android ios 逆向工程,iOS 逆向工程

1 MAC工具

1.1 class dump 利用OC runtime 特性 把Mach-O文件中的@interface 和@protocol 提取出来并生成对应的.h文件。 安装方法 见

class-dump -H /Applications/Calculator.app -o ~/Desktop/dump/Calculate-dump

/Applications/Calculator.app 是 Mac 上计算器应用的路径。

~/Desktop/dump/Calculate-dump 是指定的存放 dump 出来头文件的文件夹路径。

缺点 只能作用于未经过加密的文件 通常appstore 下载的ipa都经过加密 怎么办呢？ 也就是下个工具 砸壳工具 AppCrackr

1.2 AppCrackr

1.3 Theos

johndeMacBook:Desktop john$ nic.pl

NIC 2.0 - New Instance Creator

[1.] iphone/activator_event

[2.] iphone/application_modern

[3.] iphone/cydget

[4.] iphone/flipswitch_switch

[5.] iphone/framework

[6.] iphone/ios7_notification_center_widget

[7.] iphone/library

[8.] iphone/notification_center_widget

[9.] iphone/preference_bundle_modern

[10.] iphone/tool

[11.] iphone/tweak

[12.] iphone/xpc_service

Choose a Template (required): 11

Project Name (required): rck

Package Name [com.yourcompany.rck]: com.horck.rck

Author/Maintainer Name [john]: rck

[iphone/tweak] MobileSubstrate Bundle filter [com.apple.springboard]: com.horck.ck

[iphone/tweak] List of applications to terminate upon installation (space-separated, '-' for none) [SpringBoard]: horck

Instantiating iphone/tweak in rck/...

Done.

在桌面生成文件

屏幕快照 2017-06-14 下午3.57.06.png

control文件记录deb包管理系统所需基本信息，会被打进包中

屏幕快照 2017-06-14 下午3.57.14.png

具体字段信息可以参考debian官网 http://www.debian.org/doc/debian-policy/ch-controlfields.html

reveal 查看app结构

砸壳工具

屏幕快照 2017-06-19 下午1.44.00.png

1 寻找app包的地址

/var/mobile/Containers/Bundle/Application/用于存放StoreApp的应用

/var/mobile/Containers/Data/Application/用于存放StoreApp的应用数据

1.1 链接终端越狱手机 " ssh root@ " 密码为 alpine

1.2 手机杀死所有没必要的app 只留下需要砸壳的app 终端输入 "ps -e" 获取手机中所有进程 ( 如果提示 ps指令不存在 那就需要到 cydia 当中安装 adv-cmds 包。)

yanshude-iPhone:~ root# ps -e

PID TTY TIME CMD

1 ?? 1:30.63 /sbin/launchd

194 ?? 1:17.02 /usr/sbin/syslogd

/System/Library/Frameworks/Accounts.framework/accountsd

220 ?? 0:04.04 /System/Library/PrivateFrameworks/TCC.framework/tccd

230 ?? 0:06.79 /System/Library/PrivateFrameworks/IMCore.framework/imagent.app/imagent

233 ?? 0:40.82 /usr/libexec/configd

242 ?? 0:34.91 /usr/libexec/securityd

244 ?? 0:00.80 /usr/sbin/distnoted daemon

248 ?? 0:20.48 /usr/libexec/networkd

/Applications/Contacts.app/PlugIns/ContactsCoreSpotlightExtension.appex/ContactsCoreSpotlightExtension

1485 ?? 0:51.65 /var/containers/Bundle/Application/EF3744E4-0EC2-47BE-BF2B-2422CFF1D69A/Taobao4iPhone.app/Taobao4iPhone

3511 ?? 0:00.07 /System/Library/Frameworks/UIKit.framework/Support/pasteboardd

出来很多条目可以用“/var/containers/Bundle/Application/” 搜索定位 (作者在做的时候出现个问题就是“/var/containers/Bundle/Application/EF3744E4-0EC2-47BE-BF2B-2422CFF1D69A/Taobao4iPhone.app/Taobao4iPhone” 只出现了一半 类似这样 "/var/containers/Bundle/Application/EF3744E4-0EC2-47BE" 解决办法就是把终端显示框拉宽点。。 没出现的请绕路)

1.3 使用 Cycript 找到目标应用的 Documents 目录路径。

需要越狱手机在 cydia 上搜索 cycript 并安装就可以了。

yanshude-iPhone:~ root# cycript -p Taobao4iPhone

cy# NSHomeDirectory()

@"/var/mobile/Containers/Data/Application/AA7CA85F-CDDD-4BC2-995D-97A3A9FAC250"

退出 Cycript 按control + d

1.4 把 dumpdecrypted.dylib 文件添加到目标app的Documents 文件夹下 作者这里是用的 cyberduck 连接的手机(工具有很多种 个人比较喜欢可视化😀)

SSH连接手机

点击转到 把上面app路径复制出来

然后把dumpdecrypted.dylib 拖拽到Documents文件夹下

Documents目录

1.5 终端操作 cd “/var/mobile/Containers/Data/Application/AA7CA85F-CDDD-4BC2-995D-97A3A9FAC250/Documents” 想要查看app的路径下 执行砸壳操作

执行命令

yanshude-iPhone:/var/mobile/Containers/Data/Application/AA7CA85F-CDDD-4BC2-995D-97A3A9FAC250/Documents root# /var/containers/Bundle/Application/EF3744E4-0EC2-47BE-BF2B-2422CFF1D69A/Taobao4iPhone.app/Taobao4iPhone

Killed: 9

yanshude-iPhone:/var/mobile/Containers/Data/Application/AA7CA85F-CDDD-4BC2-995D-97A3A9FAC250/Documents root# su mobile

yanshude-iPhone:~/Containers/Data/Application/AA7CA85F-CDDD-4BC2-995D-97A3A9FAC250/Documents mobile$ DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/containers/Bundle/Application/EF3744E4-0EC2-47BE-BF2B-2422CFF1D69A/Taobao4iPhone.app/Taobao4iPhone

mach-o decryption dumper

DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.

[+] detected 64bit ARM binary in memory.

[+] offset to cryptid found: @0x1000d0f20(from 0x1000d0000) = f20

[+] Found encrypted data at address 00004000 of length 58884096 bytes - type 1.

[+] Opening /private/var/containers/Bundle/Application/EF3744E4-0EC2-47BE-BF2B-2422CFF1D69A/Taobao4iPhone.app/Taobao4iPhone for reading.

[+] Reading header

[+] Detecting header type

[+] Executable is a plain MACH-O image

[+] Opening Taobao4iPhone.decrypted for writing.

[+] Copying the not encrypted start of the file

[+] Dumping the decrypted data into the file

[+] Copying the not encrypted remainder of the file

[+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset f20

[+] Closing original file

[+] Closing dump file

yanshude-iPhone:~/Containers/Data/Application/AA7CA85F-CDDD-4BC2-995D-97A3A9FAC250/Documents mobile$

PS :作者出现过问题 " Killed：9 " 执行 " su mobile" 再次执行上图第一条命令

结果文件出现