Save 37% off PRO during our Black Friday Sale! »

Reverse Engineering iOS Apps

Reverse Engineering iOS Apps

Talk given at Swift Language User Group in SF on 20 August 2015

If you've ever needed to know how another piece of code works, or if you've ever been at the mercy of someone else's bugs – you can always look at the source code... unless you don't have it. I'll be giving an introduction to the art of reverse engineering on iOS and OS X, including Swift apps. I'll be cover sniffing network traffic as well as static and dynamic analysis, with tools like Charles, cycript, IDA, Hopper and class-dump.

Be3c4afff919b2b70348c97cb494600a?s=128

Conrad Kramer

August 20, 2015
Tweet

Transcript

  1. Reverse Engineering iOS Apps with Swi' Conrad Kramer @conradev

  2. Reverse Engineering Analyzing out how something works by examining the

    final product.
  3. Opera&ng the tools Knowing what to look for

  4. Frame the ques,on Why does this bug occur? What component

    do they use in their UI? What does the app's REST API look like?
  5. Test Subject: Ly# (Wri%en en)rely in Swy.)

  6. Ques%ons What does Ly,'s REST API look like? How does

    Ly*'s URL scheme work?
  7. What is in the Ly, app? • Metadata • Assets

    • Executable (Encrypted) • Lots of frameworks (Encrypted)
  8. What can we work with? • When it is running

    • Network traffic • Injec6ng code • When it isn't running • Inspec6ng the binaries
  9. Inspect Network Traffic using Charles charlesproxy.com

  10. HTTP(S) Proxy Performs SSL man-in-the-middle Pre$y prints JSON, YAML, XML,

    Mul8part, Form encoding, etc.
  11. Inject Code using cycript (jailbreak required for third party apps)

    cycript.org
  12. Cycript JavaScript/Objec/ve-C hybrid Interact with the app using the REPL,

    live: var application = [UIApplication sharedApplication]; [application openURL:[NSURL URLWithString:@"https://google.com"]];
  13. Decrypt The Executable with dumpdecrypted (jailbreak required) bit.ly/dumpd

  14. Analyze The Executable using IDA Pro bit.ly/idatrial

  15. Swi$ vs. Objec.ve-C Swi$ assembly is more verbose Swi$ class

    informa/on is harder to extract
  16. Looking at -applica.on:openURL: _TZFV4Lyft15DeepLinkManager13handleOpenURLfMS0_FC So5NSURLSb Mangled symbol name

  17. Looking at -applica.on:openURL: _TZFV4Lyft15DeepLinkManager13handleOpenURLfMS0_FC So5NSURLSb • _T -> Swi( symbol

    • F -> Func3on • 4Lyft -> Module name • A lot more informa3on (see Mike Ash's Friday Q&A)
  18. Looking at -applica.on:openURL: var url = NSURL(string: "lyft://") var manager

    : Lyft.DeepLinkManager = ... manager.handleOpenURL(url)
  19. Think like the developer

  20. Looking at Ly+.DeepLinkManager • DeepLinkRequest • DeepLinkable • DeepLinkToRide •

    DeepLinkToHelp • DeepLinkToSe6ngs • DeepLinkToDriveMode • etc.
  21. Looking at Ly+.DeepLinkManager lyft://action?paramter=value

  22. Looking at Ly+.DeepLinkToRide lyft://ridetype ?id=lyft_line &pickup[latitude]=0 &pickup[longitude]=0 &destination[latitude]=0 &destination[longitude]=0

  23. Thanks!