deardaniel/secdata-raw huggingface dataset:
OWASP Mobile Application Security Testing Guide: MASTG TECH 0085

---
title: Execution Tracing
platform: ios
---

Tracing involves recording the information about a program's execution. In contrast to Android, iOS offers limited options for tracing various aspects of an iOS app. In this section, we will rely heavily on tools such as Frida for tracing.

TODO: This needs to be improved as well
OWASP Mobile Application Security Testing Guide: MASTG TECH 0098

---
title: Patching React Native Apps
platform: ios
---

If the [React Native](https://facebook.github.io/react-native "React Native") framework has been used for development, the main application code is in the file `Payload/[APP].app/main.jsbundle`. This file contains the JavaScript code. Most of the time, the JavaScript code in this file is minified. With the tool [JStillery](https://mindedsecurity.github.io/jstillery "JStillery"), a human-readable version of the file can be retrieved, enabling code analysis. The [CLI version of JStillery](https://github.com/mindedsecurity/jstillery/ "CLI version of JStillery") and the local server are preferable to the online version because the latter discloses the source code to a third party.

During installation, the application archive is unpacked into the folder `/private/var/containers/Bundle/Application/[GUID]/[APP].app` starting with iOS 10, so the main JavaScript application file can be modified at this location.

To identify the exact location of the application folder, you can use @MASTG-TOOL-0138:

1. Use the command `ipainstaller -l` to list the applications installed on the device. Extract the target application name from the output list.
2. Use the command `ipainstaller -i [APP_NAME]` to display information about the target application, including the installation and data folder locations.
3. Take the path referenced at the line that starts with `Application:`.

Use the following approach to patch the JavaScript file:

1. Navigate to the application folder.
2. Copy the contents of the file `Payload/[APP].app/main.jsbundle` to a temporary file.
3. Use `JStillery` to beautify and de-obfuscate the contents of the temporary file.
4. Identify the code in the temporary file that should be patched and patch it.
5. Put the _patched code_ on a single line and copy it into the original `Payload/[APP].app/main.jsbundle` file.
6. Close and restart the application.
OWASP Mobile Application Security Testing Guide: MASTG TECH 0080

---
title: Get Open Files
platform: ios
---

`lsof` is a powerful command that provides a wealth of information about running processes. It can provide a list of all open files, including streams, network files, and regular files. When invoking the `lsof` command without any option, it will list all open files belonging to all active processes on the system, while when invoking with the flags `-c <process name>` or `-p <pid>`, it returns the list of open files for the specified process. The [man page](http://man7.org/linux/man-pages/man8/lsof.8.html "Man Page of lsof") details additional options.

Using `lsof` for an iOS application running with PID 2828, list various open files as shown below.

```bash
iPhone:~ root# lsof -p 2828
COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
iOweApp 2828 mobile  cwd    DIR    1,2      864      2 /
iOweApp 2828 mobile  txt    REG    1,3  [PII_REDACTED]74 /private/var/containers/Bundle/Application/F390A491-3524-40EA-B3F8-6C1FA105A23A/iOweApp.app/iOweApp
iOweApp 2828 mobile  txt    REG    1,3     5492 213230 /private/var/mobile/Containers/Data/Application/5AB3E437-9E2D-4F04-BD2B-972F6055699E/tmp/com.apple.dyld/iOweApp-6346DC276FE6865055F1194368EC73CC72E4C5224537F7F23DF19314CF6FD8AA.closure
iOweApp 2828 mobile  txt    REG    1,3    30628 212198 /private/var/preferences/Logging/.plist-cache.vqXhr1EE
iOweApp 2828 mobile  txt    REG    1,2    50080 234433 /usr/lib/libobjc-trampolines.dylib
iOweApp 2828 mobile  txt    REG    1,2   344204  74185 /System/Library/Fonts/AppFonts/ChalkboardSE.ttc
iOweApp 2828 mobile  txt    REG    1,2  [PII_REDACTED]95 /usr/lib/dyld
...
```
OWASP Mobile Application Security Testing Guide: MASTG TECH 0135

---
title: Bypassing Biometric Authentication
platform: ios
---

This technique can typically be used to bypass biometric authentication in apps that perform it by only returning a _success_ or _failure_ result (e.g., `if authenticated {...}` check) **instead of using the [`SecAccessControlCreateWithFlags`](https://developer.apple.com/documentation/security/secaccesscontrolcreatewithflags(_:_:_:_:)) Keychain API and requiring user presence**.

## Method for Jailbroken and Non-jailbroken Devices

If you have a jailbroken device with frida-server installed, you can bypass biometric authentication by running @MASTG-TOOL-0038 with the `ios ui biometrics_bypass` command:

```bash
objection -n "MASTestApp" start
ios ui biometrics_bypass
```

See the sample output below for using this technique against the @MASTG-DEMO-0042 demo app.

<img src="Images/Techniques/0119-ObjectionBiometricsBypass.png" width="90%" />
<img src="Images/Techniques/0119-ObjectionBiometricsBypassScreenshot.png" width="30%" />

## Method for Non-jailbroken Devices

@MASTG-TOOL-0038 cannot attach to apps on non-jailbroken devices unless the app has been repackaged with the `get-task-allow` flag. @MASTG-TECH-0084 describes how to re-sign an app with this flag. After re-signing, you can use the same method as with jailbroken devices.
OWASP Mobile Application Security Testing Guide: MASTG TECH 0069

---
title: Decompiling Native Code
platform: ios
---

TODO. Hopper is only mentioned once in the entire document, ghidra is only used for disassembly, ... We can expand this, maybe add some good ghidra snippets for Objective-C mapping, ...
OWASP Mobile Application Security Testing Guide: MASTG TECH 0074

---
title: Information Gathering - Network Communication
platform: ios
---

Most of the apps you might encounter connect to remote endpoints. Even before you perform any dynamic analysis (e.g., traffic capture and analysis), you can obtain some initial inputs or entry points by enumerating the domains to which the application is supposed to communicate.

Typically, these domains are stored as strings in the application's binary. One can extract domains by retrieving strings (as discussed above) or by checking them with tools like Ghidra. The latter option has a clear advantage: it provides context, as you can see which context each domain is used in by checking the cross-references.

From here on, you can use this information to derive more insights that might be of use later during your analysis, e.g., you could match the domains to the pinned certificates or perform further reconnaissance on domain names to know more about the target environment.

Implementing and verifying secure connections can be an intricate process, with many factors to consider. For instance, many applications use protocols other than HTTP, such as XMPP or plain TCP, or perform certificate pinning to deter MITM attacks.

Remember that, in most cases, relying solely on static analysis is not enough and can be highly inefficient compared with dynamic alternatives, which often yield more reliable results (e.g., by using an interception proxy). In this section, we've only scratched the surface. Please refer to @MASTG-TECH-0062 in the "iOS Basic Security Testing" chapter and review the test cases in the "[iOS Network Communication](../../Document/0x06g-Testing-Network-Communication.md)" chapter for further information.
OWASP Mobile Application Security Testing Guide: MASTG TECH 0087

---
title: Native Code Tracing
platform: ios
---

As discussed earlier in this chapter, iOS applications can also contain native code (C/C++) that can be traced with the `frida-trace` CLI. For example, you can trace calls to the `open` function by running the following command:

```bash
frida-trace -U -i "open" sg.vp.UnCrackable1
```

The overall approach and further improvements for tracing native code using Frida are similar to those discussed in @MASTG-TECH-0034.

Unfortunately, there are no tools such as `strace` or `ftrace` available to trace syscalls or function calls of an iOS app. Only `DTrace` exists, a powerful and versatile tracing tool, but it's available only on macOS, not on iOS.
OWASP Mobile Application Security Testing Guide: MASTG TECH 0113

---
title: Obtaining Debugging Symbols
platform: ios
---

To retrieve debug symbols from iOS binaries, you can use @MASTG-TOOL-0073, @MASTG-TOOL-0121, or @MASTG-TOOL-0041 to inspect all the app binaries.

## radare2

Using @MASTG-TOOL-0073 with the command `is`:

```bash
r2 -A MASTestApp
[0x100007408]> is~Sec
70  0x00007894 0x100007894 LOCAL  FUNC 0        imp.SecKeyCopyExternalRepresentation
71  0x000078a0 0x1000078a0 LOCAL  FUNC 0        imp.SecKeyCopyPublicKey
72  0x000078ac 0x1000078ac LOCAL  FUNC 0        imp.SecKeyCreateRandomKey
73  0x000078b8 0x1000078b8 LOCAL  FUNC 0        imp.SecKeyCreateSignature
74  0x000078c4 0x1000078c4 LOCAL  FUNC 0        imp.SecKeyVerifySignature
```

Alternatively, you can use @MASTG-TOOL-0129 to [obtain the symbols](https://book.rada.re/tools/rabin2/symbols.html) by running `rabin2 -s MASTestApp`.

## objdump

The following snippet shows how you can apply @MASTG-TOOL-0121 on `MASTestApp` (the iOS main app executable) with the typical output of a binary containing debug symbols. Those are marked with the `d` (debug) flag. Check the [objdump man page](https://www.unix.com/man-page/osx/1/objdump/ "objdump man page") for information about various other symbol flag characters.

```bash
$ objdump --syms MASTestApp | grep " d " | grep "swift"
...
[PII_REDACTED]      d  *UND* MastgTest.swift
[PII_REDACTED]      d  *UND* __swift_FORCE_LOAD_$_swiftFoundation_$_MASTestApp
[PII_REDACTED]      d  *UND* __swift_FORCE_LOAD_$_swiftObjectiveC_$_MASTestApp
[PII_REDACTED]      d  *UND* __swift_FORCE_LOAD_$_swiftDarwin_$_MASTestApp
[PII_REDACTED]      d  *UND* __swift_FORCE_LOAD_$_swiftCoreFoundation_$_MASTestApp
...
```

## nm

With @MASTG-TOOL-0041, you can compare the symbols from a plain call to `nm` with the output of a call to `nm -a`. The latter also prints the debug symbols. The following command will show only debug symbols in a diff format. If this is empty, now debug symbols are present.

```bash
$ diff <(nm MASTestApp) <(nm -a MASTestApp)
...
28a228
> [PII_REDACTED] - 01 0000   FUN _$s10MASTestApp11ContentViewV7SwiftUI0D0AadEP05_makeD4List4view6inputsAD01_dH7OutputsVAD11_GraphValueVyxG_AD01_dH6InputsVtFZTW
30a231
>[PII_REDACTED]00992c - 01 0000   FUN _$s10MASTestApp11ContentViewV7SwiftUI0D0AadEP14_viewListCount6inputsSiSgAD01_dhI6InputsV_tFZTW
31a233,234
> [PII_REDACTED] - 01 0000   FUN _$s10MASTestApp11ContentViewV7SwiftUI0D0AadEP4body4BodyQzvgTW
> [PII_REDACTED] - 00 0000  GSYM _$s10MASTestApp11ContentViewVAC7SwiftUI0D0AAWL
32a236
>[PII_REDACTED]00a220 - 01 0000   FUN _$s10MASTestApp11ContentViewVAC7SwiftUI0D0AAWl
...
```
OWASP Mobile Application Security Testing Guide: MASTG TECH 0066

---
title: Static Analysis on iOS
platform: ios
---

The preferred method for statically analyzing iOS apps is to use the original Xcode project files. Ideally, you can compile and debug the app to quickly identify potential issues in the source code.

Black box analysis of iOS apps without access to the source code requires @MASTG-TECH-0065. For example, no decompilers are available for iOS apps (although most commercial and open-source disassemblers can provide a pseudo-source code view of the binary). Hence, a deep inspection requires you to read assembly code.
OWASP Mobile Application Security Testing Guide: MASTG TECH 0078

---
title: Automated Static Analysis
platform: ios
---

Several automated tools for analyzing iOS apps are available; most are commercial. The free and open-source tools @MASTG-TOOL-0035 and @MASTG-TOOL-0038 provide static and dynamic analysis functionality. Additional tools are on the ["Testing Tools"](../../tools/index.md) page.

Don't shy away from using automated scanners for your analysis - they help you pick low-hanging fruit and allow you to focus on the more interesting aspects of analysis, such as the business logic. Keep in mind that static analyzers may produce false positives and false negatives; always review the findings carefully.
OWASP Mobile Application Security Testing Guide: MASTG TECH 0146

---
title: Dynamic Analysis on Non-Jailbroken Devices
platform: ios
---

If you do not have a jailbroken test device, you can still perform dynamic analysis on a non-jailbroken iOS device by patching and repackaging the target app to load a dynamic library at startup, such as the Frida Gadget. This enables runtime instrumentation with tools like Frida or objection while remaining inside the standard iOS sandbox. However, this approach requires a non-encrypted app binary. If the app was obtained from the App Store, you must first decrypt it, which **requires temporary access to a jailbroken device**. If you already have a non-encrypted IPA, for example from a development, enterprise, or self-built project, no jailbreak is required at any stage.

!!! note "Using the iOS Simulator"
    For researchers and learners, the iOS Simulator is often the simplest starting point for testing apps you build and sign yourself, as you cannot install an IPA retrieved from the App Store. Apps running in the Simulator are not FairPlay-encrypted and are not subject to the same code-signing and runtime restrictions as physical devices. You can attach Frida directly to the process without using the Frida Gadget, without patching the binary, and without re-signing the app. This makes the Simulator ideal for experimentation, scripting, and learning dynamic analysis techniques before moving to real-device testing. Keep in mind that the Simulator does not perfectly replicate real-device behavior, especially for hardware-backed features such as Secure Enclave, biometrics, keychain protection classes, push notifications, and certain anti-debugging or jailbreak-detection checks.

The following sections walk through each step of the process for App Store apps:

## Step 1: Obtain the IPA

Follow @MASTG-TECH-0054 to obtain the IPA file for the app you want to test and ensure you obtain a **non-encrypted version before proceeding** (you'll need a jailbroken device).

## Step 2: Obtain a Developer Provisioning Profile

Follow @MASTG-TECH-0079 to create a signing identity and obtain a valid provisioning profile. You'll need this to sign the repackaged IPA so iOS allows it to run on your device.

## Step 3: Inject the Frida Gadget

Follow @MASTG-TECH-0090 to patch the IPA and inject the Frida Gadget library. Tools such as @MASTG-TOOL-0118 and @MASTG-TOOL-0038 can automate most of this process.

## Step 4: Sign the IPA

Follow @MASTG-TECH-0092 to re-sign the patched IPA using the provisioning profile and signing identity from Step 2.

## Step 5: Install the App

Follow @MASTG-TECH-0056 to install the signed IPA on your device. Note that because you've modified the IPA, the Bundle Identifier may have changed depending on the signing tool you used.

## Step 6: Launch the App in Debug Mode

Follow @MASTG-TECH-0055 to launch the repackaged app in debug mode. Launching via SpringBoard will cause it to crash; you must use the debug launch method so the Frida Gadget can start and wait for your connection.
OWASP Mobile Application Security Testing Guide: MASTG TECH 0118

---
title: Obtaining Compiler-Provided Security Features
platform: ios
---

The iOS compiler provides several security features that can be enabled during compilation (see @MASTG-KNOW-0061). These features help protect the application against common vulnerabilities such as buffer overflows and memory leaks. This technique guides how to check if these features are enabled in the compiled binary.

## @MASTG-TOOL-0073

In radare2, the presence of these compiler-provided security features can be checked by using the `i` and `is` commands.

**Check for PIC and Canaries:** Using the `i` command, you can check if the binary has Position Independent Code (PIC) enabled (`pic`) and if it has stack canaries (`canary`).

```sh
r2 MASTestApp
[0x100007408]> i~canary,pic
canary   true
pic      true
```

The output shows that the binary has stack canaries and PIE enabled.

**Check for ARC:** Using the `is` command, you can list the symbols in the binary and check for symbols that indicate the usage of Automatic Reference Counting (ARC). Common ARC symbols include:

- `objc_autorelease`
- `objc_retainAutorelease`
- `objc_release`
- `objc_retain`
- `objc_retainAutoreleasedReturnValue`
- `swift_release`
- `swift_retain`

An iOS binary does not need to have all of these symbols to be considered ARC-enabled, but the presence of some of them indicates that ARC is used.

```sh
[0x100007408]> is~release,retain
80  0x0000790c 0x10000790c LOCAL  FUNC 0        imp.objc_release_x20
81  0x00007918 0x100007918 LOCAL  FUNC 0        imp.objc_release_x24
82  0x00007924 0x100007924 LOCAL  FUNC 0        imp.objc_release_x25
83  0x00007930 0x100007930 LOCAL  FUNC 0        imp.objc_release_x27
84  0x0000793c 0x10000793c LOCAL  FUNC 0        imp.objc_release_x8
85  0x00007948 0x100007948 LOCAL  FUNC 0        imp.objc_retainAutoreleasedReturnValue
86  0x00007954 0x100007954 LOCAL  FUNC 0        imp.objc_retain_x23
101 0x00007a08 0x100007a08 LOCAL  FUNC 0        imp.swift_release
102 0x00007a14 0x100007a14 LOCAL  FUNC 0        imp.swift_retain
```

The output shows that the binary contains symbols indicating ARC usage.

## @MASTG-TOOL-0074

Objection has a command `ios info binary` which can be used to get information about the binary, including whether stack canaries and PIE are enabled.

```sh
com.yourcompany.PPClient on (iPhone: 13.2.3) [usb] # ios info binary
Name                  Type     Encrypted    PIE    ARC    Canary    Stack Exec    RootSafe
--------------------  -------  -----------  -----  -----  --------  ------------  ----------
PayPal                execute  True         True   True   True      False         False
CardinalMobile        dylib    False        False  True   True      False         False
FraudForce            dylib    False        False  True   True      False         False
...
```

The output shows `PIE`, `ARC`, and `Canary` with a value of `True` or `False`.
OWASP Mobile Application Security Testing Guide: MASTG TECH 0094

---
title: Getting Loaded Classes and Methods dynamically
platform: ios
---

In the Frida REPL Objective-C runtime, the `ObjC` command can be used to access information within the running app. Within the `ObjC` command, the function `enumerateLoadedClasses` lists the loaded classes for a given application.

```bash
$ frida -U -f com.iOweApp

[iPhone::com.iOweApp]-> ObjC.enumerateLoadedClasses()
{
    "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation": [
        "__NSBlockVariable__",
        "__NSGlobalBlock__",
        "__NSFinalizingBlock__",
        "__NSAutoBlock__",
        "__NSMallocBlock__",
        "__NSStackBlock__"
    ],
    "/private/var/containers/Bundle/Application/F390A491-3524-40EA-B3F8-6C1FA105A23A/iOweApp.app/iOweApp": [
        "JailbreakDetection",
        "CriticalLogic",
        "ViewController",
        "AppDelegate"
    ]
}

```

Using `ObjC.classes.<classname>.$ownMethods`, the methods declared in each class can be listed.

```bash
[iPhone::com.iOweApp]-> ObjC.classes.JailbreakDetection.$ownMethods
[
    "+ isJailbroken"
]

[iPhone::com.iOweApp]-> ObjC.classes.CriticalLogic.$ownMethods
[
    "+ doSha256:",
    "- a:",
    "- AES128Operation:data:key:iv:",
    "- coreLogic",
    "- bat",
    "- b:",
    "- hexString:"
]
```
OWASP Mobile Application Security Testing Guide: MASTG TECH 0073

---
title: Information Gathering - API Usage
platform: ios
---

The iOS platform provides many built-in libraries for common application functionality, including cryptography, Bluetooth, NFC, networking, and location services. Determining whether these libraries are present in an application can provide valuable insight into its underlying logic.

For instance, if an application imports the `CC_SHA256` function, it indicates that the application will perform a SHA-256 hash. Further information on analyzing iOS's cryptographic APIs is provided in the section "[iOS Cryptographic APIs](../../Document/0x06e-Testing-Cryptography.md "iOS Cryptographic APIs")".

Similarly, the approach above can be used to determine where and how an application uses Bluetooth. For instance, an application that communicates over the Bluetooth channel must use functions from the Core Bluetooth framework, such as `CBCentralManager` or `connect`. Using the [iOS Bluetooth documentation](https://developer.apple.com/documentation/corebluetooth "iOS Bluetooth documentation"), you can identify the critical functions and begin analysis from their import dependencies.
OWASP Mobile Application Security Testing Guide: MASTG TECH 0062

---
title: Basic Network Monitoring/Sniffing
platform: ios
---

You can remotely sniff all traffic in real-time on iOS by [creating a Remote Virtual Interface](https://stackoverflow.com/questions/9555403/capturing-mobile-phone-traffic-on-wireshark/33175819#33175819 "Wireshark + OSX + iOS") for your iOS device. First, ensure @MASTG-TOOL-0081 is installed on your macOS host computer.

1. Connect your iOS device to your macOS host computer via USB.
2. You would need to know the UDID of your iOS device before you can start sniffing. Check the section ["Obtaining the UDID of an iOS device"](../../Document/0x06b-iOS-Security-Testing.md#obtaining-the-udid-of-an-ios-device) on how to retrieve it. Open the Terminal on macOS and run the following command, replacing the UDID with your iOS device's UDID.

```bash
$ rvictl -s <UDID>
Starting device <UDID> [SUCCEEDED] with interface rvi0
```

1. Launch Wireshark and select "rvi0" as the capture interface.
2. Filter the traffic with Capture Filters in Wireshark to display what you want to monitor (for example, all HTTP traffic sent/received via the IP address 192.168.1.1).

```default
ip.addr == 192.168.1.1 && http
```

<img src="Images/Chapters/0x06b/wireshark_filters.png" width="100%" />

The documentation of Wireshark offers many examples for [Capture Filters](https://wiki.wireshark.org/CaptureFilters "Capture Filters") that should help you to filter the traffic to get the information you want.