SlideShare a Scribd company logo
iOS INTERNALS
Part -2
@whoami
● Anto Joseph
● Works @ Citrix
● Does Security Research on Mobile / iOT and anything Interesting
● Speaker / Trainer @ HITB , HIP , NullCon, g0s, c0c0n, x0rconf etc
● Loves Music ( in my other life , i have been a DJ ) / Food / Bikes etc
iOS 101
● Objective C runtime
● Can be written in Objective C / Swift / Native Code
● CodeSigning is important
● Apps are zip file containers containing resources( images / plits) and the binary
● Binary if coming from apple has to be decrypted - use cluth / dump decrypted
● Use class-dump to find out the classes/ methods
● Use cycript to call those methods
Dynamic Analysis
● URl Schemes - Ios way of doing IPC
● Clipboard - - Ios way of doing IPC
● Network - SSL Trust Killer 2
● Binary Analysis - Hopper / IDa
Enter Cycript
Cycript allows developers to explore and modify running applications on either iOS
or Mac OS X using a hybrid of Objective-C++ and JavaScript syntax through an
interactive console that features syntax highlighting and tab completion.
cy# - commands
● Find all classes
○ cy# ObjectiveC.classes
● Get Instance of a class
○ cy# var blah = new Instance(0x123456)
● Call Methods
○ cy# [classname method_name: arguments]
● Find a class in memory
○ cy# choose(ClassName)
Demo Time
● Bypassing A Lock
● Making Changes to the SpringBoard
Thanks

More Related Content

What's hot

Django Python(2)
Django Python(2)Django Python(2)
Django Python(2)
tomcoh
 
Tools for FPGA Development
Tools for FPGA DevelopmentTools for FPGA Development
Tools for FPGA Development
Brahim HAMADICHAREF
 
Introduction to python programming, Why Python?, Applications of Python
Introduction to python programming, Why Python?, Applications of PythonIntroduction to python programming, Why Python?, Applications of Python
Introduction to python programming, Why Python?, Applications of Python
Pro Guide
 
JS in Arduino Uno
JS in Arduino UnoJS in Arduino Uno
JS in Arduino Uno
Raj Bharath
 
MozillaPH Rust Hack & Learn Session 1
MozillaPH Rust Hack & Learn Session 1MozillaPH Rust Hack & Learn Session 1
MozillaPH Rust Hack & Learn Session 1
Robert 'Bob' Reyes
 
مدخل برمجة صعيدي جيكس
مدخل برمجة صعيدي جيكس مدخل برمجة صعيدي جيكس
مدخل برمجة صعيدي جيكس
Hesham Hanafi
 
Italian Alt.Net Conference MonoTouch Session
Italian Alt.Net Conference MonoTouch SessionItalian Alt.Net Conference MonoTouch Session
Italian Alt.Net Conference MonoTouch Session
Chris Hardy
 
An Introduction to pair programming methods
An Introduction to pair programming methodsAn Introduction to pair programming methods
An Introduction to pair programming methods
Frank Sons
 
Dynamic hacking with Guile (FOSDEM 2011)
Dynamic hacking with Guile (FOSDEM 2011)Dynamic hacking with Guile (FOSDEM 2011)
Dynamic hacking with Guile (FOSDEM 2011)
Igalia
 
Killer Robots 101 with Gobot
Killer Robots 101 with GobotKiller Robots 101 with Gobot
Killer Robots 101 with Gobot
Thejana Satanarachchi
 
Ios fundamentals with ObjectiveC
Ios fundamentals with ObjectiveCIos fundamentals with ObjectiveC
Ios fundamentals with ObjectiveC
Madusha Perera
 
C# On The iPhone with MonoTouch at DDD8
C# On The iPhone with MonoTouch at DDD8C# On The iPhone with MonoTouch at DDD8
C# On The iPhone with MonoTouch at DDD8
Chris Hardy
 

What's hot (12)

Django Python(2)
Django Python(2)Django Python(2)
Django Python(2)
 
Tools for FPGA Development
Tools for FPGA DevelopmentTools for FPGA Development
Tools for FPGA Development
 
Introduction to python programming, Why Python?, Applications of Python
Introduction to python programming, Why Python?, Applications of PythonIntroduction to python programming, Why Python?, Applications of Python
Introduction to python programming, Why Python?, Applications of Python
 
JS in Arduino Uno
JS in Arduino UnoJS in Arduino Uno
JS in Arduino Uno
 
MozillaPH Rust Hack & Learn Session 1
MozillaPH Rust Hack & Learn Session 1MozillaPH Rust Hack & Learn Session 1
MozillaPH Rust Hack & Learn Session 1
 
مدخل برمجة صعيدي جيكس
مدخل برمجة صعيدي جيكس مدخل برمجة صعيدي جيكس
مدخل برمجة صعيدي جيكس
 
Italian Alt.Net Conference MonoTouch Session
Italian Alt.Net Conference MonoTouch SessionItalian Alt.Net Conference MonoTouch Session
Italian Alt.Net Conference MonoTouch Session
 
An Introduction to pair programming methods
An Introduction to pair programming methodsAn Introduction to pair programming methods
An Introduction to pair programming methods
 
Dynamic hacking with Guile (FOSDEM 2011)
Dynamic hacking with Guile (FOSDEM 2011)Dynamic hacking with Guile (FOSDEM 2011)
Dynamic hacking with Guile (FOSDEM 2011)
 
Killer Robots 101 with Gobot
Killer Robots 101 with GobotKiller Robots 101 with Gobot
Killer Robots 101 with Gobot
 
Ios fundamentals with ObjectiveC
Ios fundamentals with ObjectiveCIos fundamentals with ObjectiveC
Ios fundamentals with ObjectiveC
 
C# On The iPhone with MonoTouch at DDD8
C# On The iPhone with MonoTouch at DDD8C# On The iPhone with MonoTouch at DDD8
C# On The iPhone with MonoTouch at DDD8
 

Similar to iOS Internals Part -2

Introduction to iOS Penetration Testing
Introduction to iOS Penetration TestingIntroduction to iOS Penetration Testing
Introduction to iOS Penetration Testing
OWASP
 
[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...
[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...
[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...
PROIDEA
 
Ios development
Ios developmentIos development
Ios development
Shakil Ahmed
 
Extending Android's Platform Toolsuite
Extending Android's Platform ToolsuiteExtending Android's Platform Toolsuite
Extending Android's Platform Toolsuite
Opersys inc.
 
DSA Day 2 PPT.pdf
DSA Day 2 PPT.pdfDSA Day 2 PPT.pdf
DSA Day 2 PPT.pdf
AkramMohammad28
 
Leveraging Android's Linux Heritage at AnDevCon IV
Leveraging Android's Linux Heritage at AnDevCon IVLeveraging Android's Linux Heritage at AnDevCon IV
Leveraging Android's Linux Heritage at AnDevCon IV
Opersys inc.
 
Leveraging Android's Linux Heritage at AnDevCon3
Leveraging Android's Linux Heritage at AnDevCon3Leveraging Android's Linux Heritage at AnDevCon3
Leveraging Android's Linux Heritage at AnDevCon3
Opersys inc.
 
iOS Application Security
iOS Application SecurityiOS Application Security
iOS Application Security
Egor Tolstoy
 
Никита Корчагин - Introduction to Apple iOS Development.
Никита Корчагин - Introduction to Apple iOS Development.Никита Корчагин - Introduction to Apple iOS Development.
Никита Корчагин - Introduction to Apple iOS Development.
DataArt
 
Embedded Android Workshop with Lollipop
Embedded Android Workshop with LollipopEmbedded Android Workshop with Lollipop
Embedded Android Workshop with Lollipop
Opersys inc.
 
200910 - iPhone at OOPSLA
200910 - iPhone at OOPSLA200910 - iPhone at OOPSLA
200910 - iPhone at OOPSLA
Javier Gonzalez-Sanchez
 
Python_final_print_batch_II_vision_academy.pdf
Python_final_print_batch_II_vision_academy.pdfPython_final_print_batch_II_vision_academy.pdf
Python_final_print_batch_II_vision_academy.pdf
bhagyashri686896
 
Python_vision_academy notes
Python_vision_academy notes Python_vision_academy notes
Python_vision_academy notes
rajaniraut
 
Python_final_print_batch_II_vision_academy (1).pdf
Python_final_print_batch_II_vision_academy (1).pdfPython_final_print_batch_II_vision_academy (1).pdf
Python_final_print_batch_II_vision_academy (1).pdf
rupaliakhute
 
Python_final_print_batch_II_vision_academy.pdf
Python_final_print_batch_II_vision_academy.pdfPython_final_print_batch_II_vision_academy.pdf
Python_final_print_batch_II_vision_academy.pdf
sannykhopade
 
Introduction to the Python
Introduction to the PythonIntroduction to the Python
Introduction to the Python
BMS Institute of Technology and Management
 
Headless Android (Wearable DevCon 2014)
Headless Android (Wearable DevCon 2014)Headless Android (Wearable DevCon 2014)
Headless Android (Wearable DevCon 2014)
Ron Munitz
 
Embedded Android Workshop with Marshmallow
Embedded Android Workshop with MarshmallowEmbedded Android Workshop with Marshmallow
Embedded Android Workshop with Marshmallow
Karim Yaghmour
 
Embedded Android Workshop with Marshmallow
Embedded Android Workshop with MarshmallowEmbedded Android Workshop with Marshmallow
Embedded Android Workshop with Marshmallow
Opersys inc.
 
Embedded Android Workshop with Marshmallow
Embedded Android Workshop with MarshmallowEmbedded Android Workshop with Marshmallow
Embedded Android Workshop with Marshmallow
Opersys inc.
 

Similar to iOS Internals Part -2 (20)

Introduction to iOS Penetration Testing
Introduction to iOS Penetration TestingIntroduction to iOS Penetration Testing
Introduction to iOS Penetration Testing
 
[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...
[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...
[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...
 
Ios development
Ios developmentIos development
Ios development
 
Extending Android's Platform Toolsuite
Extending Android's Platform ToolsuiteExtending Android's Platform Toolsuite
Extending Android's Platform Toolsuite
 
DSA Day 2 PPT.pdf
DSA Day 2 PPT.pdfDSA Day 2 PPT.pdf
DSA Day 2 PPT.pdf
 
Leveraging Android's Linux Heritage at AnDevCon IV
Leveraging Android's Linux Heritage at AnDevCon IVLeveraging Android's Linux Heritage at AnDevCon IV
Leveraging Android's Linux Heritage at AnDevCon IV
 
Leveraging Android's Linux Heritage at AnDevCon3
Leveraging Android's Linux Heritage at AnDevCon3Leveraging Android's Linux Heritage at AnDevCon3
Leveraging Android's Linux Heritage at AnDevCon3
 
iOS Application Security
iOS Application SecurityiOS Application Security
iOS Application Security
 
Никита Корчагин - Introduction to Apple iOS Development.
Никита Корчагин - Introduction to Apple iOS Development.Никита Корчагин - Introduction to Apple iOS Development.
Никита Корчагин - Introduction to Apple iOS Development.
 
Embedded Android Workshop with Lollipop
Embedded Android Workshop with LollipopEmbedded Android Workshop with Lollipop
Embedded Android Workshop with Lollipop
 
200910 - iPhone at OOPSLA
200910 - iPhone at OOPSLA200910 - iPhone at OOPSLA
200910 - iPhone at OOPSLA
 
Python_final_print_batch_II_vision_academy.pdf
Python_final_print_batch_II_vision_academy.pdfPython_final_print_batch_II_vision_academy.pdf
Python_final_print_batch_II_vision_academy.pdf
 
Python_vision_academy notes
Python_vision_academy notes Python_vision_academy notes
Python_vision_academy notes
 
Python_final_print_batch_II_vision_academy (1).pdf
Python_final_print_batch_II_vision_academy (1).pdfPython_final_print_batch_II_vision_academy (1).pdf
Python_final_print_batch_II_vision_academy (1).pdf
 
Python_final_print_batch_II_vision_academy.pdf
Python_final_print_batch_II_vision_academy.pdfPython_final_print_batch_II_vision_academy.pdf
Python_final_print_batch_II_vision_academy.pdf
 
Introduction to the Python
Introduction to the PythonIntroduction to the Python
Introduction to the Python
 
Headless Android (Wearable DevCon 2014)
Headless Android (Wearable DevCon 2014)Headless Android (Wearable DevCon 2014)
Headless Android (Wearable DevCon 2014)
 
Embedded Android Workshop with Marshmallow
Embedded Android Workshop with MarshmallowEmbedded Android Workshop with Marshmallow
Embedded Android Workshop with Marshmallow
 
Embedded Android Workshop with Marshmallow
Embedded Android Workshop with MarshmallowEmbedded Android Workshop with Marshmallow
Embedded Android Workshop with Marshmallow
 
Embedded Android Workshop with Marshmallow
Embedded Android Workshop with MarshmallowEmbedded Android Workshop with Marshmallow
Embedded Android Workshop with Marshmallow
 

Recently uploaded

Applications of artificial Intelligence in Mechanical Engineering.pdf
Applications of artificial Intelligence in Mechanical Engineering.pdfApplications of artificial Intelligence in Mechanical Engineering.pdf
Applications of artificial Intelligence in Mechanical Engineering.pdf
Atif Razi
 
Material for memory and display system h
Material for memory and display system hMaterial for memory and display system h
Material for memory and display system h
gowrishankartb2005
 
Comparative analysis between traditional aquaponics and reconstructed aquapon...
Comparative analysis between traditional aquaponics and reconstructed aquapon...Comparative analysis between traditional aquaponics and reconstructed aquapon...
Comparative analysis between traditional aquaponics and reconstructed aquapon...
bijceesjournal
 
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
171ticu
 
Data Driven Maintenance | UReason Webinar
Data Driven Maintenance | UReason WebinarData Driven Maintenance | UReason Webinar
Data Driven Maintenance | UReason Webinar
UReason
 
integral complex analysis chapter 06 .pdf
integral complex analysis chapter 06 .pdfintegral complex analysis chapter 06 .pdf
integral complex analysis chapter 06 .pdf
gaafergoudaay7aga
 
CEC 352 - SATELLITE COMMUNICATION UNIT 1
CEC 352 - SATELLITE COMMUNICATION UNIT 1CEC 352 - SATELLITE COMMUNICATION UNIT 1
CEC 352 - SATELLITE COMMUNICATION UNIT 1
PKavitha10
 
People as resource Grade IX.pdf minimala
People as resource Grade IX.pdf minimalaPeople as resource Grade IX.pdf minimala
People as resource Grade IX.pdf minimala
riddhimaagrawal986
 
ITSM Integration with MuleSoft.pptx
ITSM  Integration with MuleSoft.pptxITSM  Integration with MuleSoft.pptx
ITSM Integration with MuleSoft.pptx
VANDANAMOHANGOUDA
 
Properties Railway Sleepers and Test.pptx
Properties Railway Sleepers and Test.pptxProperties Railway Sleepers and Test.pptx
Properties Railway Sleepers and Test.pptx
MDSABBIROJJAMANPAYEL
 
Welding Metallurgy Ferrous Materials.pdf
Welding Metallurgy Ferrous Materials.pdfWelding Metallurgy Ferrous Materials.pdf
Welding Metallurgy Ferrous Materials.pdf
AjmalKhan50578
 
Seminar on Distillation study-mafia.pptx
Seminar on Distillation study-mafia.pptxSeminar on Distillation study-mafia.pptx
Seminar on Distillation study-mafia.pptx
Madan Karki
 
132/33KV substation case study Presentation
132/33KV substation case study Presentation132/33KV substation case study Presentation
132/33KV substation case study Presentation
kandramariana6
 
Advanced control scheme of doubly fed induction generator for wind turbine us...
Advanced control scheme of doubly fed induction generator for wind turbine us...Advanced control scheme of doubly fed induction generator for wind turbine us...
Advanced control scheme of doubly fed induction generator for wind turbine us...
IJECEIAES
 
CompEx~Manual~1210 (2).pdf COMPEX GAS AND VAPOURS
CompEx~Manual~1210 (2).pdf COMPEX GAS AND VAPOURSCompEx~Manual~1210 (2).pdf COMPEX GAS AND VAPOURS
CompEx~Manual~1210 (2).pdf COMPEX GAS AND VAPOURS
RamonNovais6
 
Embedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoringEmbedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoring
IJECEIAES
 
Data Control Language.pptx Data Control Language.pptx
Data Control Language.pptx Data Control Language.pptxData Control Language.pptx Data Control Language.pptx
Data Control Language.pptx Data Control Language.pptx
ramrag33
 
Design and optimization of ion propulsion drone
Design and optimization of ion propulsion droneDesign and optimization of ion propulsion drone
Design and optimization of ion propulsion drone
bjmsejournal
 
cnn.pptx Convolutional neural network used for image classication
cnn.pptx Convolutional neural network used for image classicationcnn.pptx Convolutional neural network used for image classication
cnn.pptx Convolutional neural network used for image classication
SakkaravarthiShanmug
 
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.pptUnit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
KrishnaveniKrishnara1
 

Recently uploaded (20)

Applications of artificial Intelligence in Mechanical Engineering.pdf
Applications of artificial Intelligence in Mechanical Engineering.pdfApplications of artificial Intelligence in Mechanical Engineering.pdf
Applications of artificial Intelligence in Mechanical Engineering.pdf
 
Material for memory and display system h
Material for memory and display system hMaterial for memory and display system h
Material for memory and display system h
 
Comparative analysis between traditional aquaponics and reconstructed aquapon...
Comparative analysis between traditional aquaponics and reconstructed aquapon...Comparative analysis between traditional aquaponics and reconstructed aquapon...
Comparative analysis between traditional aquaponics and reconstructed aquapon...
 
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
 
Data Driven Maintenance | UReason Webinar
Data Driven Maintenance | UReason WebinarData Driven Maintenance | UReason Webinar
Data Driven Maintenance | UReason Webinar
 
integral complex analysis chapter 06 .pdf
integral complex analysis chapter 06 .pdfintegral complex analysis chapter 06 .pdf
integral complex analysis chapter 06 .pdf
 
CEC 352 - SATELLITE COMMUNICATION UNIT 1
CEC 352 - SATELLITE COMMUNICATION UNIT 1CEC 352 - SATELLITE COMMUNICATION UNIT 1
CEC 352 - SATELLITE COMMUNICATION UNIT 1
 
People as resource Grade IX.pdf minimala
People as resource Grade IX.pdf minimalaPeople as resource Grade IX.pdf minimala
People as resource Grade IX.pdf minimala
 
ITSM Integration with MuleSoft.pptx
ITSM  Integration with MuleSoft.pptxITSM  Integration with MuleSoft.pptx
ITSM Integration with MuleSoft.pptx
 
Properties Railway Sleepers and Test.pptx
Properties Railway Sleepers and Test.pptxProperties Railway Sleepers and Test.pptx
Properties Railway Sleepers and Test.pptx
 
Welding Metallurgy Ferrous Materials.pdf
Welding Metallurgy Ferrous Materials.pdfWelding Metallurgy Ferrous Materials.pdf
Welding Metallurgy Ferrous Materials.pdf
 
Seminar on Distillation study-mafia.pptx
Seminar on Distillation study-mafia.pptxSeminar on Distillation study-mafia.pptx
Seminar on Distillation study-mafia.pptx
 
132/33KV substation case study Presentation
132/33KV substation case study Presentation132/33KV substation case study Presentation
132/33KV substation case study Presentation
 
Advanced control scheme of doubly fed induction generator for wind turbine us...
Advanced control scheme of doubly fed induction generator for wind turbine us...Advanced control scheme of doubly fed induction generator for wind turbine us...
Advanced control scheme of doubly fed induction generator for wind turbine us...
 
CompEx~Manual~1210 (2).pdf COMPEX GAS AND VAPOURS
CompEx~Manual~1210 (2).pdf COMPEX GAS AND VAPOURSCompEx~Manual~1210 (2).pdf COMPEX GAS AND VAPOURS
CompEx~Manual~1210 (2).pdf COMPEX GAS AND VAPOURS
 
Embedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoringEmbedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoring
 
Data Control Language.pptx Data Control Language.pptx
Data Control Language.pptx Data Control Language.pptxData Control Language.pptx Data Control Language.pptx
Data Control Language.pptx Data Control Language.pptx
 
Design and optimization of ion propulsion drone
Design and optimization of ion propulsion droneDesign and optimization of ion propulsion drone
Design and optimization of ion propulsion drone
 
cnn.pptx Convolutional neural network used for image classication
cnn.pptx Convolutional neural network used for image classicationcnn.pptx Convolutional neural network used for image classication
cnn.pptx Convolutional neural network used for image classication
 
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.pptUnit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
 

iOS Internals Part -2

  • 2. @whoami ● Anto Joseph ● Works @ Citrix ● Does Security Research on Mobile / iOT and anything Interesting ● Speaker / Trainer @ HITB , HIP , NullCon, g0s, c0c0n, x0rconf etc ● Loves Music ( in my other life , i have been a DJ ) / Food / Bikes etc
  • 3. iOS 101 ● Objective C runtime ● Can be written in Objective C / Swift / Native Code ● CodeSigning is important ● Apps are zip file containers containing resources( images / plits) and the binary ● Binary if coming from apple has to be decrypted - use cluth / dump decrypted ● Use class-dump to find out the classes/ methods ● Use cycript to call those methods
  • 4. Dynamic Analysis ● URl Schemes - Ios way of doing IPC ● Clipboard - - Ios way of doing IPC ● Network - SSL Trust Killer 2 ● Binary Analysis - Hopper / IDa
  • 5. Enter Cycript Cycript allows developers to explore and modify running applications on either iOS or Mac OS X using a hybrid of Objective-C++ and JavaScript syntax through an interactive console that features syntax highlighting and tab completion.
  • 6. cy# - commands ● Find all classes ○ cy# ObjectiveC.classes ● Get Instance of a class ○ cy# var blah = new Instance(0x123456) ● Call Methods ○ cy# [classname method_name: arguments] ● Find a class in memory ○ cy# choose(ClassName)
  • 7. Demo Time ● Bypassing A Lock ● Making Changes to the SpringBoard