IOS runtime attack-cyloud

IOS runtime attacks are currently popular in two ways:Dynamic Link Library InjectionTo modify the implementation of the API method by writing a customized dylib file and setting the DYLD_INSERT_LIBRARIES environment variable (seeMac hook-DYLD_INSERT_LIBRARIESExample); another method is to use the message mechanism features of objective-c runtime, especially objc_msgSend, to operate the application, among them, the tool that combines objective-c with javascript syntax, cyborg, is superb. Next, we will introduce an example of how to manipulate the iOS app runtime using cylinder.
 
Example 1: Counterfeit UDID (UIDevice class description)
 
Step 1: select the process to be operated

Danimato-iPod :~ Root # cyw.p 8442 (either process id or process name)

 
Step 2: Obtain the current device's UDID

cy# [[UIDevice currentDevice] uniqueIdentifier]; @"a94b65f9ac84c9d5bb7f377d5122a622ea1addf6"

 
Step 3: replace the uniqueIdentifier Implementation Method

cy# UIDevice.messages['uniqueIdentifier'] = function(){ return @"tanjiti";} function () {return Instance.box("tanjiti");}

 
Step 4: Check the replaced UDID to obtain the result

cy# [[UIDevice currentDevice] uniqueIdentifier]; @"tanjiti"

 
Example 2: Unlock the screen lock PIN ( SpringBoard/sbwaycontroller. hDescription)
 
Step 1: select the process to be operated

danimato-iPod:~ root# cycript -p SpringBoard

Step 2: Check whether the password lock function is enabled for the device (1 indicates locking, 0 indicates unlocking)

cy# [SBAwayController.sharedAwayController isPasswordProtected] 1

Step 3: replace isPasswordProtected

cy# SBAwayController.messages['isPasswordProtected']=function(){return NO;} function () {return NO;}

Step 4: Check the locked status of the replaced device (1 indicates locked, 0 indicates unlocked)

cy# [SBAwayController.sharedAwayController isPasswordProtected] 0

Step 5: Call the unlockWithSound method to access the home screen.

cy# [SBAwayController.sharedAwayController unlockWithSound:1]

The screen lock is successfully unlocked through the above operations.
 
Next, I will write about the core component MobileSubstrate in runtime attack and the very popular Theos jailbreak development framework.
 
Refer:
Http://iphonedevwiki.net/index.php/Cycript
Http://iphonedevwiki.net/index.php/Cycript_Tricks