Eduardo Novella enovella

Zimperium zShield RE Notes

Newer versions of the Rabbit R1's APK are protected by https://www.zimperium.com/zshield/ (I don't know this for certain, somebody told me it is but I haven't really seen any identifying marks in the code yet)

Interesting assets within the APK:

lib/arm64-v8a/liboptipkawfn.so    ~3MB packed/encrypted ELF
assets/optipkawfn/0.odex          only 41 bytes (EDIT: I think this is part of an asset obfuscation scheme, the real file contents are likely elsewhere - inside the .szip maybe?)
assets/optipkawfn.szip ~8MB - I predict containing encrypted+compressed bytecode

Zimperium zShield RE Notes

Newer versions of the Rabbit R1's APK are protected by https://www.zimperium.com/zshield/ (I don't know this for certain, somebody told me it is but I haven't really seen any identifying marks in the code yet)

Interesting assets within the APK:

lib/arm64-v8a/liboptipkawfn.so    ~3MB packed/encrypted ELF
assets/optipkawfn/0.odex          only 41 bytes (EDIT: I think this is part of an asset obfuscation scheme, the real file contents are likely elsewhere - inside the .szip maybe?)
assets/optipkawfn.szip ~8MB - I predict containing encrypted+compressed bytecode

iOS app introspection

Jailbreak in 2025
Create Provisioning Profile in XCode

System directories

Method	Result
Environment.getDataDirectory()	/data
Environment.getDownloadCacheDirectory()	/cache
Environment.getRootDirectory()	/system

External storage directories

	function monitorMemory(base, length, interceptedInstructions = new Set()) {
	const baseAddress = ptr(base.toString());
	MemoryAccessMonitor.enable({base: baseAddress, size: length}, {
	onAccess: function(details) {
	let baseOffset = details.address.sub(baseAddress);
	console.log(`${details.address} (offset in range ${baseAddress} = ${baseOffset}) accessed for ${details.operation} from address ${DebugSymbol.fromAddress(details.from)}. Page ${details.pageIndex + 1} of ${details.pagesTotal}`);
	let instruction = Instruction.parse(details.from);
	const nextInstr = ptr(instruction.next.toString());
	if (interceptedInstructions.has(nextInstr.toString())) {
	return;

	import argparse
	import json

	predefined_struct = {
	"UnityEngine_Vector3_o" : [("float","x"),("float","y"),("float","z")]
	}

	def extract_class_methods(methods_informations, clazz):
	"""
	We check if the signature start with the class we want to hook, if so

	const THUMB_HOOK_REDIRECT_SIZE = 8;
	const THUMB_BIT_REMOVAL_MASK = ptr(1).not();

	const trampolines: NativePointer[] = [];
	const replacements: NativePointer[] = [];

	export function makeTrampoline(target: NativePointer): NativePointer {
	const targetAddress = target.and(THUMB_BIT_REMOVAL_MASK);
	const trampoline = Memory.alloc(Process.pageSize);

	#!/usr/bin/python3
	from subprocess import Popen
	import frida
	import time
	import sys

	dumped = False

	def get_script(package_name):
	jscode = """