IOS Reverse engineering smashed shell

<span id="Label3"></p>In the 4.6.2 section of the iOS application reverse engineering, we recommended using the Appcrackr version 1.7 of the iphonecake source to shell the app. This way simple rough, save time and effort, but it is because it is too convenient to have wood, resulting in almost all idevice users can easily get started, casual profane play, So many users take it to crack the program, instead of learning "ios application reverse engineering", can be said to be aunt can not tolerate uncle! This also led to the iOS jailbreak development community generally believe that this software to promote the arrogance of piracy, not out of the vulgar, the Iphonecake source has been strongly condemned, ordered its deadline Rectification. Under pressure, Iphonecake in the previous period of time will appcrackr, and the book mentioned in Xsellize source Appcrackr is 1.5 old version, can not be used in the advanced System. therefore, in order to respond to the Industry's anti-piracy calls, advocate Chairman Mao "self-clothed" Revolutionary spirit, Let "smashed the shell" this thing to restore pure research purposes, Here we will use more biased geek some of the dumpdecrypted way to the app shell, no longer recommend appcrackr, clutch, Crackulous and other pure UI Way. As dumpdecrypted just experienced a major upgrade, the current online can find the use of the tutorial has expired, so here we hand take everyone to carry out a complete "smashing shell + class-dump", Please prepare the bench melon seeds soda, began to Onlookers. If you can be on the computer, watching while doing, good great yan! Lou Pig caishuxueqian, If there is a mistake, please treatise, listen, foul-mouthed, silence, Thank you for your support!<span style="font-size: 18px;"><span style="font-size: 18px;"><strong>first, Set</strong></span></span>1. Download dumpdecrypted source code is "https://github.com/stefanesser/dumpdecrypted/archive/master.zip", After downloading, unzip it to the place you are accustomed to. the pig here put it in THE/USERS/WWC (name of its own Computer)/desktop/code directory under 2. Confirm your idevice system version settings, general--about this machine 3. Modifying the SDK fields in makefile dumpdecrypted must be compiled with the same SDK version as the iOS version to work correctly. Open Terminal (Terminal), Enter<p><p>XCRUN–SDK iphoneos–show-sdk-path, look at the output to see what version of the current default SDK is, such as the building of the pig is "/applications/xcode.app/contents/developer/ PLATFORMS/IPHONEOS.PLATFORM/DEVELOPER/SDKS/IPHONEOS6.1.SDK ". There are 2 kinds of situations:</p></p>I. If you are using an iOS version that matches the SDK version of the output above (for example, It is iOS 6.1.5), you do not need to make any changes to the files in the dumpdecrypted project; If you are using an iOS version that does not match the Output SDK version above, you will need to change the makefile (friendly tip: Open with a text Editor) sdk= ' xcrun–sdk iphoneos–show-sdk-path ' is the same SDK version as the iOS Version. what, you only have one sdk? Go to https://developer.apple.com/downloads/index.action to download the old version of xcode, and then extract the SDK Inside. what, not to extract? Go to Google yourself and punish you for sleeping tonight! After extracting the old version of the sdk, Lou Pig used to put them in the same directory as the new sdk, and then changed sdk= ' Xcrun–sdk iphoneos–show-sdk-path ' to sdk=/applications/xcode.app/ Contents/developer/platforms/iphoneos.platform/developer/sdks/iphoneos6.x.sdk<p><p>Or</p></p><p><p>Sdk=/applications/xcode.app/contents/developer/platforms/iphoneos.platform/developer/sdks/iphoneos5.x.sdk</p></p><p><p>that the iOS version needs to be the same as the SDK Version. Note that the Version 5.1 SDK compiled dylib is backwards compatible and can be used in the ios5.0,6.1 Sdk. (note: this remains to be verified, the building pig has not yet done So)</p></p>4. Modify the Gcc_universal field in makefile and DUMPDECRYPTED.C if your ios/sdk version is 7.0, goto "continue here:". If it is not 7.0, you need to modify the Gcc_universal field and DUMPDECRYPTED.C in Makefile. The Makefile in the<p><p>gcc_universal=$ (gcc_base)-arch armv7-arch Armv7s-arch arm64</p></p><p><p>Switch</p></p><p><p>gcc_universal=$ (gcc_base)-arch Armv7-arch armv7s</p></p><p><p>And then dumpdecrypted.c the 76th Line.</p></p><p><p>If (lc->cmd ==lc_encryption_info | | lc->cmd = = LC_ENCRYPTION_INFO_64)</p></p><p><p>Change into</p></p><p><p>if (lc->cmd = = Lc_encryption_info)</p></p><p><p>Save. Continue here: then direct CD to "/users/wwc/desktop/code/dumpdecrypted-master/", then enter "make" and return, generate "/users/wwc/desktop/code/ Dumpdecrypted-master/dumpdecrypted.dylib ".</p></p>5. Too much trouble? Direct download Building Pig compiled file https://github.com/iosre/Ready2Rock/blob/master/dumpdecrypted_5.dylibhttps://github.com/iosre/ ready2rock/blob/master/dumpdecrypted_6.dylibhttps://github.com/iosre/ready2rock/blob/master/dumpdecrypted_7. Dylib<strong style="font-size: 2em; font-style: italic; line-height: 1.5;"><strong style="font-size: 2em; font-style: italic; line-height: 1.5;"><span style="font-size: 18px;">second, hit the shell</span></strong></strong><span style="font-size: 14px;"><span style="font-size: 14px;">1. Put the "hammer" into the device</span></span><p><p>View the IP address of your iOS device, and then use the SCP command on your Mac to place the Dumpdecrypted.dylib file on your iOS device:</p></p><p class="alt"><p class="alt">$ SCP dumpdecrypted.dylib [email protected]:/var/tmp</p></p><p><p>[email protected] ' s password:</p></p><p class="alt"><p class="alt">Dumpdecrypted.dylib 100% 81KB 81.0kb/s 00:00</p></p><p><p><strong><span style="font-size: 14px; line-height: 1.5;">2. Smash</span></strong></p></p><p><p>Choose an app that makes you feel very uncomfortable or very interested, and I choose a QQ randomly. Open Ifunbox on your iOS device and find the path to its executable file:/var/mobile/applications/xxxxxxxx/qq.app/qq</p></p><p><p>Then use SSH to connect to the iOS device, CD to the path of the Just-in-motion Library:/var/tmp.</p></p><p><p>$ ssh [email protected]</p></p><p><p>[email protected] ' s password:</p></p><p class="alt"><p class="alt">root# cd/var/tmp/</p></p><p><p>root# ls</p></p><p class="alt"><p class="alt">Flipswitchcache/com.apple.audio.hogmode.plist</p></p><p><p>l65ancd.sock= com.apple.tccd/</p></p><p class="alt"><p class="alt">l65d.sock= com.apple.timed.plist</p></p><p><p>Mediacache/cydia.log</p></p><p class="alt"><p class="alt">restorefrombackuplock* dumpdecrypted.dylib*</p></p><p><p>Springboard_reboot_flag launchd/</p></p><p class="alt"><p class="alt">Com.apple.assistant.bundleservicecache.plist Mobile_assertion_agent.log</p></p><br><p><p>Smashed the shell (waiting):</p></p> <ol start="1"> <li class="alt"><li class="alt">root# DYLD_INSERT_LIBRARIES=DUMPDECRYPTED.DYLIB/VAR/MOBILE/APPLICATIONS/XXXXXXXX/QQ.APP/QQ</li></li> <li><li>Mach-o decryption Dumper</li></li> <li class="alt"><li class="alt"></li></li> <li><li>Disclaimer:this tool is a meant for security and purposes, not for application Crackers.</li></li> <li class="alt"><li class="alt"></li></li> <li><li>[+] detected 32bit ARM binary in Memory.</li></li> <li class="alt"><li class="alt">[+] offset to cryptid found: @0xd5a90 (from 0xd5000) = A90</li></li> <li><li>[+] Found encrypted data at address 00004000 of length 3047424 Bytes-type 1.</li></li> <li class="alt"><li class="alt">[+] OPENING/PRIVATE/VAR/MOBILE/APPLICATIONS/EBBD26E9-DDBA-481E-9403-84D159436889/QQ.APP/QQ for Reading.</li></li> <li><li>[+] Reading Header</li></li> <li class="alt"><li class="alt">[+] Detecting header Type</li></li> <li><li>[+] Executable is a FAT image-searching for right architecture</li></li> <li class="alt"><li class="alt">[+] Correct Arch is at offset 16384 in the file</li></li> <li><li>[+] Opening qq.decrypted for Writing.</li></li> <li class="alt"><li class="alt">[+] Copying the not encrypted start of the file</li></li> <li><li>[+] Dumping the decrypted data into the file</li></li> <li class="alt"><li class="alt">[+] Copying the not encrypted remainder of the file</li></li> <li><li>[+] Setting the Lc_encryption_info->cryptid to 0 at offset 4a90</li></li> <li class="alt"><li class="alt">[+] Closing Original File</li></li> <li><li>[+] Closing dump File</li></li> </ol><br>Results:<p class="alt"><p class="alt">root# ls</p></p><p><p>Flipswitchcache/com.apple.audio.hogmode.plist</p></p><p class="alt"><p class="alt">Qq.decrypted com.apple.tccd/</p></p><p><p>l65ancd.sock= com.apple.timed.plist</p></p><p class="alt"><p class="alt">l65d.sock= Cydia.log</p></p><p><p>mediacache/dumpdecrypted.dylib*</p></p><p class="alt"><p class="alt">restorefrombackuplock* launchd/</p></p><p><p>Springboard_reboot_flag Mobile_assertion_agent.log</p></p><p class="alt"><p class="alt">Com.apple.assistant.bundleservicecache.plist</p></p>The qq.decrypted is the target product///////////////////////note://///////////////////////////this section of the building pigs have not been verified, the heart of the small partners can verify, and then feedback to the building pig, The House pig thanked again First.<strong><strong>Class-dump</strong></strong>In the new 21st century, the App's executable file is generally fat binary, that is, a binary file contains an executable file that is suitable for multiple CPU architectures, Although the CPU architecture is backwards compatible (that is, armv64 can execute armv7s instructions, but not the other way), But backwards compatibility generally leads to some performance sacrifices. So if a binary contains both the executable file for the ARMV7 schema and the armv7s, It also contains arm64, which means it can be used on iphone 4 (armv7), 4s (armv7), 5 (armv7s), 100% performance on 5s (arm64). Although other constellation users other than Virgo are generally not aware of this performance improvement ~ however, The machine is more Virgo than virgo, it executes a fat binary, will choose the most suitable for their own CPU of the executable file, the other executables are not actually executed. So Dumpdecrypted.dylib works only with the executable that actually gets executed, for example, if victim contains 2 architectures of ARMV7 and armv7s, and our machine is a iphone5/ 4, then dumpdecrypted smashed is armv7s/armv7 that part of the shell, armv7/armv7s part is still Shell. naturally, the Class-dump object must be the binary that smashed the shell, so we want to specify the target when class-dump, in this case, class-dump–arch armv7s victim.decrypted<p><p>Or</p></p><p><p>Class-dump–arch armv7 victim.decrypted</p></p><p><p>note://///////////////////////////</p></p><p><p></p></p><p><p>Lou Pig directly executed the class-dump command extracted the header file, the command is as Follows:</p></p><p><p>Class-dump-h qq.decrypted-o/users/wwc/desktop/code/headers</p></p><p><p>Wait for the command to finish, look at the directory, and the things you want are Inside.</p></p><p><p></p></p><p><p>This is the building pig learn from the experience of the parties, coupled with their own hands-on conclusions, there may be some local flaws, I hope that the small partners actively correct ME. My little brother is here humbly.</p></p><p><p>IOS Reverse engineering smashed shell</p></p></span>