iOS Frida Configuration

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Deepen your expertise in Mobile Security with 8kSec Academy. Master iOS and Android security through our self-paced courses and get certified:

On-demand Mobile Security Training | 8kSec Academy8kSec Academy

Installing Frida

Koraci za instalaciju Frida na Jailbroken uređaju:

1. Otvorite Cydia/Sileo aplikaciju.

2. Idite na Manage -> Sources -> Edit -> Add.

3. Unesite "https://build.frida.re" kao URL.

4. Idite na novo dodati Frida izvor.

5. Instalirajte Frida paket.

Ako koristite Corellium, potrebno je da preuzmete Frida verziju sa https://github.com/frida/frida/releases (frida-gadget-[yourversion]-ios-universal.dylib.gz) i raspakujete i kopirate na dylib lokaciju koju Frida traži, npr.: /Users/[youruser]/.cache/frida/gadget-ios.dylib

Nakon instalacije, možete koristiti na vašem PC-u komandu frida-ls-devices i proveriti da li se uređaj pojavljuje (vaš PC treba da može da mu pristupi). Izvršite takođe frida-ps -Uia da proverite pokrenute procese telefona.

Frida bez Jailbroken uređaja & bez patchovanja aplikacije

Proverite ovaj blog post o tome kako koristiti Frida na ne-jailbroken uređajima bez patchovanja aplikacije: https://mrbypass.medium.com/unlocking-potential-exploring-frida-objection-on-non-jailbroken-devices-without-application-ed0367a84f07

Frida Client Installation

Install frida tools:

pip install frida-tools
pip install frida

Sa instaliranim Frida serverom i uređajem koji radi i je povezan, proverite da li klijent radi:

frida-ls-devices  # List devices
frida-ps -Uia     # Get running processes

Frida Trace

# Functions
## Trace all functions with the word "log" in their name
frida-trace -U <program> -i "*log*"
frida-trace -U <program> -i "*log*" | swift demangle # Demangle names

# Objective-C
## Trace all methods of all classes
frida-trace -U <program> -m "*[* *]"

## Trace all methods with the word "authentication" from classes that start with "NE"
frida-trace -U <program> -m "*[NE* *authentication*]"

# Plug-In
## To hook a plugin that is momentarely executed prepare Frida indicating the ID of the Plugin binary
frida-trace -U -W <if-plugin-bin> -m '*[* *]'

Dobijte sve klase i metode

• Automatsko dovršavanje: Samo izvršite frida -U <program>

• Dobijte sve dostupne klase (filtrirajte po stringu)

/tmp/script.js

// frida -U <program> -l /tmp/script.js

var filterClass = "filterstring";

if (ObjC.available) {
for (var className in ObjC.classes) {
if (ObjC.classes.hasOwnProperty(className)) {
if (!filterClass || className.includes(filterClass)) {
console.log(className);
}
}
}
} else {
console.log("Objective-C runtime is not available.");
}

• Dobijte sve metode klase (filtrirajte po stringu)

/tmp/script.js

// frida -U <program> -l /tmp/script.js

var specificClass = "YourClassName";
var filterMethod = "filtermethod";

if (ObjC.available) {
if (ObjC.classes.hasOwnProperty(specificClass)) {
var methods = ObjC.classes[specificClass].$ownMethods;
for (var i = 0; i < methods.length; i++) {
if (!filterMethod || methods[i].includes(filterClass)) {
console.log(specificClass + ': ' + methods[i]);
}
}
} else {
console.log("Class not found.");
}
} else {
console.log("Objective-C runtime is not available.");
}

• Pozovite funkciju

// Find the address of the function to call
const func_addr = Module.findExportByName("<Prog Name>", "<Func Name>");
// Declare the function to call
const func = new NativeFunction(
func_addr,
"void", ["pointer", "pointer", "pointer"], {
});

var arg0 = null;

// In this case to call this function we need to intercept a call to it to copy arg0
Interceptor.attach(wg_log_addr, {
onEnter: function(args) {
arg0 = new NativePointer(args[0]);
}
});

// Wait untill a call to the func occurs
while (! arg0) {
Thread.sleep(1);
console.log("waiting for ptr");
}


var arg1 = Memory.allocUtf8String('arg1');
var txt = Memory.allocUtf8String('Some text for arg2');
wg_log(arg0, arg1, txt);

console.log("loaded");

Frida Fuzzing

Frida Stalker

Iz dokumentacije: Stalker je Fridin motor za praćenje koda. Omogućava praćenje niti, hvatajući svaku funkciju, svaki blok, čak i svaku instrukciju koja se izvršava.

Imate primer implementacije Frida Stalker na https://github.com/poxyran/misc/blob/master/frida-stalker-example.py

Ovo je još jedan primer kako da se povežete na Frida Stalker svaki put kada se pozove funkcija:

console.log("loading");
const wg_log_addr = Module.findExportByName("<Program>", "<function_name>");
const wg_log = new NativeFunction(
wg_log_addr,
"void", ["pointer", "pointer", "pointer"], {
});

Interceptor.attach(wg_log_addr, {
onEnter: function(args) {
console.log(`logging the following message: ${args[2].readCString()}`);

Stalker.follow({
events: {
// only collect coverage for newly encountered blocks
compile: true,
},
onReceive: function (events) {
const bbs = Stalker.parse(events, {
stringify: false,
annotate: false
});
console.log("Stalker trace of write_msg_to_log: \n" + bbs.flat().map(DebugSymbol.fromAddress).join('\n'));
}
});
},
onLeave: function(retval) {
Stalker.unfollow();
Stalker.flush();  // this is important to get all events
}
});

Ovo je zanimljivo za svrhe debagovanja, ali za fuzzing, konstantno .follow() i .unfollow() je veoma neefikasno.

Fpicker

fpicker je Frida-bazirani fuzzing paket koji nudi razne fuzzing režime za fuzzing unutar procesa, kao što su AFL++ režim ili pasivni režim praćenja. Trebalo bi da radi na svim platformama koje podržava Frida.

• Instalirajte fpicker & radamsa

# Get fpicker
git clone https://github.com/ttdennis/fpicker
cd fpicker

# Get Frida core devkit and prepare fpicker
wget https://github.com/frida/frida/releases/download/16.1.4/frida-core-devkit-16.1.4-[yourOS]-[yourarchitecture].tar.xz
# e.g. https://github.com/frida/frida/releases/download/16.1.4/frida-core-devkit-16.1.4-macos-arm64.tar.xz
tar -xf ./*tar.xz
cp libfrida-core.a libfrida-core-[yourOS].a #libfrida-core-macos.a

# Install fpicker
make fpicker-[yourOS] # fpicker-macos
# This generates ./fpicker

# Install radamsa (fuzzer generator)
brew install radamsa

• Pripremite FS:

# From inside fpicker clone
mkdir -p examples/wg-log # Where the fuzzing script will be
mkdir -p examples/wg-log/out # For code coverage and crashes
mkdir -p examples/wg-log/in # For starting inputs

# Create at least 1 input for the fuzzer
echo Hello World > examples/wg-log/in/0

• Fuzzer skripta (examples/wg-log/myfuzzer.js):

examples/wg-log/myfuzzer.js

// Import the fuzzer base class
import { Fuzzer } from "../../harness/fuzzer.js";

class WGLogFuzzer extends Fuzzer {

constructor() {
console.log("WGLogFuzzer constructor called")

// Get and declare the function we are going to fuzz
var wg_log_addr = Module.findExportByName("<Program name>", "<func name to fuzz>");
var wg_log_func = new NativeFunction(
wg_log_addr,
"void", ["pointer", "pointer", "pointer"], {
});

// Initialize the object
super("<Program nane>", wg_log_addr, wg_log_func);
this.wg_log_addr = wg_log_addr; // We cannot use "this" before calling "super"

console.log("WGLogFuzzer in the middle");

// Prepare the second argument to pass to the fuzz function
this.tag = Memory.allocUtf8String("arg2");

// Get the first argument we need to pass from a call to the functino we want to fuzz
var wg_log_global_ptr = null;
console.log(this.wg_log_addr);
Interceptor.attach(this.wg_log_addr, {
onEnter: function(args) {
console.log("Entering in the function to get the first argument");
wg_log_global_ptr = new NativePointer(args[0]);
}
});

while (! wg_log_global_ptr) {
Thread.sleep(1)
}
this.wg_log_global_ptr = wg_log_global_ptr;
console.log("WGLogFuzzer prepare ended")
}


// This function is called by the fuzzer with the first argument being a pointer into memory
// where the payload is stored and the second the length of the input.
fuzz(payload, len) {
// Get a pointer to payload being a valid C string (with a null byte at the end)
var payload_cstring = payload.readCString(len);
this.payload = Memory.allocUtf8String(payload_cstring);

// Debug and fuzz
this.debug_log(this.payload, len);
// Pass the 2 first arguments we know the function needs and finally the payload to fuzz
this.target_function(this.wg_log_global_ptr, this.tag, this.payload);
}
}

const f = new WGLogFuzzer();
rpc.exports.fuzzer = f;

• Kompajlirajte fuzzer:

# From inside fpicker clone
## Compile from "myfuzzer.js" to "harness.js"
frida-compile examples/wg-log/myfuzzer.js -o harness.js

• Pozovite fuzzer fpicker koristeći radamsa:

# Indicate fpicker to fuzz a program with the harness.js script and which folders to use
fpicker -v --fuzzer-mode active -e attach -p <Program to fuzz> -D usb -o examples/wg-log/out/ -i examples/wg-log/in/ -f harness.js --standalone-mutator cmd --mutator-command "radamsa"
# You can find code coverage and crashes in examples/wg-log/out/

U ovom slučaju ne ponovo pokrećemo aplikaciju ili obnavljamo stanje nakon svake payload. Dakle, ako Frida pronađe srušavanje, sledeći unosi nakon te payload mogu takođe srušiti aplikaciju (jer je aplikacija u nestabilnom stanju) čak i ako unos ne bi trebao da sruši aplikaciju.

Štaviše, Frida će se povezati na signale izuzetaka iOS-a, tako da kada Frida pronađe srušavanje, verovatno izveštaji o srušavanju iOS-a neće biti generisani.

Da bismo to sprečili, na primer, mogli bismo ponovo pokrenuti aplikaciju nakon svakog Frida srušavanja.

Logs & Crashes

Možete proveriti macOS konzolu ili log cli da biste proverili macOS logove. Takođe možete proveriti logove sa iOS-a koristeći idevicesyslog. Neki logovi će izostaviti informacije dodajući <private>. Da biste prikazali sve informacije, potrebno je da instalirate neki profil sa https://developer.apple.com/bug-reporting/profiles-and-logs/ da biste omogućili te privatne informacije.

Ako ne znate šta da radite:

vim /Library/Preferences/Logging/com.apple.system.logging.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Enable-Private-Data</key>
<true/>
</dict>
</plist>

killall -9 logd

Možete proveriti padove u:

• iOS

• Podešavanja → Privatnost → Analitika i poboljšanja → Podaci o analitici

• /private/var/mobile/Library/Logs/CrashReporter/

• macOS:

• /Library/Logs/DiagnosticReports/

• ~/Library/Logs/DiagnosticReports

iOS čuva samo 25 padova iste aplikacije, tako da to morate očistiti ili će iOS prestati da kreira padove.

Frida Android Tutorijali

Frida Tutorial

Reference

• https://www.briskinfosec.com/blogs/blogsdetail/Getting-Started-with-Frida

Produbite svoje znanje u Mobilnoj bezbednosti sa 8kSec Akademijom. Savladajte iOS i Android bezbednost kroz naše kurseve samostalnog učenja i dobijte sertifikat:

On-demand Mobile Security Training | 8kSec Academy8kSec Academy

Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Podrška HackTricks

• Proverite planove pretplate!

• Pridružite se 💬 Discord grupi ili telegram grupi ili pratite nas na Twitteru 🐦 @hacktricks_live.

• Podelite hakerske trikove slanjem PR-ova na HackTricks i HackTricks Cloud github repozitorijume.