APP extension's Shelling method

APP extension's Shelling method

Apps and apps downloaded from the App Store are extension and can be viewed through Otool:

$ otool -l binary_name | grep cryptcryptoff  16384cryptsize 294912cryptid   1

The decryption method of IPhone applications

Dumpdecrypted is an excellent app shell open Source tool that works by running the application (the iOS system decrypts the program before it starts), and then dumps the decrypted results in memory to the file to get a new executable.

What's special about IPhone app extensions

• App extension is a standalone process, but cannot be run independently
• In the process of app extension, write permission is tightly controlled

Based on the above two points, dumpdecrypted can not achieve the iphone app extensions shelling.

The decryption method of IPhone app extensions

By modifying the dumpdecrypted slightly, changing its path to the dump result, the workaround can be implemented to decrypt the app extension, see: Carina's dumpdecrypted

The use of the method is very simple, using the share extension as an example

1, local compilation good Dumpdecrypted.dylib
2. Extension Bundle with specified function

{Filter = {Bundles = ("com.tencent.xin.sharetimeline");};}

3, dumpdecrypted.plist dumpdecrypted.dylib Copy to the bottom of the jailbreak machine /Library/MobileSubstrate/DynamicLibraries/
4, using the system album to start the share Extension

When the share extension is started, the decryption plugin automatically works. It is worth noting that if your jailbreak is a armv7 architecture, then only dump armv7 that part, if the jailbreak is arm64 architecture, then only dump arm64 that part. So, finally you need to:

$ lipo -thin armv7 xxx.decrypted -output xxx_armv7.decrypted$ lipo -thin armv64 xxx.decrypted -output xxx_arm64.decrypted

To get a clean dump result.

APP extension's Shelling method