47
votes
Decompiling iPhone App
iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device ...
- 5,551
20
votes
How difficult is to decompile C++ file?
Not hard enough!
First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used.
If you save the key ...
- 693
17
votes
How are Apple App Store Apps encrypted?
When you download an app from the App Store, Apple injects a special 4196 byte long header into the signed binary encrypted with the public key associated with your iTunes account. This public/...
- 605
13
votes
How difficult is to decompile C++ file?
A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
- 10.5k
11
votes
Accepted
Decrypting IPA Binary on OS X
Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's ...
- 34.6k
10
votes
What are the possibilities for reverse engineering an IPA file to its source?
I would recommend checking out Frida. It's an open source instrumentation toolkit for iOS, Android, Windows, Mac and Linux.
Check out this tutorial to dive in by building your own debugger in 5 ...
8
votes
Accepted
getting function address by reading ADRP and ADD instruction values
For the first instruction (0x90000008) it matches the opcode below for PC relative addressing instruction.
0x90000008 = 0b10010000000000000000000000001000 so we have op=1 (ADRP), immlo=0, immhi=0 and ...
- 1,321
6
votes
How does Apple enforce the expiration of beta apps distributed through TestFlight
I'm assuming you are talking about beta versions of apps distributed through TestFlight.
While the iOS Distribution profile used to sign the app may not be expired, the profile used on the device in ...
- 605
5
votes
What are the possibilities for reverse engineering an IPA file to its source?
dumpdecrypted can automate the decryption of the iOS binary. Additionally, there is a tool called iRET that you can use that automates alot of the analysis and reversing for you.
- 51
5
votes
Decrypt iOS standard encryption without device
In order to remove the iOS app encryption (called FairPlay), you'd need to do one of the following:
Run the app on a physical ARM device and dynamically decrypt it.
Run the app on a virtual ARM ...
- 20.4k
5
votes
Accepted
Using IDA Pro, How can I just "edit" values, Rather than patching Offsets,
Open the binary in IDA View (assembly view). Place the cursor in the line that you want to patch. Click Edit in menu bar > Patch Program > Change bytes.
Switch to "Hex View". Match the assembly ...
- 1,439
4
votes
Any Disassembler for iOS?
If your iPhone is jailbroken, you can use radare2 on it. You can follow the process to cross-compile it here, or simply grab the latest release from Cydia.
A neat feature of radare2 is that you can ...
- 2,486
3
votes
objective-c: getting source code from binary
With a lot of manual correction you can most probably get "a" source code, in assembly language as a first step. That may be all you need to provide whatever support you need to do.
To get "a" ...
- 159
3
votes
%orig found outside of hook or subclass
You should give the newer theos/theos a try, perhaps it has fixed this bug already.
*.xmi/*.xi support was broken (seems still is), and the lead developer discourages its usage, and including a ...
- 446
3
votes
Accepted
ios jailbreak: command cycrypt not found
The command you're trying to use is cycript, not cycrypt. Notice the i instead of your second y. That's why your ssh session fails executing it.
- 11.3k
3
votes
Can this method be hooked in iOS?
You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few ...
- 146
3
votes
lldb - breakpoint not reached when attach do process (but executing when set before app running)
The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the ...
- 1,321
3
votes
Accepted
Special ink for iPhone (or other mobile) screen for interaction
According to the app developer's website, the cards use conductive ink which can interact with the mobile device's capacitive screen.
- 20.4k
3
votes
Dylib can run without code sign in iOS?
EDIT: The below applies only to non-jailbroken devices. Jailbreaks usually disable signature checking completely to allow unsigned homebrew software to run.
Apparently only libraries which are listed ...
- 34.6k
3
votes
Download and Decompile an Ios app
AFAIK there is no way to download apps without a device, since the necessary keys are embedded in the CPU and cannot be extracted using software means (this also prevents offline decryption of apps). ...
- 34.6k
3
votes
Accepted
Lipo alternate for linux
Here’s a port of Apple’s cctools to Linux, it should include lipo:
https://github.com/tpoechtrager/cctools-port
- 34.6k
3
votes
Accepted
Mach-O ARM64 using literal values instead of a frame pointer (BP) register
This is not really an RE question but anyway...
On x86, the advantage of using dedicated EBP was that the instructions using it are smaller than those using ESP. It also makes it easier for a ...
- 34.6k
3
votes
Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff
I think that the code is supposed to be checking for hooks.
The adr instruction sets x8 to the start of the function so if there was a breakpoint or a jump placed there by a hook library, the byte ...
- 34.6k
3
votes
Change iOS app binary file
All apps and binaries that are executed on Apple platforms need to be signed by key/certificate issued by Apple. By modifying a single byte in the app binaries, you have invalidated this signature and ...
- 525
2
votes
Accepted
Can not continue debugging after SIGTRAP
This could happen if your breakpoint address is in the "middle" of the opcode, for example if your asm code looks like this:
0x000C: BLX R3
0x000E: LDR R0, [R6]
and you put breakpoint on address ...
- 36
2
votes
iOS Obfuscated Import Table
My guess would be that the packer/obfuscator does manual importing by scanning for dylibs in memory or maybe walking the dyld structures. The names in the import list are red herrings, and the fake ...
- 34.6k
2
votes
Accepted
Setting Breakpoints at functions decoded by Hopper/IDA Pro in an iOS app
I was able to achieve this by installing gdbserver on my ipad. Then i ssh into the ipad and attach a remote lldb debugger (xcode tools) to attack breakpoints. A long method but works. There are now ...
2
votes
Find cryptography used by iOS applications by analyzing ARM assembly in IDA?
FindCrypt and IDASignsrch are both plugins used to scan the binary itself for cryptographic algorithm signatures. Non of them try to map API functions (and certainly not for iOS).
They work by ...
- 11.3k
2
votes
Decrypt iOS standard encryption without device
My answer What you can actually do is to look for "cracked IPA apps", which basically mean they are decrypted (FairPlay encryption removed). There are many sites like this one (AppAddict).
Note
I ...
2
votes
Where to start with iOS debugging?
In iOS all sandboxing and security are handled by the AppleMobileFileIntegrity Kernel Extension
As wat i know with Pod-Gizmo board you can pass the amfi_get_out_of_my_way boot-arg and with this arg ...
- 136
Only top scored, non community-wiki answers of a minimum length are eligible