Link to this headingRuntime Hooking
Link to this headingFrida
Frida Flags:
-U: use frida over USB for use with-H 127.0.0.1: use frida to connect to a server on a port. This must be used withfrida-server -H 0.0.0.0-f: run the application and pause the application. Use com.example.application.name--no-pause: with the-fparameter but don’t pause the application-p: attach to running with process id-n Name: attach to process with name-l SCRIPT: add a JavaScript file to the application.-o Output_file: Specify log file
Launch Application through USB. Attach a script to be run on startup and log output to file:
Attach to running Application through USB. Attach a script to be run on startup and log output to file:
Link to this headingRunning frida on device
Use the update_frida.sh script
Start the frida server on all interfaces:
Connecting through WIFI and not USB:
Link to this headingFrida Helper functions
Swizzler2 - Hacking iOS applications
Tool to trace Classes
Link to this headingObjection
- Biased off Frida
Attach to a Application:
Run a single command:
Run with a script:
List Classes:
OWASP.-Swift # ios hooking list classes
List Functions in a class:
OWASP.-Swift # ios hooking list class_methods <ClassName>
Disable iOS Pinning:
OWASP.-Swift # ios sslpinning disable
Dump the application key chain:
OWASP.-Swift # ios keychain dump
Application Folders:
OWASP.-Swift # env
Name Path
----------------- -------------------------------------------------------------------------------------------
BundlePath /var/containers/Bundle/Application/3ADAF47D-A734-49FA-B274-FBCA66589E67/iGoat-Swift.
CachesDirectory /var/mobile/Containers/Data/Application/8C8E7EB0-BC9B-435B-8EF8-8F5560EB0693/Library/Caches
DocumentDirectory /var/mobile/Containers/Data/Application/8C8E7EB0-BC9B-435B-8EF8-8F5560EB0693/Documents
LibraryDirectory /var/mobile/Containers/Data/Application/8C8E7EB0-BC9B-435B-8EF8-8F5560EB0693/Library
Link to this headingTheos
Link to this headingInstalling Theos On Linux
Get Code:
Get iOS SDK:
TMP=
Get Swift:
Link to this headingCreating a Theos Project
- Run
nic.plfrom the folder you want to make the Hook in - Select the iphone/tweak option
- Choose a project name (Example. “com.example.hook”)
- Choose a Package name (Example. “com.example.hook”)
- Choose a Mobile Substrate Bundle filter. This is what application you want to hook.
- Choose the Application you want to restart. This is the application you want to hook.
Example Makefile
ARCHS=arm64
THEOS=/opt/iOS/theos
THEOS_DEVICE_IP=iphone.usb
THEOS_DEVICE_PORT=2222
Link to this headingCreating Objective C Hook
These hooks are pretty straight forward to construct. You will require the class name and function call details. “class-dump” tool can be used to retrieve such information.
Some example hooks:
%hook ANSMetadata //Name of target class
- (bool)computeIsJailbroken{ // name of the function we want to hook
NSLog(@" ## We hooked ANSMetadata - computIsJailbroken ! ## "); // this will be printed on the device console once it is called.
bool result = %orig; // we call the "original" function that we are currently hooking. The return of the given function stored in "result".
NSLog(@" ## ANSMetadata - computIsJailbroken original return value is %d ## ", result); // Print the original result.
//Example console snippet:
//default 16:19:54.889467 -0400 DuoMobileApp ## ANSMetadata - computIsJailbroken original return value is 1 ##
//Now we return 0 as we want to bypass this jailbreak detection check.
return 0;
}
%hook AFSecurityPolicy //Name of target class
+ (id)policyWithPinningMode:(uint64_t)policyID{ // function which requires 1 parameter
id result = %orig(policyID); //we call original function with original parameter.
//Print the result to device console and return the original result.
NSLog(@" ## AFSecurityPolicy - policyWithPinningMode is hit. PolicyID/Argument is %ld \nResult is %@ ## ", (long)policyID, result);
return result;
}
%end
// In this example, given function returns a NSDictionary object (id is like void *).
// Our hook gets the original output, changes the value of a parameter and returns the modified output.
%hook DUODeviceInfo
- (id)dictionaryRepresentation{
id result = %orig;
NSLog(@" ## DUODeviceInfo - dictionaryRepresentation original return value is: %@\n\n ## ", result);
/* Example console snippet:
default 16:03:51.008002 -0400 DuoMobileApp ## DUODeviceInfo - dictionaryRepresentation original return value is: {
"app_id" = "com.duosecurity.DuoMobile";
"app_version" = "3.27.0.4";
"device_name" = iPhone;
jailbroken = true; <-- our jailbreak is detected by the application.
language = en;
manufacturer = Apple;
model = "iPhone9,1";
pkpush = "rsa-sha512";
platform = iOS;
region = US;
version = "12.2";
}
*/
NSMutableDictionary *muteDict = [result mutableCopy]; //we cast it into a mutable form.
muteDict[@"jailbroken"] = @"false"; // setting the "jailbreak" flag to FALSE.
NSLog(@"## DUODeviceInfo - dictionaryRepresentation after modification: %@", muteDict);
/* Example console snippet:
default 16:03:51.008002 -0400 DuoMobileApp ## DUODeviceInfo - dictionaryRepresentation after modification: {
"app_id" = "com.duosecurity.DuoMobile";
"app_version" = "3.27.0.4";
"device_name" = iPhone;
jailbroken = false; <-- now the value is false hence server will not flag the device as jailbroken.
language = en;
manufacturer = Apple;
model = "iPhone9,1";
pkpush = "rsa-sha512";
platform = iOS;
region = US;
version = "12.2";
}
*/
return (NSDictionary *) muteDict; // returning the modified dictionary to pass server-side validation.
}
%end
Link to this headingCreating C Hook
Hooking a C function by Name:
static FILE * (*orig_fopen) ( const char * filename, const char * mode );
FILE * new_fopen ( const char * filename, const char * mode ) {
if (strcmp(filename, "/bin/bash") == 0) {
return NULL;
}
return orig_fopen(filename, mode);
}
%ctor {
//Address of Function, Replacement Function, Backup Function address
MSHookFunction((void *)fopen, (void *)new_fopen, (void **)&orig_fopen);
}
Hooking a C function by Address:
#include <mach-o/dyld.h>
#import "substrate.h"
int new_100037950(void)
{
return 0;
}
int (*orig_100037950)();
%ctor
{
@autoreleasepool
{
//Get Function Address from ASLR Offset and Function Address
unsigned long function_address = _dyld_get_image_vmaddr_slide(0) + 0x100037950;
//Replace the origination function address to the new Function
//Address of Function, Replacement Function, Backup Function address
MSHookFunction((void *)function_address, (void *)new_100037950, (void **)&orig_100037950);
}
}
Link to this headingCreating Swift Hook
Hooking Swift methods in Theos
Link to this headingPushing the Hook to the device
Build and install the package to the iphone:
Link to this headingCycrypt (Outdated)
Example:
#"<_UIBackdropViewLayer: 0x283d034c0>"
()
| ()
()