Originally presented April 4, 2020 @ VirSecCon2020

1. © Copyright 2019 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.© Copyright 2019 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
iOS recon with r2
Dawn Isabel
Mobile Security Research Engineer

2. © Copyright 2019 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
▪ Portable reverse engineering framework
▪ Assemble / disassemble
▪ Analyze and emulate code
▪ Native debugger
▪ Various interactive modes
▪ Control-flow graphs
▪ Automate your mobile app static analysis
2
What is radare2, and why use it?

3. © Copyright 2019 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
▪ Apps are packaged in a zip file
▪ Native binaries will be
▪ Objective-C
▪ Swift
▪ C, C++
▪ Analysis and emulation makes our job easier!
▪ aar - Analyze opcode absolute and relative references
▪ aae - Emulate code to identify new pointer references
▪ aao - Analyze all objc references
▪ e emu.str=true – Enable string emulation
3
iOS binary basics

4. © Copyright 2019 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
Why use multiple tools?
▪ i – Binary information
▪ il – List libraries
▪ ic / icc – Examine and dump classes
▪ izz – Dump and search strings
4
Gathering basic app info

5. © Copyright 2019 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
▪ Objective-C methods are invoked using message-passing
▪ objc_msgSend
▪ arg0: class or instance receiving the message
▪ arg1: method name / “selector”
▪ arg2…argN: method arguments
▪ Finding cross-references to methods requires looking for the
selector string, not the address of the method implementation
5
Finding method cross-references

6. © Copyright 2019 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
▪ izz~ / izzq~ - Search for a string
▪ axt – Find cross-references (xrefs) to an address
▪ s – Seek to address
▪ n / N - Jump next / previous flag
▪ df – Define function
▪ pdsf – Print disassemble summary for function
6
Simple Workflow – finding functions and references

7. © Copyright 2019 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
▪ _ - Search using HUD
▪ x – Find xrefs to/from data
▪ u / U – Undo / redo seek
▪ p – change view
▪ V – Graph mode!
7
Getting fancy - visual mode

8. © Copyright 2019 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
▪ Recon can be easily automated using python and r2pipe
import r2pipe
r2 = r2pipe.open("ipa://decrypted-app.ipa")
print("[*] Dumping classes...")
r2.cmd('icc > classdump.txt')
print("[*] Dumping strings...")
r2.cmd("izz > strings.txt")
8
Automation with r2pipe

9. © Copyright 2019 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
▪ https://rada.re/n/
▪ https://radare.gitbooks.io/radare2book/
▪ https://www.youtube.com/results?search_query=r2con
▪ https://github.com/prateek147/DVIA
Dawn Isabel (she/her)
@dawnisabel
9
Happy hacking!