学习iOS安全之砸壳原理小记

前言

准备

1. 越狱
• https://checkra.in/

2. Cydia工具安装
• OpenSSH
• Darwin cc tools

3. 下载App
• 在 AppStore 随便找个App

$ otool -lv /var/containers/Bundle/Application/xxxxx-xxxx-xxxx-xxxx-xxxxx/Foo.app/Foo | egrep 'LC_ENCRYPTION_INFO|cryptid'
          cmd LC_ENCRYPTION_INFO_64
      cryptid 1

• Clutch

• dumpdecrypted

• frida-ios-dump

• CrackerXI App

初代砸壳工具

源码分析

__attribute__((constructor))
void dumptofile(int argc, const char **argv, const char **envp, const char **apple, struct ProgramVars *pvars)

void dumptofile(const char *path, const struct mach_header *mh) {
	...
}

static void image_added(const struct mach_header *mh, intptr_t slide) {
	Dl_info image_info;
	int result = dladdr(mh, &image_info);
	dumptofile(image_info.dli_fname, mh);
}

__attribute__((constructor))
static void dumpexecutable() {
	_dyld_register_func_for_add_image(&image_added);
}

/*
 * The following functions allow you to install callbacks which will be called   
 * by dyld whenever an image is loaded or unloaded.  During a call to _dyld_register_func_for_add_image()
 * the callback func is called for every existing image.  Later, it is called as each new image
 * is loaded and bound (but initializers not yet run).  The callback registered with
 * _dyld_register_func_for_remove_image() is called after any terminators in an image are run
 * and before the image is un-memory-mapped.
 */
extern void _dyld_register_func_for_add_image(void (*func)(const struct mach_header* mh, intptr_t vmaddr_slide))    __OSX_AVAILABLE_STARTING(__MAC_10_1, __IPHONE_2_0);
extern void _dyld_register_func_for_remove_image(void (*func)(const struct mach_header* mh, intptr_t vmaddr_slide)) __OSX_AVAILABLE_STARTING(__MAC_10_1, __IPHONE_2_0);

1. 内核空间
内核空间的主要任务是创建新 task 并初始化内存页和对应的权限：
1. 分配虚拟内存空间。
2. fork 进程。
3. 加载 MachO 到进程空间。
4. 加载动态链接器 dyld 并将控制权交给 dyld 处理。

2. 用户空间
从内核回到用户空间，便跳转到目标的入口地址开始执行动态链接阶段，进入 dyld 动态链接器：
1. 配置环境变量
2. 加载共享缓存库
3. 实例化主程序
4. 加载动态链接库
5. 链接主程序
6. 加载Load和特定的C++的构造函数方法
7. 寻找APP的main函数并调用

/* extract basename */
tmp = strrchr(rpath, '/');
printf("\n\n");
if (tmp == NULL)
{
	printf("[-] Unexpected error with filename.\n");
	_exit(1);
}
else
{
	printf("[+] Dumping %s\n", tmp + 1);
}

/* detect if this is a arm64 binary */
if (mh->magic == MH_MAGIC_64)
{
	lc = (struct load_command *)((unsigned char *)mh + sizeof(struct mach_header_64));
	printf("[+] detected 64bit ARM binary in memory.\n");
}
else
{ /* we might want to check for other errors here, too */
	lc = (struct load_command *)((unsigned char *)mh + sizeof(struct mach_header));
	printf("[+] detected 32bit ARM binary in memory.\n");
}

/* searching all load commands for an LC_ENCRYPTION_INFO load command */
for (i = 0; i < mh->ncmds; i++)
{
	/*printf("Load Command (%d): %08x\n", i, lc->cmd);*/
	if (lc->cmd == LC_ENCRYPTION_INFO || lc->cmd == LC_ENCRYPTION_INFO_64)
	{
		eic = (struct encryption_info_command *)lc;
		/* If this load command is present, but data is not crypted then exit */
		if (eic->cryptid == 0)
		{
			break;
		}
...

off_cryptid = (off_t)((void *)&eic->cryptid - (void *)mh);
printf("[+] offset to cryptid found: @%p(from %p) = %x\n", &eic->cryptid, mh, off_cryptid);

printf("[+] Reading header\n");
n = read(fd, (void *)buffer, sizeof(buffer));
if (n != sizeof(buffer))
{
	printf("[W] Warning read only %d bytes\n", n);
}

printf("[+] Detecting header type\n");
fh = (struct fat_header *)buffer;

/* Is this a FAT file - we assume the right endianess */
if (fh->magic == FAT_CIGAM)
{
	printf("[+] Executable is a FAT image - searching for right architecture\n");
	...
}
else if (fh->magic == MH_MAGIC || fh->magic == MH_MAGIC_64)
{
	printf("[+] Executable is a plain MACH-O image\n");
}
else
{
	printf("[-] Executable is of unknown type\n");
	_exit(1);
}

...
/* calculate address of beginning of crypted data */
n = fileoffs + eic->cryptoff;

restsize = lseek(fd, 0, SEEK_END) - n - eic->cryptsize;
lseek(fd, 0, SEEK_SET);

printf("[+] Copying the not encrypted start of the file\n");
/* first copy all the data before the encrypted data */
while (n > 0)
{
	toread = (n > sizeof(buffer)) ? sizeof(buffer) : n;
	r = read(fd, buffer, toread);
	if (r != toread)
	{
		printf("[-] Error reading file\n");
		_exit(1);
	}
	n -= r;

	r = write(outfd, buffer, toread);
	if (r != toread)
	{
		printf("[-] Error writing file\n");
		_exit(1);
	}
}

/* now write the previously encrypted data */
printf("[+] Dumping the decrypted data into the file\n");
r = write(outfd, (unsigned char *)mh + eic->cryptoff, eic->cryptsize);
if (r != eic->cryptsize)
{
	printf("[-] Error writing file\n");
	_exit(1);
}

/* and finish with the remainder of the file */
n = restsize;
lseek(fd, eic->cryptsize, SEEK_CUR);
printf("[+] Copying the not encrypted remainder of the file\n");
while (n > 0)
{
	toread = (n > sizeof(buffer)) ? sizeof(buffer) : n;
	r = read(fd, buffer, toread);
	if (r != toread)
	{
		printf("[-] Error reading file\n");
		_exit(1);
	}
	n -= r;

	r = write(outfd, buffer, toread);
	if (r != toread)
	{
		printf("[-] Error writing file\n");
		_exit(1);
	}
}
...

• 复制文件头数据（header开始到eic->cryptoff

• 将解密数据写入文件（mh+eic->cryptoff 开始大小为 eic->cryptsize 的内核解密好的数据）

• 将文件的其余部分也写入文件

if (off_cryptid)
{
	uint32_t zero = 0;
	off_cryptid += fileoffs;
	printf("[+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset %x\n", off_cryptid);
	if (lseek(outfd, off_cryptid, SEEK_SET) != off_cryptid || write(outfd, &zero, 4) != 4)
	{
		printf("[-] Error writing cryptid value\n");
	}
}

编译&测试

Clutch

使用

<key>platform-application</key>
<true/>
<key>get-task-allow</key>
<true/>
<key>run-unsigned-code</key>
<true/>
<key>com.apple.private.skip-library-validation</key>
<true/>
<key>com.apple.private.security.no-container</key>
<true/>

frida-ios-dump

使用

# 要使用 zst 上的 xz 压缩重新打包存档：
mkdir frida_16.0.8_iphoneos-arm
cd frida_16.0.8_iphoneos-arm
ar -x ../frida_16.0.8_iphoneos-arm.deb
zstd -d *.zst
xz *.tar
ar r frida_16.0.8_iphoneos-arm-repacked.deb debian-binary control.tar.xz data.tar.xz
# SCP frida_16.0.8_iphoneos-arm-repacked.deb 存档到你的设备，然后运行 dpkg -i：
dpkg -i frida_16.0.8_iphoneos-arm-repacked.deb

git clone https://github.com/AloneMonkey/frida-ios-dump
pip3 install -r frida-ios-dump/requirements.txt

最后

参考链接

• checkra.in

• iOS-Pentest-Tools

• Understanding the iOS File System

• 一条命令完成砸壳

• dumpdecrypted

• __attribute__((constructor)) and __attribute__((destructor)) syntaxes in C

• 深入浅出MachO

• 砸壳原理之dumpdecrypted

• apple-oss-distributions/dyld

• iOS 应用的启动过程

• iOS逆向(5)-不知MachO怎敢说自己懂DYLD

• iOS逆向(11)-砸壳原理剖析，主动加载所有framework

• Frida-ios-dump一键砸壳菜鸡版