writing

iOS App Reverse Engineering Resource CollectioniOS 应用逆向工程资料整理

2018-01-15 · Debugging & reverse engineering

Translated from Chinese — .

On this page

Environment
- Hardware
- Jailbreak
- Tools
  - frida
  - cycript
  - chisel (lldb script)
  - MonkeyDev
  - passionfruit
  - objection
  - theos
  - HookZz
  - AppleTrace
  - dump
  - dump class
    - class-dump/class-dump-z/classdump-dyld
    - swift class dump
  - Hikari
  - Reveal
  - IDA
  - Hopper
  - Flex
  - Others
Books
Resources
PWN
Forums

It’s been a long time since I last reverse-engineered an app. Recently I had a need to see how other apps are implemented, so I wanted to review. Also, over these two years a number of commonly-used tools have changed, and some new tools have appeared. This article summarizes the basic methods, tools, and some books for app reverse engineering. I’ll try to update this article whenever I make new discoveries.

Environment

Hardware

An iPhone or iPad running iOS
A MacBook or similar running macOS

Jailbreak

Whether a phone can be jailbroken can be determined via this website: https://canijailbreak.com/ The jailbreak software also has download links.

Tools

frida

Official site https://www.frida.re/

Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts.

cycript

http://www.cycript.org/

Cycript allows developers to explore and modify running applications on either iOS or Mac OS X using a hybrid of Objective-C++ and JavaScript syntax through an interactive console that features syntax highlighting and tab completion.

chisel (lldb script)

https://github.com/facebook/chisel

Chisel is a collection of LLDB commands to assist debugging iOS apps.

The most commonly used commands are pview and pvc. All supported commands can be found in the Wiki: https://github.com/facebook/chisel/wiki .

MonkeyDev

https://github.com/AloneMonkey/MonkeyDev

An upgrade of the original iOSOpenDev — a god-tier toolkit for non-jailbreak tweak development!

You can use Xcode to develop CaptainHook Tweak, Logos Tweak, and Command-line Tool, developing tweaks on jailbroken devices. This is the migration and improvement of the original iOSOpenDev features.

Just drag in a decrypted app, and it automatically integrates class-dump, restore-symbol, Reveal, Cycript and the injected dynamic library, then re-signs and installs it onto a non-jailbroken device.

Supports debugging your own dynamic libraries and third-party apps.

Supports integrating SDKs and non-jailbreak tweaks into third-party apps via CocoaPods — in short, it builds a non-jailbreak tweak store via CocoaPods.

A fresh new force, born in 2017. Already an essential tool for analyzing closed-source apps.

passionfruit

https://github.com/chaitin/passionfruit

Built on frida, essential for reversing — you can easily see all kinds of information about third-party apps.

Cross plarform web GUI!
Also supports non-jailbroken device (see Non-jailbroken device).
List all url schemes.
Check signature entitlements.
List human readable app meta info (Info.plist).
Capture screenshot.
Checksec: see if target app is encrypted, and has enabled PIE, ARC and stack canary.
App sandbox file browser. Directly preview images, SQLite databases and plist files on device. You can always download the file for further investigation.
and more

objection

https://github.com/sensepost/objection

A toolkit built on frida.

objection is a runtime mobile exploration toolkit, powered by Frida. It was built with the aim of helping assess mobile applications and their security posture without the need for a jailbroken or rooted mobile device.

theos

https://github.com/theos/theos

Provides all kinds of templates and tools for reverse engineering development.

A cross-platform suite of tools for building and deploying software for iOS and other platforms.

HookZz

https://github.com/jmpews/HookZz

a hook framework for arm/arm64/ios/android

AppleTrace

https://github.com/everettjf/AppleTrace

Objective C message tracing tool for iOS/macOS based on HookZz

dump

frida-ios-dump

https://github.com/AloneMonkey/frida-ios-dump

Lets you dump apps very conveniently. Can replace Clutch.

pull decrypted ipa from jailbreak device

Clutch

https://github.com/KJCracks/Clutch

Fast iOS executable dumper

dumpdecrypted

https://github.com/AloneMonkey/dumpdecrypted

Adds the ability to dump dynamic libraries on top of the original.

Dumps decrypted mach-o files from encrypted applications、framework or app extensions.

dump class

Generate Objective-C headers from Mach-O files.

class-dump/class-dump-z/classdump-dyld

swift class dump

Hikari

https://github.com/HikariObfuscator/Hikari

Reveal

https://revealapp.com/

IDA

The killer tool.

Hopper

Lightweight decompiler.

Flex

https://github.com/Flipboard/FLEX

Others

strings, nm, weak_classdump

http://iphonedevwiki.net/index.php/Reverse_Engineering_Tools

Books

iOS Application Reverse Engineering

Chinese: http://item.jd.com/11670145.html English: https://github.com/iosre/iOSAppReverseEngineering

Hacking iOS Applications

http://iosre.com/t/hacking-ios-applications/8014

security.ios-wiki.com

https://wizardforcel.gitbooks.io/ios-sec-wiki/

Advanced Apple Debugging & Reverse Engineering

https://store.raywenderlich.com/products/advanced-apple-debugging-and-reverse-engineering

Reverse Engineering for Beginners

https://beginners.re/ Chinese https://item.jd.com/12166962.html

Beginner’s Guide to Exploitation on ARM

http://zygosec.com/Products/

*OSInternals

Volume I - User Mode
Volume III - Security & Insecurity

Supposedly Volume II comes out this fall (2018).

http://newosxbook.com/

Resources

Anti-debugging Resources, Hook Detection

AttackingBYODEnterpriseMobileSecuritySolutions

OWASP Mobile Security Testing Guide

https://www.gitbook.com/book/b-mueller/the-owasp-mobile-security-testing-guide

iOS Security Wiki

https://legacy.gitbook.com/book/wizardforcel/ios-sec-wiki/details http://security.ios-wiki.com

Others

http://iphonedevwiki.net/ http://www.cydiasubstrate.com/ https://www.theiphonewiki.com/

https://github.com/michalmalik/osx-re-101 https://github.com/kpwn/iOSRE https://github.com/pandazheng/IosHackStudy

http://www.droidsec.cn/category/ios%e5%ae%89%e5%85%a8%e6%94%bb%e9%98%b2/

https://github.com/nygard https://github.com/saurik

PWN

Security Beginner Articles

https://www.fuzzysecurity.com/tutorials.html

Getting Started with pwn

http://pwnable.kr/

IoT Security AzeriaLabs

https://azeria-labs.com/writing-arm-shellcode/

ARM Assembly, Advanced iOS Debugging

https://zhuanlan.zhihu.com/c_142064221

Forums

http://iosre.com

文章目录

环境
- 硬件
- 越狱
- 工具
  - frida
  - cycript
  - chisel (lldb script)
  - MonkeyDev
  - passionfruit
  - objection
  - theos
  - HookZz
  - AppleTrace
  - dump
  - dump class
    - class-dump/class-dump-z/classdump-dyld
    - swift class dump
  - Hikari
  - Reveal
  - IDA
  - Hopper
  - Flex
  - 其他
书籍
资料
PWN
论坛

又是很久不逆向App了，近期有点需求需要看看其他App怎么实现的，想来复习一下。以及这两年也有若干常用工具发生了变化，产生了一些新的工具。这篇文章总结下基础的App逆向的方法、工具和一些书籍。以后有新的发现也会尽量更新到这篇文章。

环境

硬件

iOS系统的iPhone或iPad
macOS系统的MacBook等

越狱

手机是否可以越狱可通过这个网站来确定： https://canijailbreak.com/ 越狱用的软件也有链接可下载。

工具