ineedcodes 1.6.1 → 1.7.0

package/skills/ios-pentesting-tricks/IOS_RUNTIME_TRICKS.md

@@ -0,0 +1,411 @@
+# iOS Runtime Tricks — Frida Recipes, Objection Reference & Hooking Patterns
+
+> **AI LOAD INSTRUCTION**: Load this when you need Frida recipes for iOS-specific hooks, Objection command reference, or runtime hooking pattern templates. Assumes the main [SKILL.md](./SKILL.md) is already loaded for general iOS testing methodology.
+
+---
+
+## 1. FRIDA RECIPES FOR iOS
+
+### 1.1 ObjC Class Enumeration
+
+```javascript
+// List all classes containing a keyword
+Java.perform || true;  // NOP for iOS
+ObjC.enumerateLoadedClasses({
+    onMatch: function(name) {
+        if (name.toLowerCase().indexOf('auth') !== -1 ||
+            name.toLowerCase().indexOf('login') !== -1 ||
+            name.toLowerCase().indexOf('token') !== -1) {
+            console.log('[Class] ' + name);
+        }
+    },
+    onComplete: function() { console.log('[+] Class enumeration done'); }
+});
+```
+
+### 1.2 Method Enumeration for a Class
+
+```javascript
+// List all methods of a specific class
+var className = 'AppDelegate';
+var methods = ObjC.classes[className].$ownMethods;
+console.log('[' + className + '] Methods (' + methods.length + '):');
+methods.forEach(function(method) {
+    console.log('  ' + method);
+});
+```
+
+### 1.3 Jailbreak Detection Bypass
+
+```javascript
+// Comprehensive jailbreak detection bypass for iOS
+var paths = [
+    '/Applications/Cydia.app', '/usr/sbin/sshd', '/bin/bash',
+    '/usr/bin/ssh', '/etc/apt', '/private/var/lib/apt/',
+    '/usr/local/bin/cycript', '/usr/lib/libcycript.dylib',
+    '/var/lib/cydia', '/var/cache/apt', '/var/lib/apt',
+    '/Library/MobileSubstrate/MobileSubstrate.dylib',
+    '/private/var/stash', '/.cydia_no_stash',
+    '/Applications/Sileo.app', '/var/jb'
+];
+
+// Hook NSFileManager
+var fm = ObjC.classes.NSFileManager;
+Interceptor.attach(fm['- fileExistsAtPath:'].implementation, {
+    onEnter: function(args) {
+        this.path = ObjC.Object(args[2]).toString();
+    },
+    onLeave: function(retval) {
+        for (var i = 0; i < paths.length; i++) {
+            if (this.path === paths[i]) {
+                retval.replace(ptr(0));
+                console.log('[JB Bypass] fileExistsAtPath blocked: ' + this.path);
+                return;
+            }
+        }
+    }
+});
+
+// Hook canOpenURL (Cydia URL scheme check)
+var app = ObjC.classes.UIApplication;
+Interceptor.attach(app['- canOpenURL:'].implementation, {
+    onEnter: function(args) {
+        this.url = ObjC.Object(args[2]).toString();
+    },
+    onLeave: function(retval) {
+        if (this.url.indexOf('cydia://') !== -1 ||
+            this.url.indexOf('sileo://') !== -1) {
+            retval.replace(ptr(0));
+            console.log('[JB Bypass] canOpenURL blocked: ' + this.url);
+        }
+    }
+});
+
+// Hook fopen for /etc/fstab, /bin/sh checks
+var fopen = Module.findExportByName(null, 'fopen');
+Interceptor.attach(fopen, {
+    onEnter: function(args) {
+        this.path = args[0].readUtf8String();
+    },
+    onLeave: function(retval) {
+        if (this.path === '/bin/sh' || this.path === '/etc/fstab' ||
+            this.path === '/bin/bash') {
+            retval.replace(ptr(0));
+        }
+    }
+});
+
+// Hook fork() — should return -1 on non-jailbroken
+var fork = Module.findExportByName(null, 'fork');
+Interceptor.attach(fork, {
+    onLeave: function(retval) {
+        retval.replace(ptr(-1));
+        console.log('[JB Bypass] fork() → -1');
+    }
+});
+
+console.log('[+] Jailbreak detection bypass installed');
+```
+
+### 1.4 SSL Pinning Bypass (iOS-Specific)
+
+```javascript
+// Hook SecTrustEvaluateWithError (iOS 12+)
+var SecTrustEvaluateWithError = Module.findExportByName('Security', 'SecTrustEvaluateWithError');
+if (SecTrustEvaluateWithError) {
+    Interceptor.attach(SecTrustEvaluateWithError, {
+        onLeave: function(retval) {
+            retval.replace(ptr(1));  // Return true (trusted)
+        }
+    });
+}
+
+// Hook SecTrustEvaluate (legacy)
+var SecTrustEvaluate = Module.findExportByName('Security', 'SecTrustEvaluate');
+if (SecTrustEvaluate) {
+    Interceptor.attach(SecTrustEvaluate, {
+        onLeave: function(retval) {
+            retval.replace(ptr(0));  // errSecSuccess
+        }
+    });
+}
+
+// Hook NSURLSession delegate for certificate validation
+var NSURLSession = ObjC.classes.NSURLSession;
+if (NSURLSession) {
+    try {
+        var handler = ObjC.classes.NSURLSessionConfiguration;
+        // Hook didReceiveChallenge completionHandler
+        Interceptor.attach(
+            ObjC.classes.__NSCFURLSessionConnection['- _]redirectRequest:withResponse:completionHandler:'].implementation, {
+            onEnter: function(args) {
+                console.log('[SSL] Redirect intercepted');
+            }
+        });
+    } catch(e) {}
+}
+
+console.log('[+] iOS SSL pinning bypass installed');
+```
+
+### 1.5 Keychain Dumper via Frida
+
+```javascript
+// Dump all keychain items accessible to the app
+function dumpKeychain() {
+    var NSMutableDictionary = ObjC.classes.NSMutableDictionary;
+    var SecItemCopyMatching = new NativeFunction(
+        Module.findExportByName('Security', 'SecItemCopyMatching'),
+        'int', ['pointer', 'pointer']
+    );
+
+    var classes = [
+        'genp',  // kSecClassGenericPassword
+        'inet',  // kSecClassInternetPassword
+        'cert',  // kSecClassCertificate
+        'keys'   // kSecClassKey
+    ];
+
+    classes.forEach(function(secClass) {
+        var query = NSMutableDictionary.alloc().init();
+        query.setObject_forKey_(secClass, 'class');
+        query.setObject_forKey_(ObjC.classes.__NSCFBoolean.numberWithBool_(true), 'r_Data');
+        query.setObject_forKey_('m_LimitAll', 'm_Limit');
+
+        var result = Memory.alloc(Process.pointerSize);
+        var status = SecItemCopyMatching(query.handle, result);
+
+        if (status === 0) {
+            var items = new ObjC.Object(result.readPointer());
+            console.log('\n[Keychain] Class: ' + secClass + ' (' + items.count() + ' items)');
+
+            for (var i = 0; i < items.count(); i++) {
+                var item = items.objectAtIndex_(i);
+                console.log('  Account: ' + item.objectForKey_('acct'));
+                console.log('  Service: ' + item.objectForKey_('svce'));
+                var data = item.objectForKey_('v_Data');
+                if (data) {
+                    try {
+                        var str = ObjC.classes.NSString.alloc().initWithData_encoding_(data, 4);
+                        console.log('  Data: ' + str);
+                    } catch(e) {
+                        console.log('  Data: <binary ' + data.length() + ' bytes>');
+                    }
+                }
+                console.log('  ---');
+            }
+        }
+    });
+}
+
+dumpKeychain();
+```
+
+---
+
+## 2. OBJECTION COMMAND REFERENCE FOR iOS
+
+### 2.1 Information Gathering
+
+| Command | Purpose |
+|---|---|
+| `ios info binary` | App binary info (PIE, canaries, ARC) |
+| `ios plist cat Info.plist` | Read Info.plist |
+| `ios bundles list_frameworks` | List loaded frameworks |
+| `ios bundles list_bundles` | List app bundles |
+| `env` | Show app sandbox paths |
+
+### 2.2 Security Bypass
+
+| Command | Purpose |
+|---|---|
+| `ios sslpinning disable` | Bypass SSL pinning |
+| `ios jailbreak disable` | Bypass jailbreak detection |
+| `ios jailbreak simulate` | Pretend device is jailbroken |
+
+### 2.3 Data Extraction
+
+| Command | Purpose |
+|---|---|
+| `ios keychain dump` | Dump keychain items |
+| `ios keychain dump --json` | Keychain as JSON |
+| `ios cookies get` | Extract cookies |
+| `ios nsuserdefaults get` | Read NSUserDefaults |
+| `ios pasteboard monitor` | Watch clipboard |
+
+### 2.4 Runtime Manipulation
+
+| Command | Purpose |
+|---|---|
+| `ios hooking list classes` | List ObjC classes |
+| `ios hooking search classes <pattern>` | Search classes |
+| `ios hooking list class_methods <class>` | List methods |
+| `ios hooking watch class <class>` | Watch all method calls |
+| `ios hooking watch method "<method>"` | Watch specific method |
+| `ios hooking set return_value "<method>" true` | Force return value |
+
+### 2.5 Filesystem
+
+| Command | Purpose |
+|---|---|
+| `ls` / `cd` / `pwd` | Navigate sandbox |
+| `file download <path>` | Download file to host |
+| `file upload <local> <remote>` | Upload file to device |
+| `sqlite connect <path>` | Open SQLite database |
+
+---
+
+## 3. RUNTIME HOOKING PATTERNS
+
+### 3.1 Return Value Modification
+
+```javascript
+// Force any boolean method to return true/false
+function hookBoolMethod(className, methodName, returnValue) {
+    var hook = ObjC.classes[className][methodName];
+    Interceptor.attach(hook.implementation, {
+        onLeave: function(retval) {
+            var newVal = returnValue ? ptr(1) : ptr(0);
+            retval.replace(newVal);
+            console.log('[Hook] ' + className + ' ' + methodName + ' → ' + returnValue);
+        }
+    });
+}
+
+// Examples
+hookBoolMethod('SecurityManager', '- isJailbroken', false);
+hookBoolMethod('AuthController', '- isSessionValid', true);
+hookBoolMethod('AppDelegate', '- shouldEnforceSSLPinning', false);
+```
+
+### 3.2 Argument Logging and Modification
+
+```javascript
+// Log and optionally modify method arguments
+var target = ObjC.classes.APIClient['- sendRequest:withToken:'];
+Interceptor.attach(target.implementation, {
+    onEnter: function(args) {
+        // args[0] = self, args[1] = _cmd, args[2+] = method args
+        var request = ObjC.Object(args[2]);
+        var token = ObjC.Object(args[3]);
+        console.log('[API] Request: ' + request.toString());
+        console.log('[API] Token: ' + token.toString());
+
+        // Modify argument: replace token
+        var newToken = ObjC.classes.NSString.stringWithString_('attacker_token');
+        args[3] = newToken.handle;
+    },
+    onLeave: function(retval) {
+        console.log('[API] Response: ' + ObjC.Object(retval).toString());
+    }
+});
+```
+
+### 3.3 Method Swizzling via Frida
+
+```javascript
+// Replace method implementation entirely
+var originalImpl = ObjC.classes.PaymentManager['- validateReceipt:'].implementation;
+
+ObjC.classes.PaymentManager['- validateReceipt:'].implementation = ObjC.implement(
+    ObjC.classes.PaymentManager['- validateReceipt:'], function(handle, selector, receipt) {
+        console.log('[Swizzle] validateReceipt called');
+        // Skip validation, return success
+        return ptr(1);
+    }
+);
+```
+
+### 3.4 Notification Observer
+
+```javascript
+// Monitor NSNotificationCenter for interesting events
+var nc = ObjC.classes.NSNotificationCenter;
+Interceptor.attach(nc['- postNotificationName:object:userInfo:'].implementation, {
+    onEnter: function(args) {
+        var name = ObjC.Object(args[2]).toString();
+        var userInfo = args[4].isNull() ? 'nil' : ObjC.Object(args[4]).toString();
+        if (name.indexOf('auth') !== -1 || name.indexOf('login') !== -1 ||
+            name.indexOf('token') !== -1 || name.indexOf('session') !== -1) {
+            console.log('[Notification] ' + name);
+            console.log('[Notification] userInfo: ' + userInfo);
+        }
+    }
+});
+```
+
+---
+
+## 4. COMMON iOS TESTING WORKFLOWS
+
+### 4.1 Quick Security Audit Flow
+
+```bash
+# Step 1: Get decrypted binary
+frida-ios-dump com.target.app   # or bagbak
+
+# Step 2: Static analysis
+class-dump decrypted_binary > headers.h
+grep -r "password\|secret\|token\|apikey\|isJailbroken" headers.h
+
+# Step 3: Check binary protections
+otool -hv decrypted_binary | grep PIE
+otool -Iv decrypted_binary | grep -c __stack_chk_guard
+
+# Step 4: Runtime testing with Objection
+objection -g com.target.app explore
+> ios keychain dump
+> ios nsuserdefaults get
+> ios sslpinning disable
+> ios jailbreak disable
+
+# Step 5: Traffic interception
+# Configure proxy (Burp/mitmproxy) + SSL bypass
+# Analyze API calls for auth issues, IDOR, etc.
+```
+
+### 4.2 Data Extraction Workflow
+
+```bash
+# 1. Connect to app
+objection -g com.target.app explore
+
+# 2. Enumerate data stores
+> env   # shows sandbox paths
+> ls Documents/
+> ls Library/
+> ls Library/Preferences/
+> ls Library/Application Support/
+
+# 3. Download interesting files
+> file download Library/Preferences/com.target.app.plist
+> file download Library/Application\ Support/data.sqlite
+
+# 4. Dump keychain
+> ios keychain dump --json > keychain.json
+
+# 5. Check cookies
+> ios cookies get
+
+# 6. Monitor pasteboard
+> ios pasteboard monitor
+```
+
+---
+
+## 5. iOS-SPECIFIC FRIDA QUICK REFERENCE
+
+| Task | Frida One-Liner |
+|---|---|
+| List processes | `frida-ps -U` |
+| Spawn app | `frida -U -f com.target.app` |
+| Attach to running | `frida -U com.target.app` |
+| List ObjC classes | `ObjC.enumerateLoadedClasses(callbacks)` |
+| Get class methods | `ObjC.classes.ClassName.$ownMethods` |
+| Hook method | `Interceptor.attach(ObjC.classes.X['- method'].implementation, {...})` |
+| Replace method | `ObjC.classes.X['- method'].implementation = ObjC.implement(...)` |
+| Call method | `ObjC.classes.X.alloc().init().method()` |
+| Read string arg | `ObjC.Object(args[2]).toString()` |
+| Find instances | `ObjC.choose(ObjC.classes.ClassName, {onMatch: ...})` |
+| Read memory | `Memory.readUtf8String(ptr)` |
+| Find export | `Module.findExportByName('Security', 'SecTrustEvaluate')` |