OWASP Mobile Application Security Testing Guide: MASTG TECH 0096

---
title: Process Exploration
platform: ios
---

When testing an app, process exploration can provide the tester with deep insights into the app's process memory. It can be achieved via runtime instrumentation and allows performing tasks such as:

- Retrieving the memory map and loaded libraries.
- Searching for occurrences of specific data.
- After searching, get the location of a particular offset in the memory map.
- Performing a memory dump and inspecting or reverse engineering the binary data _offline_.
- Reverse engineering a binary or Framework while it's running.

As you can see, these tasks are somewhat supportive and/or passive. They'll help us collect data and information that will support other techniques. Therefore, they're typically used alongside other techniques, such as method hooking.

In the following sections, you will use @MASTG-TOOL-0036 to retrieve information directly from the app runtime. First, start by opening an r2frida session to the target app (e.g. @MASTG-APP-0028) that should be running on your iPhone (connected via USB). Use the following command:

```bash
r2 frida://usb//iGoat-Swift
```

## Memory Maps and Inspection

You can retrieve the app's memory maps by running `:dm`:

```bash
[0x00000000]> :dm
0x[PII_REDACTED]b7c000 - 0x[PII_REDACTED]de0000 r-x /private/var/containers/Bundle/Application/3ADAF47D-A734-49FA-B274-FBCA66589E67/iGoat-Swift.app/iGoat-Swift
0x[PII_REDACTED]de0000 - 0x[PII_REDACTED]e68000 rw- /private/var/containers/Bundle/Application/3ADAF47D-A734-49FA-B274-FBCA66589E67/iGoat-Swift.app/iGoat-Swift
0x[PII_REDACTED]e68000 - 0x[PII_REDACTED]e97000 r-- /private/var/containers/Bundle/Application/3ADAF47D-A734-49FA-B274-FBCA66589E67/iGoat-Swift.app/iGoat-Swift
...
0x[PII_REDACTED]ea8000 - 0x[PII_REDACTED]eb0000 rw-
0x[PII_REDACTED]eb0000 - 0x[PII_REDACTED]eb4000 r--
0x[PII_REDACTED]eb4000 - 0x[PII_REDACTED]eb8000 r-x /usr/lib/TweakInject.dylib
0x[PII_REDACTED]eb8000 - 0x[PII_REDACTED]ebc000 rw- /usr/lib/TweakInject.dylib
0x[PII_REDACTED]ebc000 - 0x[PII_REDACTED]ec0000 r-- /usr/lib/TweakInject.dylib
0x[PII_REDACTED]f60000 - 0x[PII_REDACTED]2dc000 r-x /private/var/containers/Bundle/Application/3ADAF47D-A734-49FA-B274-FBCA66589E67/iGoat-Swift.app/Frameworks/Realm.framework/Realm
```

While you're searching or exploring the app memory, you can always verify your current offset in the memory map. Instead of noting and searching for the memory address in this list, you can run `:dm`. You'll find an example in the section titled "In-Memory Search".

If you're only interested in the modules (binaries and libraries) that the app has loaded, you can use the command `:il` to list them all:

```bash
[0x00000000]> :il
0x[PII_REDACTED]b7c000 iGoat-Swift
0x[PII_REDACTED]eb4000 TweakInject.dylib
0x[PII_REDACTED]2c0000 SystemConfiguration
0x[PII_REDACTED]7c0000 libc++.1.dylib
0x[PII_REDACTED]ed9000 Foundation
0x[PII_REDACTED]83c000 libobjc.A.dylib
0x[PII_REDACTED]7be000 libSystem.B.dylib
0x[PII_REDACTED]b77000 CFNetwork
0x[PII_REDACTED]d64000 CoreData
0x[PII_REDACTED]4b4000 CoreFoundation
0x[PII_REDACTED]1d3000 Security
0x000000018ea1d000 UIKit
0x[PII_REDACTED]f60000 Realm
```

As you might expect, you can correlate the addresses of the libraries with the memory maps: e.g., the main app from @MASTG-APP-0028 is called "iGoat-Swift" and is located at `0x[PII_REDACTED]b7c000`, and the Realm Framework at `0x[PII_REDACTED]f60000`.

You can also use @MASTG-TOOL-0074 to display the same information.

```bash
$ objection -n OWASP.iGoat-Swift start

OWASP.iGoat-Swift on (iPhone: 11.1.2) [usb] # memory list modules
Save the output by adding `--json modules.json` to this command

Name                              Base         Size                  Path
--------------------------------  -----------  --------------------  ------------------------------------------------------------------------------
iGoat-Swift                       0x100b7c000  2506752 (2.4 MiB)     /var/containers/Bundle/Application/3ADAF47D-A734-49FA-B274-FBCA66589E67/iGo...
TweakInject.dylib                 0x100eb4000  16384 (16.0 KiB)      /usr/lib/TweakInject.dylib
SystemConfiguration               0x1862c0000  446464 (436.0 KiB)    /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguratio...
libc++.1.dylib                    0x1847c0000  368640 (360.0 KiB)    /usr/lib/libc++.1.dylib
```

## In-Memory Search

In-memory search is a valuable technique for detecting sensitive data in the app's memory.

See r2frida's help on the search command (`:/?`) to learn about the search command and get a list of options. The following shows only a subset of them:

```bash
[0x00000000]> :/?
 /      search
 /j     search json
 /w     search wide
 /wj    search wide json
 /x     search hex
 /xj    search hex json
...
```

You can adjust your search by using the search settings `:e~search`. For example, `:e search.quiet=true;` will print only the results and hide search progress:

```bash
[0x00000000]> :e~search
e search.in=perm:r--
e search.quiet=false
```

For now, we'll keep the defaults and focus on string search. In this first example, you can start by searching for something that you know should be located in the main binary of the app (for example, the name of the @MASTG-APP-0028 app):

```bash
[0x00000000]> :/ iGoat
Searching 5 bytes: 69 47 6f 61 74
Searching 5 bytes in [0x[PII_REDACTED]b7c000-0x[PII_REDACTED]de0000]
...
hits: 509
0x100d7d332 hit2_0 iGoat_Swift24StringAnalysisExerciseVCC
0x100d7d3b2 hit2_1 iGoat_Swift28BrokenCryptographyExerciseVCC
0x100d7d442 hit2_2 iGoat_Swift23BackgroundingExerciseVCC
0x100d7d4b2 hit2_3 iGoat_Swift9AboutCellC
0x100d7d522 hit2_4 iGoat_Swift12FadeAnimatorV
```

Now take the first hit, seek it, and check your current location in the memory map:

```bash
[0x00000000]> s 0x100d7d332
[0x100d7d332]> :dm.
0x[PII_REDACTED]b7c000 - 0x[PII_REDACTED]de0000 r-x /private/var/containers/Bundle/Application/3ADAF47D-A734-49FA-B274-FBCA66589E67/iGoat-Swift.app/iGoat-Swift
```

As expected, you are located in the region of the main iGoat-Swift binary (r-x, read and execute). In the previous section, you saw that the main binary is located between `0x[PII_REDACTED]b7c000` and `0x[PII_REDACTED]e97000`.

Now, for this second example, you can search for something that's not in the app binary nor in any loaded library, typically user input. Open the @MASTG-APP-0028 app and navigate in the menu to **Authentication** -> **Remote Authentication** -> **Start**. There you'll find a password field that you can overwrite. Write the string "owasp-mstg" but do not click on **Login** just yet. Perform the following two steps.

```bash
[0x00000000]> :/ owasp-mstg
hits: 1
0x1c06619c0 hit3_0 owasp-mstg
```

In fact, the string could be found at address `0x1c06619c0`. Seek `s` to there and retrieve the current memory region with `:dm.`.

```bash
[0x100d7d332]> s 0x1c06619c0
[0x1c06619c0]> :dm.
0x00000001c0000000 - 0x00000001c8000000 rw-
```

Now you know that the string is located in an rw- (read and write) region of the memory map.

Additionally, you can search for occurrences of the [wide version of the string](https:/