1. Beyond The ‘Cript: Practical iOS Reverse Engineering
Michael Allen
Security Consultant

2. Why This Talk? Apps more hardened against common attacks
Bridge the gap
Deeper understanding of what happens under the hood
Foundation for additional research
Bridge gap: between the mundane methodologies and vulnerabilities and a new approach that finds additional bugs that require assembly knowledge to discover. 

3. Outline/Agenda Building A General Toolkit
iOS Application Assessment 101
Usual results
“New” approach
The Reverse Engineer’s Toolkit
Reverse Engineering iOS Applications
Mach-O Binary Format
Mach Tasks
ARM(32/64)
Objective-C
Swift
Identifying and bypassing Simple Jailbreak Detection Routines
Conclusion

4. Outline/Agenda Building A General Toolkit
iOS Application Assessment 101
The Reverse Engineer’s Toolkit
Reverse Engineering iOS Applications
Identifying and bypassing Simple Jailbreak Detection Routines
Conclusion

5. Building A General Toolkit
Jailbroken Device
File System
Network
Instrumentation
Automating Common Tasks
Essentials

6. Jailbroken Device
Removing software restrictions imposed by iOS, through the use of software exploits
Recommend dedicated device for testing
Latest jailbreak
Pangu (iOS 9.2 – bit devices only)

7. Jailbroken Device (contd.)
Tethered
Does not persist across reboots
Requires computer to start device
Untethered
Persists on device across reboots
Semi-tethered
Requires computer to start into jailbroken state
Rebooting or starting device without assistance possible. But boots into non-jailbroken state

8. Jailbroken Device (ProTip)
Change default root password from alpine
Access device over usb using usbmuxd
sudo python tcprelay.py -t 22:22
Generate ssh keys
ssh-keygen -t rsa -f ~/.ssh/ironman -N "”
Copy public key to device
ssh-copy-id -i ~/.ssh/ironman.pub
Create an alias on (~/.ssh/config)

9. File System: Moving Files
iFunbox
iExplorer
Sftp
See also iExplorer

10. Network: BurpSuite Pro Intercepting Proxy

11. Network: SSL Kill Switch 2
“Disables SSL certificate validation - including certificate pinning - within iOS Apps.”

12. Instrumentation: Cycript
Injects into target process
Interactive console
Objective-C and Javascript syntax
Supported Architectures(iOS, Mac OS X)
NowSecure fork where runtime powered by Frida* (Cycript on steroids)

13. Instrumentation: Cycript (contd.)

14. Instrumentation: Frida
Injects Google’s V8 engine into target process
Javascript executed with full access to memory
Function hooking
Access to native methods
Inject into starting process
Multiple architectures (Windows, Mac, Linux, iOS and Android)

15. Instrumentation: Frida (contd.)
Method tracing

16. Automating Common Tasks
Idb Tool -
Snoop-IT -
iRet -
IntroSpy -
AppMon -
Needle -
Varying levels of support

17. Automating Common Tasks: Idb Tool
“idb is a tool to simplify some common tasks for iOS app security assessments and research.”
Provides general app info
URL Handler
Keychain dumping
Pasteboard
Logging

18. Automating Common Tasks: Idb Tool (contd.)

19. Essentials: Command Line Utilities
BigBoss Recommended Tools (Cydia)
Erica Utilities (Cydia)
Jonathan Levin compiled a number of commonly used binaries for iOS

20. Essentials: iOSBinpack (Jonathan Levin)
Listing of available tools
Exercise caution
May not be compatible with tweaks and you may end up losing jb
Copy binary you need

21. Outline/Agenda Building A General Toolkit
iOS Application Assessment 101
The Reverse Engineer’s Toolkit
Reverse Engineering iOS Applications
Identifying and bypassing Simple Jailbreak Detection Routines
Conclusion

22. Common Attack Vectors: Sniffing On A Remote Virtual Interface
UDID from itunes

23. Common Attack Vectors: Sniffing On A Remote Virtual Interface (contd.)

24. Common Attack Vectors: Insecure Storage
Property list files (.plist)
SQLite databases
Keychain
Snapshots
Cache

25. Insecure Storage: Property Lists (.plist)
Stores serialized objects
Key value pairs
Maybe compacted to bplist (binary plist)
cat filename.plist | plutil -convert xml1 - -o -
Often stores Application preferences in /Library/Preferences using NSDefaults class

26. Insecure Storage: Client-Side Data Stores
Often see SQLite being used for client-side storage
Lightweight client-side database
Query using SQL

27. Insecure Storage: Fun Fact About SQLite Data Stores
Delete doesn’t do what you think
Deleted data added to free list
Free records not overwritten until more space required
End result is data may not be overwritten for a while
May be recovered with SQLite-parser

28. Insecure Storage: Dumping The Keychain
SQLite database stored in /var/Keychains

29. Insecure Storage: Snapshots

30. Insecure Storage: Inspecting The Cache
Caches directory similar function to that of a web browser’s cache
Aimed at improving performance
May store web cache content
Application uses UIWebView to render content.

31. Insecure Storage: Dumping Binary Cookies
Created by URL loading system or webview
Stored on local file system in binary format.

32. Common Attack Vectors: Inter-process Communication
Application registers custom URL scheme
Invoked when scheme called
Application registers custom URL scheme
Application invoked when scheme is called
Recall bug in Skype that allowed calls via protocol handler without users consent

33. Common Attack Vectors: Inter-process Communication
Suggest using lsdtrip to identify URL’s
Use publicurls | privateurls option
Application registers custom URL scheme
Application invoked when scheme is called
Recall bug in Skype that allowed calls via protocol handler without users consent

34. Inter-process Communication (Side Note)
Malicious app could register your URL scheme
[[UIApplication sharedApplication] openURL:myURL];
Universal Links introduced in iOS 9
Kills the openURL problem
Developer specifies what URL’s will be processed by app (association file)
Communication over HTTPS
No more enumerating apps via can canOpenURL method

35. Common Attack Vectors: Injection Attacks
UIWebViews
File-Handling Routine
XML

36. Summary: Usual Results
Issues relating to Local Storage
Keep in mind most of these attacks requires the device to be unlocked
Unsecured API’s (via Burpsuite Pro)
Some hard-coded secrets maybe (typically run strings against binary)
The truth however is that most of these bugs closed
Binary protections are now standard
Data Protection API’s (keychain etc)
Universal links introduced with iOS 9 address IPC loophole
…...

37. Additionally What Happens When?
The common tools fail?
Your Google Fu returns nothing?
There are custom security protections in place
You want to extend an existing tool?
You want start investigating deeply hidden logic bugs
Crypto functions etc
Move beyond 3rd party applications

38. Towards A “New” Approach
At this point we need to take a different approach one that involves Reverse Engineering and leverages knowledge of :
iOS internals
ARM(32/64) Assembly
Deep dive into Objective-C/Swift
…....
Let’s improve our toolkit
And expand our knowledge base

39. Outline/Agenda Building A General Toolkit
iOS Application Assessment 101
The Reverse Engineer’s Toolkit
Reverse Engineering iOS Applications
Identifying and bypassing Simple Jailbreak Detection Routines
Conclusion

40. The Reverse Engineer’s Toolkit
IDA Pro
Hopper
LLDB
Jtool
Procexp
GNU Project Debugger (gdb)
Apple CC Tools

41. The Reverse Engineer’s Toolkit: IDA Pro
Remote iOS Debugger plugin
Allows users to debug iOS target applications directly from IDA

42. The Reverse Engineer’s Toolkit: Hopper

43. The Reverse Engineer’s Toolkit: lldb
Debugging an application binary with lldb
iOS Device
debugserver -x backboard ip:port </path/to/executable>
MAC Host
lldb
process connect connect://<remote_host>:<port>
image list –o –f (ASLR)
debugserver not configured on device by default
attach device to Xcode enable debugging
thin binary for your device
slap on entitlements
See paper at end for details on configuration

44. The Reverse Engineer’s Toolkit: lldb (contd.)

45. The Reverse Engineer’s Toolkit: lldb ASLR (contd.)
Breakpoint = offset1 + offset2
Or just use the symbols  1 2

46. The Reverse Engineer’s Toolkit: jtool
otool type functionality with way more options
MACH-O analysis (atos, dyldinfo, nm, strings etc)
Multi-platform (OS X, iOS, Linux)
ARM64 disassembler

47. The Reverse Engineer’s Toolkit: jtool (contd.)

48. The Reverse Engineer’s Toolkit: jtool (bonus)
All processes share the same copy of dyld_shared_cache
- It’s only loaded once

49. The Reverse Engineer’s Toolkit: procexp
Getting task related info
Display threads, mach ports, dump core (memory image) etc..

50. The Reverse Engineer’s Toolkit: gdb
Use source from
No support for arm64 architectures

51. The Reverse Engineer’s Toolkit: filemon
Tracing file system activity with FSEvents

52. Apple’s CC Tools otool nm lipo Codesign MACH-O Binary Swiss army knife
Displays symbol table
lipo
Architectures embedded in binary
Codesign
Binary signing

53. Outline/Agenda Building A General Toolkit
iOS Application Assessment 101
The Reverse Engineer’s Toolkit
Reverse Engineering iOS Applications
Identifying and bypassing Simple Jailbreak Detection Routines
Conclusion

54. Reverse Engineering iOS Applications (Under The Hood)
Mach-O Binary Format
Mach Tasks
ARM(32/64)
Objective-C
Swift
XNU
BSD – files, processes etc
MACH microkernel – task, memory, IPC primitives
IOKIT – Kernel Extensions
ELF – Extensible and Library Format

55. Mach-O Binary Format

56. Application Binary Version Location < iOS 8
/var/mobile/Application/<app bundle id>
iOS 8 +
/var/mobile/Containers/Bundle/Application/<app bundle id>
App binary, nibs, Code Signature
/var/mobile/Containers/Data/Application/<app bundle id>
Documents, Library, tmp folder
iOS 9.3.x
/var/containers/Bundle/Application/<app bundle id>
App binary

57. Mach-O Binary Header – Identifies file type, architecture etc
Load Commands – Details layout and linkage specifications
Data – Code

58. Mach-O: Header <mach-o/loader.h>

59. Mach-O: Flags PIE: Commonly checked flag during an assessment.
ASLR for executable types

60. Mach-O: Load Commands (Kernel)
LC_SEGMENT[_64] main load command
Memory regions with same r/w/x protection
<mach-o/loader.h>
Kernel
- Allocate virtual memory
- Create main thread
- Code Signing
- Encryption
LC_SEGMENT
instructs the kernel how to set up the memory space of the newly run process.
“segments” are directly loaded from the Mach-O binary into memory.
Kernel loader bsd/kern/mach_loader.c

61. Mach-O: SEGMENTS
__PAGEZERO(NULL pointer trap, all access permissions revoked )
_TEXT(program code)
_DATA (readable/writeable program data)
_LINKEDIT (symbol and other tables used by linker)
_RESTRICT (see dyld.cpp, will not load DYLD_INSERT_LIBRARIES)
Optional sections
Memory regions with same r/w/x protection
_RESTRICT with _restrict section
__PAGEZERO
- 32 bit systems corresponds to single page of memory (4KB)
- 64 bit systems entire 32-bit address space or first 4GB
- All access permissions revoked

62. Mach-O: Common Segments and Sections

63. Mach-O: Viewing Segments and Sections
LC_UNIXTHREAD/LC_MAIN defines entry point
LC_ENCRYPTION_INFO
LC_CODE_SIGNATURE

64. MachOView (GUI) LC_UNIXTHREAD/LC_MAIN defines entry point
LC_ENCRYPTION_INFO
LC_CODE_SIGNATURE

65. Mach-O: Load Commands (dyld)
Kernel hands off to DYLD(dynamic linker)
Uses dynamic linker specified in LC_LOAD_DYLINKER
Loads each LC_LOAD_DYLIB
Resolves symbols
Interposing (method switching)
add __interpose section to __DATA SEGMENT
Force library loading with DYLD_INSERT_LIBRARIES
code with __attribute(constructor) auto runs
Interposing inject/replace functions
See DYLD_INSERT_LIBRARIES used by dumpdecrytped

66. Mach Tasks

67. Mach Tasks At this point binary mapped into memory
Process on other systems
Port (IPC Endpoint)
Own the port, own the task
Mach Trap task_for_pid()
Requires jailbreak tfp0 patch for kernel(PID0)
processor_set_tasks()
Any task port in system
XNU Kernel is at heart of OSX/iOS
Heart of XNU is MACH microkernel
processor_set_tasks – Controls processor group (usually cores on single CPU)
XNU abstraction to scale to multiprocessors/multicores architectures.
Trap is an exception by executing special instruction

68. Mach Tasks – Interacting with the task
Get the task port
Read/write memory with mach_vm* api’s
Inject your own shellcode
Left to your imagination

69. Mach Tasks – Owning The Port
* mach_vm_region returns information about a memory region in a given address space.

70. Mach Tasks – Dumping Memory
Write your own code and call appropriate mach_vm* api’s
Use procexp <pid> regions

71. Mach Tasks – Dumping Memory
Read using lldb (memory read –outfile <outfile> –count <size> <address>)

72. ARM Assembly

73. ARM32 - Registers Register Purpose R0 – R12 General purpose registers
Stack pointer
R14
Link register. Holds return address during a function call.
R15
Program counter (PC)
CPSR
Information on current execution state (Endianness bit, Thumb bit, Mode bit)
CPSR – Current Program Status Register
ARM – instructions are 32 bits wide
THUMB – 16/32 bits wide
PC – Like EIP/RIP
Stack Pointer - ESP

74. ARM32 – Function Calling Convention
Functions are invoked via a B, BX, BL, BLX
Register
Purpose
r0-r3
First four function parameters.
Other arguments passed on stack r0
Stores return value

75. ARM32 – Basic Loading Instructions
Arm is a load/store architecture
Data must be loaded into registers before they can be used
Register
Purpose
LDR
Loads a word.
Ex. LDR R3, [R0]
Loads the word value at R0 into R3
STR
Stores a word.
Ex. STR R3, [R4]
Takes the value in R3 and stores at memory address R4
Load store architecture

76. ARM64 - Registers Register Purpose x0-x28
General purpose registers (64 bit)
w0-w30
General purpose registers (32 bit)
x29
Frame pointer
x30
Link register (return address) SP
Stack pointer PC
Program counter

77. ARM64 – Function Calling Convention
Register
Purpose
x0-x7
Arguments/return values
x9-x15
Local variables
x19-x29
Callee-saved registers

78. Objective-C

79. Objective-C objc_msgSend id objc_msgSend(id self, SEL op,…)
Equivalent of calling functions in C
id objc_msgSend(id self, SEL op,…)
receiver(id self)
selector(SEL op)
Receiver is a pointer to class message is intended for
Selector is the method to handle message

80. Objective-C (contd.)

81. Objective-C (contd.) x0 – receiver x1 – selector x2 – argument
objc_msgSend – func call
-v –d objc retrieves info on classes, methods etc
*ARM64

82. Objective-C: Method Swizzling Under The Hood
objc_method struct holds information about method of a class [/usr/include/objc/runtime.h]
Hooking Frameworks [/Library/Frameworks/CydiaSubstrate.framework]
Member
Description
method_name
Method name
method_types
Accepted parameters
method_imp
Pointer to implementation
CydiaSubstrate:
MSHookMessageEx
MSHookFunction
Swizzling just changes implementation using underlying C functions:
class_replaceMethod
method_exchangeImplementations
method_setImplementation

83. CydiaSubstrate Method Swizzling

84. SWIFT

85. Swift Introduced with iOS 8
Still uses traditional message passing for Swift classes that inherit from Objective-C classes
Swift classes may use
Direct function calls
Vtables
C++ like mangled function names
Method Swizzling if subclass of NSObject

86. Swift: Mangled Function Names
Objective-C

87. Swift: Mangled Function Names
__TFC9jailbreak14ViewController12btnFileCheckfS0_FPSs9AnyObject_T_
__T Swift Symbol
F indicates function
C indicates it is a function belonging to a class
9jailbreak module name prefixed with length
14ViewController class name prefixed with length
12btnFileCheck function name prefixed with length
S0_FPSs no clue ?? 
f function attribute
9AnyObject function parameter
T_ return type

88. Swift: demangle Tool See also hopper-swift-demangle plugin
Plugin for Hopper that automates this

89. Outline/Agenda Building A General Toolkit
iOS Application Assessment 101
The Reverse Engineer’s Toolkit
Reverse Engineering iOS Applications
Identifying and bypassing Simple Jailbreak Detection Routines
Conclusion

90. Disclaimer We will discuss binary patching next
Yeah but I could do this with ?
Yes there are several other options:
xCon
tsProtector
Officer
Tools discussed earlier(remember CydiaSubstrate hooking with MSHookFunction)
What happens when you can’t?
Get comfortable reading/modifying ARM assembly
Start with simple examples

91. But First A Note On Patching 101
Replace instruction with NOP
No Operation
Change conditional instructions to unconditional ones
BNE, BEQ, BLT….changes to just B etc
Update the register that determines branch taken
reg write <register> <value>
p $<reg> = <value>
Remove SEGMENT
__RESTRICT

92. Identifying and bypassing Simple Jailbreak Detection Routines Case Study

93. Case Study: Viewing File System Activity
Using filemon -l
Creates hard links to temporary files

94. Case Study: Viewing Logs
Using idevicesyslog [libimobiledevice]

95. Case Study: Obtaining The Binary
Dump the binary (facilitated by DYLD and DYLD_INSERT_LIBRARIES environment variable)

96. Case Study: Obtaining Symbols
Dump the symbols along with dylib’s to which they belong

97. Case Study: Extracting strings
Any interesting strings?
Dump cstring section (same as running strings)
Knowledge of SEGMENTS and sections important

98. Case Study: Extracting DYLIB’S
procexp <pid> regions
Dump the library with lldb

99. Case Study: Extracting DYLIB’S

100. Case Study: Obtaining Classes

101. Case Study: Bypassing RootFS Check

102. Case Study: Bypassing RootFS Check
statfs argument
statfs func call
Patch here
TBNZ test the bit to determine if i

103. Case Study: Bypassing RootFS Check
Patch register w8
Patch here

104. Case Study: Bypassing RootFS Check

105. Case Study: Bypassing Debugger Checks
Changes when debugger attached

106. Case Study: Bypassing Debugger Checks (ppid)
A process ID value of 1 indicates that there is no parent process associated with the calling process.

107. Case Study: Bypassing Debugger Checks (ppid)
Patch here
ppid func call
A process ID value of 1 indicates that there is no parent process associated with the calling process.

108. Case Study: Bypassing Debugger Checks (ppid)
Patch here
parent process id of calling process

109. Case Study: Bypassing Debugger Checks (p_traced)
sysctl func call
Patch here
sysctl - Get or set kernel state
CTL_KERN top-level name for kernel-specific information
KERN_PROC Indicates that sysctl will return a struct with process entries.
KERN_PROC_PID - specifies that the target process will be selected based on a process ID (PID).
- Finally, the last item is the PID of that process.

110. Case Study: Bypassing Debugger Checks (p_traced)
Patch here

111. Case Study: Bypassing Fork Check
Call to fork
Return value in X0
Patch CMN W19, #1

112. Case Study: Bypassing Fork Check
Patch here

113. Conclusion Add the reverse engineering skillset to your arsenal !!!
Common bugs being closed
A “new” approach and break from the norm is required for in depth assessments
Assembly knowledge a MUST for Reversing Engineering
Low level assembly allows you to bypass many security protections, discover hidden gems and then some
Knowledge of iOS architecture will not only improve your assessments but also provide a launching pad for other research
Disassemblers are your friends (IDA, Hopper, Jtool …..)
Add the reverse engineering skillset to your arsenal !!!

114. References
Books:
Mac OS X and iOS Internals To the Apple’s Core (Jonathan Levin)
The Mobile Application Hacker’s Handbook (Dominic Chell, Tyrone Erasmus et al. )
Hacking and Securing iOS Applications (Jonathan Zdziarski)
iOS Application Security: The Definitive Guide for Hackers and Developers (David Thiel)
Blogs and Tools:
processor_set_tasks() -
procexp –
iOSBinaries -
jtool -
filemon -
AmIBeingDebugged -
Frida -
Cycript -
iFunBox -
SSL Kill Switch –
BurpSuite -
IDA -
Hopper -
Idb -
PT_DENY_ATTACH -
ARM -
SQLite-parser -
SQLite Deletion -
lsdtrip -