change bytes.
Switch to "Hex View". Match the assembly mnemonic with the HEX value. This vary with every instruction. For example, cmp [rbp-4], 4 (in X86_64) is shows as 83 7D FC 04.
Press F2 to edit in hex view. Edit ...
3
The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the application in lldb, no slide is applied so the addresses are the same.
Here is an example of it in action from two different Calculator apps running
0x00000200 ...
3
You can use Radare2, IDA Pro or Hopper. You'll need to reverse it and this might take more time than rewriting it. Also have a look at this post: Possibilities for reverse engineering an ipa file to its source
3
Use IDA Pro 6.5 Demo (available for free from http://hex-rays.com)
It supports ObjC by default
3
With a lot of manual correction you can most probably get "a" source code, in assembly language as a first step. That may be all you need to provide whatever support you need to do.
To get "a" source code in Objective-C or in any higher language you will have to analyse the structure of your working assembly program and translate it into the language of ...
3
According to the app developer's website, the cards use conductive ink which can interact with the mobile device's capacitive screen.
3
You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few instructions of the function with some instructions to jump to your hook. Your hook then call back to some instructions elsewhere that performs the instructions you ...
3
The command you're trying to use is cycript, not cycrypt. Notice the i instead of your second y. That's why your ssh session fails executing it.
3
You should give the newer theos/theos a try, perhaps it has fixed this bug already.
*.xmi/*.xi support was broken (seems still is), and the lead developer discourages its usage, and including a source file instead of header file is strange anyway. If you just want to separate the hooks into different files, simply put all the *.xm/*.x and into the _FILES ...
3
EDIT: The below applies only to non-jailbroken devices. Jailbreaks usually disable signature checking completely to allow unsigned homebrew software to run.
Apparently only libraries which are listed as dependencies of the executable in the header (LC_LOAD_DYLIB and similar commands) are checked, and those loaded with dlopen are not.
This is mentioned ...
3
Here’s a port of Apple’s cctools to Linux, it should include lipo:
https://github.com/tpoechtrager/cctools-port
3
This is not really an RE question but anyway...
On x86, the advantage of using dedicated EBP was that the instructions using it are smaller than those using ESP. It also makes it easier for a compiler (or a human when writing assembly) to track accesses to the stack frame - when using ESP you always need to compensate for every stack pointer adjustment.
...
2
This could happen if your breakpoint address is in the "middle" of the opcode, for example if your asm code looks like this:
0x000C: BLX R3
0x000E: LDR R0, [R6]
and you put breakpoint on address 0x00D, in this case the process will get SIGTRAP on other address than 0x000D, but gdb only knows the 0x00D address from the user input so its just throw ...
Only top voted, non community-wiki answers of a minimum length are eligible
