iOS app Smash Shell

Here is an introduction to using dumpdecrypted to smash shells. The principle is to use the DYLD_INSERT_LIBRARIES environment variable to load the shelled dynamic link library dumpdecrypted.dylib

1.ssh connect the jailbreak on the machine, enter the password Alpine

　　　　SSH [email protected]

2. Open the App,ps aux to smash | grep var finds its directory

yigewangde-iphone:~ root# PS aux | grep var

Mobile 1118 0.0 1.0 1139072 9684?? Ss wed10am 5:30.70/var/containers/bundle/application/bcc24500-0986-4343-a287-7baf60b33e60/wechat.app/wechat

Root 1913 0.0 0.1 537488 568 s000 s+ 9:50AM 0:00.02 grep var

Root 474 0.0 0.2 707792 1676?? Ss tue04pm 0:00.47/usr/libexec/pkd-d/var/db/pluginkit-annotations

Mobile 1902 0.0 4.8 900736 47580?? Us 9:50AM 0:03.69/var/containers/bundle/application/249a5309-8f1a-4c4a-93fd-e48eeae00c95/dingtalk.app/dingtalk

Let's take Dingtalk to the axe.

3. Use SCP to copy the Dumpdecrypted.dylib to the/usr/lib directory

SCP Dumpdecrypted.dylib [Email protected]:/usr/lib

4. Switch to Mobile User

Su Mobile

5. Switch to/var/mobile/documents this directory

Cd/var/mobile/documents

6. Start smashing shells

dyld_insert_libraries=/usr/lib/dumpdecrypted.dylib/var/containers/bundle/application/ 249a5309-8f1a-4c4a-93fd-e48eeae00c95/dingtalk.app/dingtalk

Mach-o decryption Dumper

Disclaimer:this tool is a meant for security and purposes, not for application crackers.

[+] detected 64bit ARM binary in memory.

[+] offset to cryptid found: @0x100084cf8 (from 0x100084000) = Cf8

[+] Found encrypted data at address 00004000 of length 40534016 Bytes-type 1.

[+] Opening/private/var/containers/bundle/application/249a5309-8f1a-4c4a-93fd-e48eeae00c95/dingtalk.app/dingtalk for reading.

[+] Reading Header

[+] Detecting header Type

[+] Executable is a plain mach-o image

[+] Opening dingtalk.decrypted for writing.

[+] Copying the not encrypted start of the file

[+] Dumping the decrypted data into the file

[+] Copying the not encrypted remainder of the file

[+] Setting the Lc_encryption_info->cryptid to 0 at offset Cf8

[+] Closing Original File

[+] Closing dump File

It's 7.over. You can see it under the/var/mobile/documents.

iOS app Smash Shell