Upgrade to Pro — share decks privately, control downloads, hide ads and more …

A first step into other people's apps

A first step into other people's apps

Mostly setup and then a little bit of practical example of inspecting and changing third party apps at runtime.

Daniel Haight

May 22, 2014
Tweet

More Decks by Daniel Haight

Other Decks in Technology

Transcript

  1. vim

  2. entitlements.plist <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

    <dict> <key>com.apple.springboard.debugapplications</key> <true/> <key>get-task-allow</key> <true/> <key>task_for_pid-allow</key> <true/> <key>run-unsigned-code</key> <true/> </dict> </plist>
  3. Setup summary 1. Jailbreak device 2. Install openSSH on the

    device 3. extract debugserver from xcode 4. sign debugserver to allow it to attach to any process 5. copy over debugserver to device
  4. Setup summary 1. Jailbreak device 2. Install openSSH on the

    device 3. extract debugserver from xcode 4. sign debugserver to allow it to attach to any process 5. copy over debugserver to device 6. ??? 7. ??? 8. PROFIT
  5. ps -ax | grep .app 26 ?? 9:45.26 /System/Library/CoreServices/SpringBoard.app/SpringBoard 40

    ?? 0:45.37 /System/Library/PrivateFrameworks/IDSCore.framework/identityservicesd.app/identityservicesd 41 ?? 0:36.34 /System/Library/PrivateFrameworks/IMCore.framework/imagent.app/imagent 219 ?? 0:00.53 /System/Library/PrivateFrameworks/CloudServices.framework/Support/EscrowSecurityAlert.app/EscrowSecurityAlert 248 ?? 0:11.39 /Applications/MobileMail.app/MobileMail 405 ?? 0:57.57 /Applications/MobileSMS.app/MobileSMS 1267 ?? 0:15.45 /Applications/AppStore.app/AppStore 1277 ?? 4:53.17 com.apple.imdpersistence.IMDPersistenceAgent 1354 ?? 0:00.19 /System/Library/PrivateFrameworks/CommunicationsFilter.framework/CMFSyncAgent.app/CMFSyncAgent 1496 ?? 0:05.21 com.apple.StreamingUnzipService 1535 ?? 0:02.09 /var/mobile/Applications/ECFB614C-F996-47A9-A32F-96303DA0C49C/UppTalk.app/UppTalk 1542 ?? 0:00.10 /usr/libexec/afcd --xpc --service-name com.apple.crashreportcopymobile -d /private/var/mobile/Library/Logs/CrashReporter 1575 ?? 0:07.00 /Applications/Preferences.app/Preferences 1582 ?? 0:00.54 com.apple.facebook.xpc 1600 ?? 0:20.77 /var/mobile/Applications/C31CF7B6-9B92-4158-9DAD-F1F1897D0B61/Citymapper.app/Citymapper 1605 ?? 0:22.20 /var/mobile/Applications/C019C106-5764-4385-8E48-19DB12A50490/Tweetbot.app/Tweetbot 1632 ?? 0:08.88 /var/mobile/Applications/5F09A19A-469B-4F31-8DB2-9DCE92530940/Paper.app/Paper
  6. debugserver-300.2 for armv7. Attaching to process paper... Spawning general listening

    thread. Spawning kqueue listening thread. Listening to port 1234 for a connection from *...
  7. (lldb) po [[[UIApplication sharedApplication] delegate] window] <UIWindow: 0x146d15a0; frame =

    (0 0; 320 568); autoresize = W+H; gestureRecognizers = <NSArray: 0x146d1bf0>; layer = <UIWindowLayer: 0x146d1680>>
  8. { findContainer = "<UIView: 0x16ed9ca0; frame = (40 248; 241

    90); autoresize = RM+BM; layer = <CALayer: 0x16ed9d00>>"; findContainerFrame = "NSRect: {{0, 0}, {0, 0}}"; findTadeawaysBttn = "<CSDPlainColorButton: 0x16ed5250; baseClass = UIButton; frame = (1 50; 240 40); opaque = NO; autoresize = RM+TM+BM; layer = <CALayer: 0x16ed0660>>"; joinBttn = "<UIButton: 0x16ed6480; frame = (40 438; 118 30); clipsToBounds = YES; opaque = NO; autoresize = RM+TM+BM; layer = <CALayer: 0x16ed4660>>"; locationBttn = "<UIButton: 0x16dfa250; frame = (218 12; 16 16); opaque = NO; autoresize = RM+TM+BM; layer = <CALayer: 0x16dfa3f0>>"; postCodeTextField = "<UITextField: 0x16ec6050; frame = (20 0; 190 40); text = ''; clipsToBounds = YES; opaque = NO; autoresize = RM+TM+BM; gestureRecognizers = <NSArray: 0x16ed8ae0>; layer = <CALayer: 0x16ed20d0>>"; postCodeTextFieldBG = "<UIView: 0x16ed9d30; frame = (0 0; 241 40); clipsToBounds = YES; alpha = 0.25; autoresize = RM+TM+BM; layer = <CALayer: 0x16ed9d90>>"; signInBttn = "<CSDPlainColorButton: 0x16eb0200; baseClass = UIButton; frame = (163 438; 118 30); opaque = NO; autoresize = RM+TM+BM; layer = <CALayer: 0x16ec5ec0>>"; }