我們可以正常dump系統(tǒng)APP的頭文件, 但是App Store下載的應(yīng)用是加密后, 無法直接用class-dump進(jìn)行dump頭文件, 這個(gè)時(shí)候就要用到這篇文件的dumpdecrypted, 把加密的APP砸殼后dump, 感謝開發(fā)這些工具的大佬們~
環(huán)境iPhone5c iOS 10.3.3
下載地址
github
進(jìn)行clone并make
$git clone https://github.com/stefanesser/dumpdecrypted.git
Cloning into 'dumpdecrypted'...
remote: Counting objects: 31, done.
remote: Total 31 (delta 0), reused 0 (delta 0), pack-reused 31
Unpacking objects: 100% (31/31), done.
$cd dumpdecrypted
$make
`xcrun --sdk iphoneos --find gcc` -Os -Wimplicit -isysroot `xcrun --sdk iphoneos --show-sdk-path` -F`xcrun --sdk iphoneos --show-sdk-path`/System/Library/Frameworks -F`xcrun --sdk iphoneos --show-sdk-path`/System/Library/PrivateFrameworks -arch armv7 -arch armv7s -arch arm64 -c -o dumpdecrypted.o dumpdecrypted.c
`xcrun --sdk iphoneos --find gcc` -Os -Wimplicit -isysroot `xcrun --sdk iphoneos --show-sdk-path` -F`xcrun --sdk iphoneos --show-sdk-path`/System/Library/Frameworks -F`xcrun --sdk iphoneos --show-sdk-path`/System/Library/PrivateFrameworks -arch armv7 -arch armv7s -arch arm64 -dynamiclib -o dumpdecrypted.dylib dumpdecrypted.o
ld: warning: directory not found for option '-F/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS11.3.sdk/System/Library/PrivateFrameworks'
ld: warning: directory not found for option '-F/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS11.3.sdk/System/Library/PrivateFrameworks'
ld: warning: directory not found for option '-F/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS11.3.sdk/System/Library/PrivateFrameworks'
執(zhí)行完make后會(huì)在當(dāng)前目錄生成一個(gè)dumpdecrypted.dylib 文件 這就是去砸殼的榔頭.
$ls
Makefile README dumpdecrypted.c dumpdecrypted.dylib dumpdecrypted.o
現(xiàn)在進(jìn)入手機(jī)尋找想要砸殼的APP的路徑, storeAPP的可執(zhí)行文件都存放在/var/containers/Bundle/Application/ 中
$ls /var/containers/Bundle/Application/
017E448E-7AB7-4619-9F2E-32F9FD02D476 13F95CDA-3F8A-4A8A-8E33-A9D3D896B1CD 3D3F3796-B24C-405C-A257-88F7E0D8BC0C 68A0B1EE-F924-404B-AE6B-DDEB3E996F47
我們無法分別哪個(gè)文件夾是..那么我們就用ps命令來過濾一下
避免干擾, 殺掉所有APP進(jìn)程, 只保留你要砸殼的那一個(gè).
$ps -e | grep /var/containers/Bundle/Application/
1387 ?? 0:02.25 /var/containers/Bundle/Application/68A0B1EE-F924-404B-AE6B-DDEB3E996F47/SeekingArrangement.app/SeekingArrangement
1408 ttys000 0:00.00 grep /var/containers/Bundle/Application/
我們找到了這個(gè)68A0B1EE-F924-404B-AE6B-DDEB3E996F47/SeekingArrangement.app/SeekingArrangement
然后再用cycript來找出對應(yīng)APP的documents目錄
$cycript -p 1387
cy# [[NSFileManager defaultManager] URLsForDirectory:NSDocumentDirectory inDomains:NSUserDomainMask][0]
#"file:///var/mobile/Containers/Data/Application/9EE3F784-AAC6-458E-9502-DDD264AFA7A1/Documents/"
然后將剛才的dumpdecrypted.dylib拷貝到這個(gè)目錄下
$scp dumpdecrypted.dylib root@192.168.6.52:/var/mobile/Containers/Data/Application/9EE3F784-AAC6-458E-9502-DDD264AFA7A1/Documents/
root@192.168.6.52's password:
dumpdecrypted.dylib 100% 193KB 2.1MB/s 00:00
然后找到剛才用ps -e找出來的可執(zhí)行文件, 開始進(jìn)行砸殼
$DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/containers/Bundle/Application/68A0B1EE-F924-404B-AE6B-DDEB3E996F47/SeekingArrangement.app/SeekingArrangement
中途可能會(huì)出現(xiàn)這個(gè)問題
dyld: could not load inserted library 'dumpdecrypted.dylib' because no suitable image found. Did find:
dumpdecrypted.dylib: required code signature missing for 'dumpdecrypted.dylib'
/private/var/mobile/Containers/Data/Application/9EE3F784-AAC6-458E-9502-DDD264AFA7A1/Documents/dumpdecrypted.dylib: required code signature missing for '/private/var/mobile/Containers/Data/Application/9EE3F784-AAC6-458E-9502-DDD264AFA7A1/Documents/dumpdecrypted.dylib'
Abort trap: 6
是因?yàn)楹灻膯栴}, 用開發(fā)者證書對dumpdecrypted.dylib進(jìn)行簽名后重新上傳
#list簽名
$security find-identity -v -p codesigning
#進(jìn)行簽名
$codesign --force --verify --verbose --sign "iPhone Developer: xxx xxxx (xxxxxxxxxx)" dumpdecrypted.dylib
#scp上傳后重新進(jìn)行砸殼
$DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/containers/Bundle/Application/68A0B1EE-F924-404B-AE6B-DDEB3E996F47/SeekingArrangement.app/SeekingArrangement
mach-o decryption dumper
DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.
[+] detected 32bit ARM binary in memory.
[+] offset to cryptid found: @0x4cbe4(from 0x4c000) = be4
[+] Found encrypted data at address 00004000 of length 9633792 bytes - type 1.
[+] Opening /private/var/containers/Bundle/Application/68A0B1EE-F924-404B-AE6B-DDEB3E996F47/SeekingArrangement.app/SeekingArrangement for reading.
[+] Reading header
[+] Detecting header type
[+] Executable is a plain MACH-O image
[+] Opening SeekingArrangement.decrypted for writing.
[+] Copying the not encrypted start of the file
[+] Dumping the decrypted data into the file
[+] Copying the not encrypted remainder of the file
[+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset be4
[+] Closing original file
[+] Closing dump file
當(dāng)前目錄會(huì)生成SeekingArrangement.decrypted 文件, 即砸殼后的文件
$ls
SeekingArrangement.decrypted dumpdecrypted.dylib
然后就可以拷貝到你想用的地方進(jìn)行使用了, class-dump, IDA都等著呢~
至于為什么要在APP的Documents目錄進(jìn)行操作, 因?yàn)樯痰甑腁PP只能在自己的沙盒中進(jìn)行操作, 相信各位這個(gè)問題都可以理解的.
