3 ms·

Isn't a theoretical large reason for jailbreaking (not your main phone) to be able to read the contents of all installed apps, say, via SSH? I don't know of ano

by leoh 6y ago

Isn't a theoretical large reason for jailbreaking (not your main phone) to be able to read the contents of all installed apps, say, via SSH? I don't know of another way to do this.

enricozb 6y ago
It doesn't install OpenSSH by default, but it does set up a root user with a default password "alpine". It's recommended that you change this.
- saagarjha 6y ago
  I believe that the root user already exists with that password.
  - enricozb 6y ago
    It looks like you're right. I guess I don't really understand then why we can't just log in as root in vanilla iOS
judge2020 6y ago
It technically is, but iOS apps are compiled ARM64 so decompiling them isn't trivial. It's often easier to find the app's config files and mess around, or to use an app like Flex that allows you to override return values for an app's methods. https://twitter.com/flextweak https://twitter.com/flextweak
- leoh 6y ago
  Super interesting. I suspect Ghidra might support reasonably well.
  - _kbh_ 6y ago
    Ghidra doesn't do a great job of decompiling Swift and ObjC which most most iOS apps would be written in now days. You are better off with something like Hopper. Hopper does a better job of decompiling Swift and ObjC but its decompiler output is no where near as good unfortunately.
- userbinator 6y ago
  but iOS apps are compiled ARM64 so decompiling them isn't trivial One of the fun things about Android is the ease of decompiling and recompiling Java, but if you're used to RE'ing native code for Windows or Linux, then I don't think it would be all that different?
- saagarjha 6y ago
  It’s no unobfuscated Java, but it’s far from being complicated.
Lammy 6y ago
Some tools you may want to look into. They're used for piracy 99% of the time, but interesting stuff all the same: https://github.com/KJCracks/Clutch https://github.com/KJCracks/Clutch https://forum.iphonecake.com/index.php?/topic/363020-crackerxi-gui-app-decryption-tool-for-ios-11-12-13/ https://forum.iphonecake.com/index.php?/topic/363020-cracker...
varenc 6y ago
Jailbreaking can be invaluable for legitimate security research. For example, frida is a powerful reverse engineering tool that allowing all sorts of scripting and dynamic instrumentation. It's functionality is very limited without jailbreaking. https://frida.re/docs/ios https://frida.re/docs/ios
- leoh 6y ago
  Looks a lot like dtrace
  - varenc 6y ago
    It is! Though DTrace doesn't really work on iOS... Apparently Apple ported it over but they've certainly never released it publicly. https://twitter.com/ahl/status/311883517820809216 https://twitter.com/ahl/status/311883517820809216
lucb1e 6y ago
Yes, this is one of the things I use Linux Deploy (requires root) on my Android phone for. I do backups of all data this way and randomly browsing photos from Linux (nemo specifically) is also easy: 1. Open file manager 2. Click a bookmark that points to "sftp://tel" 3. I can now browse my phone, e.g. to view pictures or copy a previously taken screenshot. No need to take the phone out of your pocket and connect it over USB or anything. "tel" is configured in ~/.ssh/config to point to the static IP of my phone. I have another ssh host called "hotspot" which points to the IP it uses when it functions as hotspot. (Of course, this occasional convenience and full backups aren't the only things I would want root for.)

by leoh 6y ago

Isn't a theoretical large reason for jailbreaking (not your main phone) to be able to read the contents of all installed apps, say, via SSH? I don't know of another way to do this.

enricozb 6y ago

It doesn't install OpenSSH by default, but it does set up a root user with a default password "alpine". It's recommended that you change this.

saagarjha 6y ago
I believe that the root user already exists with that password.
- enricozb 6y ago
  It looks like you're right. I guess I don't really understand then why we can't just log in as root in vanilla iOS

judge2020 6y ago

It technically is, but iOS apps are compiled ARM64 so decompiling them isn't trivial. It's often easier to find the app's config files and mess around, or to use an app like Flex that allows you to override return values for an app's methods. https://twitter.com/flextweak https://twitter.com/flextweak

leoh 6y ago
Super interesting. I suspect Ghidra might support reasonably well.
- _kbh_ 6y ago
  Ghidra doesn't do a great job of decompiling Swift and ObjC which most most iOS apps would be written in now days. You are better off with something like Hopper. Hopper does a better job of decompiling Swift and ObjC but its decompiler output is no where near as good unfortunately.
userbinator 6y ago
but iOS apps are compiled ARM64 so decompiling them isn't trivial One of the fun things about Android is the ease of decompiling and recompiling Java, but if you're used to RE'ing native code for Windows or Linux, then I don't think it would be all that different?
saagarjha 6y ago
It’s no unobfuscated Java, but it’s far from being complicated.

Lammy 6y ago

Some tools you may want to look into. They're used for piracy 99% of the time, but interesting stuff all the same: https://github.com/KJCracks/Clutch https://github.com/KJCracks/Clutch https://forum.iphonecake.com/index.php?/topic/363020-crackerxi-gui-app-decryption-tool-for-ios-11-12-13/ https://forum.iphonecake.com/index.php?/topic/363020-cracker...

varenc 6y ago

Jailbreaking can be invaluable for legitimate security research. For example, frida is a powerful reverse engineering tool that allowing all sorts of scripting and dynamic instrumentation. It's functionality is very limited without jailbreaking. https://frida.re/docs/ios https://frida.re/docs/ios

leoh 6y ago
Looks a lot like dtrace
- varenc 6y ago
  It is! Though DTrace doesn't really work on iOS... Apparently Apple ported it over but they've certainly never released it publicly. https://twitter.com/ahl/status/311883517820809216 https://twitter.com/ahl/status/311883517820809216

lucb1e 6y ago

Yes, this is one of the things I use Linux Deploy (requires root) on my Android phone for. I do backups of all data this way and randomly browsing photos from Linux (nemo specifically) is also easy: 1. Open file manager 2. Click a bookmark that points to "sftp://tel" 3. I can now browse my phone, e.g. to view pictures or copy a previously taken screenshot. No need to take the phone out of your pocket and connect it over USB or anything. "tel" is configured in ~/.ssh/config to point to the static IP of my phone. I have another ssh host called "hotspot" which points to the IP it uses when it functions as hotspot. (Of course, this occasional convenience and full backups aren't the only things I would want root for.)