[ios] cydia, clutch, frida hooking (탈옥 탐지 우회)

cydia impactor 키고 h3lix드래그하면 탈옥댄다...

비번은 appleid.apple.com에서 만들어야댐 (*-*-*-*)

1. 모바일 기기 접속

mac_pc#ssh root@ip

root@ip's password: passwd

mugui-iPhone:~ root#

2. 클러치 (ipa 푸는 툴)

mugui-iPhone:~ root#clutch -i

Installed apps:

1:   1234 <com.1234>

2:   2345 <kr.2345>

mugui-iPhone:~ root# clutch -d 1

Zipping 1234.app

ASLR slide: 0x37000

Dumping <1234> (armv7)

Patched cryptid (32bit segment)

Writing new checksum

DONE: /private/var/mobile/Documents/Dumped/com.1234-(Clutch-2.0.4).ipa

3. 경로 이동

ps-ef로 확인한다.

#cd /var/containers/Bundle/Application/B92134E2-1231230925/1234.app

mugui-iPhone:/private/var/mobile/Documents/Dumped root# unzip com.1234-\(Clutch-2.0.4\).ipa

4. filza > 피씨로 1234 가져옴

ip:11111 (웹에서 가능)

5. frida 구동

mugui-iPhone:/private/var/mobile/Media/Downloads root# ./frida-server-11.0.12-ios-arm &

[2] 1838

6. 바이너리 분석 및 거치는 메소드도 후킹하여 확인

7. frida로 후킹

mugui-iPhone:/private/var/mobile/Media/Downloads root# frida *** -[method name]

Instrumenting functions...                                              

-[method name]:  "/Users/mug/Desktop/**/**.js"

Started tracing 1 function. Press Ctrl+C to stop.     

8. js파일 작성

{

  onEnter: function (log, args, state) {

    log("-[asdasd Jailbreak]");

  },

  onLeave: function (log, retval, state) {

    log(retval);

  }

}

***

    log("-----mug_test_11111-----");

    //retval.replace("0x0");

    log("type of retval : " + typeof retval);

    //newretval = ptr("0x0");

    //retval.replace(newretval);

    var str = ObjC.Object(retval);

    log("text : " + str);

    log("retval : " + retval);

    //var test = ObjC.classes.NSString.stringWithString_('{**= "mug"; **= "/mug"; **= 0000;}');

    //retval.replace(test);

    log("text2 : " + str);

    log("----------");