snakeninny, hangcom Translated by Ziqi Wu, 0xBBC, tianqing and Fei Cheng iOS App Reverse Engineering Table of Contents Recommendation ..................................................................................................................................................... 1 Preface ....................................................................................................................................................................... 2 Foreword ................................................................................................................................................................... 7 Part 1 Concepts ....................................................................................................................................................... 12 Chapter 1 Introduction to iOS reverse engineering ............................................................................................. 13 1.1 Prerequisites of iOS reverse engineering .......................................................................................................... 13 1.2 What does iOS reverse engineering do ............................................................................................................ 13 1.2.1 Security related iOS reverse engineering ...................................................................................................... 16 1.2.2 Development related iOS reverse engineering ............................................................................................. 17 1.3 The process of iOS reverse engineering ............................................................................................................ 19 1.3.1 System Analysis ............................................................................................................................................ 19 1.3.2 Code Analysis ................................................................................................................................................ 20 1.4 Tools for iOS reverse engineering ..................................................................................................................... 20 1.4.1 Monitors ....................................................................................................................................................... 21 1.4.2 Disassemblers ............................................................................................................................................... 21 1.4.3 DeBuggers .................................................................................................................................................... 23 1.4.4 Development kit ........................................................................................................................................... 23 1.5 Conclusion ........................................................................................................................................................ 23 Chapter 2 Introduction to jailbroken iOS .............................................................................................................. 24 2.1 iOS System Hierarchy ........................................................................................................................................ 24 2.1.1 iOS filesystem ............................................................................................................................................... 26 2.1.2 iOS file permission ........................................................................................................................................ 32 2.2 iOS file types ..................................................................................................................................................... 33 2.2.1 Application .................................................................................................................................................... 33 2.2.2 Dynamic LiBrary ............................................................................................................................................ 37 2.2.3 Daemon ........................................................................................................................................................ 38 2.3 Conclusion ........................................................................................................................................................ 39 Part 2 Tools .............................................................................................................................................................. 40 Chapter 3 OSX toolkit ............................................................................................................................................ 41 3.1 class-dump ........................................................................................................................................................ 41 3.2 Theos ................................................................................................................................................................ 43 3.2.1 Introduction to Theos ................................................................................................................................... 43 3.2.2 Install and configure Theos ........................................................................................................................... 44 3.2.3 Use Theos ..................................................................................................................................................... 46 3.2.4 An example tweak ........................................................................................................................................ 67 3.3 Reveal ............................................................................................................................................................... 70 3.4 IDA .................................................................................................................................................................... 76 3.4.1 Introduction to IDA ....................................................................................................................................... 76 3.4.2 Use IDA ......................................................................................................................................................... 77 3.4.3 An analysis example of IDA .......................................................................................................................... 90 3.5 iFunBox ............................................................................................................................................................. 95 3.6 dyld_decache .................................................................................................................................................... 96 3.7 Conclusion ........................................................................................................................................................ 97 Chapter 4 iOS toolkit .............................................................................................................................................. 98 4.1 CydiaSubstrate .................................................................................................................................................. 98 4.1.1 MoBileHooker ............................................................................................................................................... 98 4.1.2 MoBileLoader .............................................................................................................................................. 109 4.1.3 Safe mode ................................................................................................................................................... 109 4.2 Cycript ............................................................................................................................................................. 111 4.3 LLDB and debugserver .................................................................................................................................... 115 4.3.1 Introduction to LLDB ................................................................................................................................... 115 4.3.2 Introduction to deBugserver ....................................................................................................................... 116 4.3.3 Configure deBugserver ............................................................................................................................... 116 4.3.4 Process launching and attaching using deBugserver .................................................................................. 118 4.3.5 Use LLDB ..................................................................................................................................................... 119 4.3.6 Miscellaneous LLDB .................................................................................................................................... 133 4.4 dumpdecrypted .............................................................................................................................................. 134 4.5 OpenSSH ........................................................................................................................................................