This document provides information about an office hours session on March 23, 2017 hosted by Suhaib Alfageeh. It includes quotes about thinking differently and doing great work. The document discusses Suhaib's work on mobile scanning software and reverse engineering iOS apps. It introduces tools like Frida and MITMProxy that can be used to intercept traffic and modify apps. The document provides an overview of the Tinder API and timelines the work.

1. S W I F T
O F F I C E H O U R S
03/23/2017
“Think differently. Don't be afraid to be different. It's the crazy ones who change the world” ― Steve Jobs

2. HACKING
W I T H L O V EOnce upon a time, in a connected world…
By: Suhaib Alfageeh

3. Delivery
“Hear Ye, Hear Ye…”
Test
Using real-worldcustomer
apps
Development
Rinse. Repeat.
Design
Not your average UX
I W O R K O N
M O B I L E S C A N N I N G
S O F T W A R E
S E N I O R S O F T W A R E
E N G I N E E R AT
V E R A C O D E I N C .

7. Bundle
ResourcesAssetts
/iTunesArtwork
/iTunesArtwork@2x
App Binary
/Payload/Appname.app/Appname
iTunesMetadata.plist
What’sinside?

8. ASKAQUESTION
B.
A.
C.
D.
WHY
Why does this happen?
HOW
How does this work?
WHAT
What’s being communicated?
WHERE
Where is all this information going?

9. DIG DEEPER
WHY
Why is this app crashing?
HOW
How is this feature designed?
WHAT
What functions are called when I do this?
WHERE
What REST API endpoints are reached?

10. PILLARSOF iOS REVERSE ENGINEERING
.
DECRYPT
(BINARY)01 EXTRACT
BLUEPRINT02 STUDY &
UNDERSTAND03 MODIFY /
OPTIMIZE04
Apple AppStoreapps are
encryptedusing FairPlay
Dump headers containing
objective-c runtime info
Stored in the Mach-O
Performstatic and
dynamic analysis to
understandbehavior
Inject customcode at
runtime tocreate new
features or modify
existing ones

11. Why Tinder
SIMPLE TO
USE
EASY
TO
READ
EASY
TO
UNDERSTAND

12. MARKET SIZE
Let’s face it…most of us.

13. FLEX
BY : F L I P BOA RDhttps://github.com/Flipboard/FLEX

14. F L E X
FLEX (Flipboard Explorer) is a set of in-app debugging and
exploration tools for iOS development.

15. J o h n C o a t e s
@ p u n k s o m e t h i n g

25. w w w. f r i da . r e

26. D y n a m i c C o d e I n s t r u m en ta t i o n To o l k i t

27. W h a t c a n y o u d o w i t h i t ?

28. D y n a m i c I n s t r um e nt a ti o n

29. I n j e c t a n i n s t r u m en ta t i o n s c r i p t
i n t r o a r u n n i n g a p p l i ca t i o n

30. L i s t a l l r u n n i ng p r o c e s se s a n d P I D s
o f a U S B c o n n e c te d d e v i c e

31. Tr a c e n a t i v e A P I s

32. Tr a c e n a t i v e A P I s i n a s p e c i f i c p r o c e s s
$ f r i da - t ra ce – n T i n d e r - i “ * U R L * ” $

33. Tr a c e O b j e c t i ve - C C a l l s
$ f r i d a - t r a c e – U T i n d e r – m “ [ T N D R * * L i k e *

36. A n i n t e r a c t i v e c o n s o l e t h a t i n t e r c e p t s t r a f f i c
- I n s p e c t
- M o d i f y
- R e p l a y

37. M I T M P r o x y i n t e r c e p t s y o u r H T T P / S t r a f f i c
T h i s a l l o w s u s t o l e a r n a b o u t t h e T i n d e r A P I

41. LIKE PASS RECS UPDATES
/like/{id} /pass/{id} /user/recs /updates/
api.gotinder.com

42. O u r t i m e l i n e

43. Q&AYour work is going to
fill a large part of your
life, and the only way
to be truly satisfied is
to do what you believe
is great work. And the
only way to do great
work is to love what
you do. If you haven't
found it yet, keep
looking. Don't settle.
As with all matters of
the heart, you'll know
when you find it.
- Steve Jobs