Set up DebugServer on iOS 7

I had my iPhone 4 jailbroken, so I can debug/crack apps on iPhone.

Server: iPhone 4 + debugserver
Client: Mac OS X + lldb

Server

DebugServer

Debugserver can be found on iOS: /Developer/usr/bin/debugserver
Just follow instructions: debugserver on iPhone Wiki

Save following content as a plist like dbg.plist

Apply the entitlement

If entitlement above is not applied, debugserver won’t be able to listen to a TCP port.

Remove FairPlay

FairPlay is Apple’s DRM applied to apps on AppStore.
If you see cryptid 1 like below, try Clutch!

Disable ASLR

Try otool -hv to your App, if you see PIE flags, you have to disable ASLR.

See: Mach-O Disable ASLR/PIE

Make sure you have python installed on your iPhone.

Find your target app.

Client

Copy a decrypted and de-aslr-ed app binary to your OS X and:

Set up DebugServer on iOS 7 by @sskaje: https://sskaje.me/2016/01/set-up-debugserver-ios-7/

Incoming search terms:

Mach-O Disable ASLR/PIE

ASLR, Address Space Layout Randomization

Address space layout randomization (ASLR) is a computer security technique involved in protection from buffer overflow attacks. In order to prevent an attacker from reliably jumping to a particular exploited function in memory (for example), ASLR involves randomly arranging the positions of key data areas of a program, including the base of the executable and the positions of the stack, heap, and libraries, in a process’s address space.

From http://en.wikipedia.org/wiki/Address_space_layout_randomization

Mach-O

Mach-O, short for Mach object file format, is a file format for executables, object code, shared libraries, dynamically-loaded code, and core dumps. A replacement for the a.out format, Mach-O offered more extensibility and faster access to information in the symbol table.

Mach-O was once used by most systems based on the Mach kernel.[citation needed] NeXTSTEP, OS X, and iOS are examples of systems that have used this format for native executables, libraries and object code.

http://en.wikipedia.org/wiki/Mach-O

There are several tools turning ASLR/PIE off, some of those need to be compiled. So I decided to write one in Python. Repository: https://github.com/sskaje/disable_aslr

Disable ASLR on jailbroken iPod Touch 4 with python installed from Cydia
Disable ASLR

Disable ASLR on OS X for iOS App
Disable ASLR on OS X for iOS App

https://developer.apple.com/library/mac/documentation/DeveloperTools/Conceptual/MachORuntime/Reference/reference.html

Mach-O Disable ASLR/PIE by @sskaje: https://sskaje.me/2014/05/mach-o-disable-aslr-pie/

Incoming search terms: