Home

Welcome to the iOS-Pentesting wiki!

Reversing/Patching with Hopper:

Decrypt app:

Clutch 2

Either grab Clutch by adding repository http://cydia.iphonecake.com to Cydia or from git https://github.com/KJCracks/Clutch

root# Clutch2 -b 2 Dumps to: /var/tmp/clutch/app-dir

Fix for Clutch’s cracked Apps crashing on ARMv7s Devices

To be performed on Mac OS X

Extract the IPA file 2. Go into Payload/whatevername.app 3. Open up Terminal 4. Run this command lipo binary -thin armv7 -output newbinary mv newbinary binary

Rasticrac

Grab from cydia. ldone will also be installed. rc.sh -m

Dump class info (for debugging using gdb/cycript)

root# class-dump Spotify > /spotify-dump.txt

Patch app using Hopper and place it back on device.

Resigning the iOS Binary

Place binary back on app directory and do the following:

ldone spotify -s chmod 755 spotify chown mobile.mobile spotify

Runtime debugging:

Runtime with Cycript:

var app = [ UIApplication sharedApplication ] app.delegate !# you can also just use UIApp.delegate var delegate = new Instance(0x2315f0)

!#call delegate [ delegate pinLockControllerDidFinishUnlocking ] for bool values: [ UIApp.delegate userIsLogged: YES ]