Skip to content

Instantly share code, notes, and snippets.

@prinsharma1999

prinsharma1999/tips.md

Created October 20, 2022 09:29
Show Gist options
  • Save prinsharma1999/92488eedcde68ec65d399598bef996d2 to your computer and use it in GitHub Desktop.
Save prinsharma1999/92488eedcde68ec65d399598bef996d2 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
tips.md

Debugging 3rd party apps on iOS and Android

Part I: iOS

Prerequisites

  • checkra1n
    • A7 - A10 devices (iPhone 5s - iPhone X), iOS 12.0+
    • Dropbear SSH, port 44, root:alpine
  • USB multiplexing daemon usbmuxd (available via brew)
  • Use scp to copy file to/from device

Forward remote (iDevice) port 44 (Dropbear SSH) to local (Mac) 2222 iproxy 2222 44

Decrypt Apple FairPlay DRM for static analysis

Sign the lib before injection ldid -S dumpdecrypted.dylib

DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/containers/Bundle/Application/$APP_UUID/$APP_NAME.app/$APP_BIN

Debug

  • find debugserver at /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/$VER/DeveloperDiskImage.dmg
  • Resign with debug server entitlements
  • Remember about ASLR slide
  • Basic code injection with dlopen or lldb process load

Fake sign debugserver with ent.xml entitlements (on device) ldid -Sent.xml debugserver

Forward debugserver ’s device port to computer iproxy 1111 1111

Run debugserver on device debugserver localhost:1111 -x backboard $APP_BIN_PATH

Run lldb on computer lldb platform select remote-ios process connect connect://localhost:1111

Can be put into .lldbinit

Links

Part II: Android

Prerequisites

gdbserver

  • Native binaries only Find gbdserver at $ANDROID_SDK/ndk/$VER/prebuilt/android-$ARCH/gdbserver/gdbserver

Find gdb frontend at $ANDROID_SDK/ndk/$VER/prebuilt/darwin-x86_64/bin/gdb

Forward gdbserver ’s device port to computer adb forward tcp:1111 tcp:1111

Run gdb on device gdbserver localhost:1111 --attach $PID

Run gdb on computer gdb target remote localhost:1111

Extract apk using ADB

adb shell pm list packages adb shell pm path com.example.someapp adb pull /data/app/.../base.apk

Unpack apk and backsmali dex for static analysis

  • Apktool
    • Works with aapt2
    • backsmalis dex files by default java -jar apktool.jar d com.example.someapp -o someapp/
  • grep all the things! grep -ir $QUERY . --include="*.smali"

ro.debuggable 1

  • Set android:debuggable="true" to the AndroidManifest.xml
    • Non optimal solution
    • Requires repacking of apks
  • Set ro.debuggable 1 globally in prop file
    • All app become visible as debuggable in ADM (deprecated) adb shell su magisk resetprop ro.debuggable 1 stop; start;

JDWP

  • Port forwarding adb shell ps -A | grep $PACKAGE_ID adb forward tcp:8700 jdwp:$PID

Reset adb forward —-remove-all

Debug

  • Any JDWP capable debugger
  • Intellij IDEA CE + smalidea
    • Import Project - small source code folder
    • Register *.smali extension under “Editor -> File types”
    • Configure remote debugging
  • Dex to Java decompiler jadx-gui

Start waiting for debugger adb shell am start-activity -D -W com.example.someapp/com.example.someapp.MainActivity

Frida

  • JS scriptable debugger backend for all platform
  • start frida-server /data/local/tmp/fida-server &
  • traces all the classes matching pattern frida-trace -U -f com.example.someapp -j '*someclass*!*/is'

Links

Links

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment