5 ms·

Very interesting. How did you go about reverse engineering it? Would you mind sharing?

by geekam 12y ago

conradev 12y ago
Sure! It's a combination of static and dynamic analysis. I have a jailbroken phone, which allows me to access any file on the filesystem and decrypt any App Store binaries[1]. The first step is to find in which binaries the functionality lives. I know from searching that AirDrop lives in Sharing.framework[2], which has a supporting daemon, sharingd. Then, I open the binaries in a disassembler like IDA Pro[3] or Hopper[4] to determine how they work. Running class-dump is also helpful[5]. If I need to inspect a process like sharingd at runtime, I use Cycript[6], which gives me an Objective-C REPL into the process, or LLDB[7]. [1] https://github.com/stefanesser/dumpdecrypted https://github.com/stefanesser/dumpdecrypted [2] https://github.com/JaviSoto/iOS8-Runtime-Headers/tree/master/PrivateFrameworks/Sharing.framework https://github.com/JaviSoto/iOS8-Runtime-Headers/tree/master... [3] https://www.hex-rays.com/products/ida/ https://www.hex-rays.com/products/ida/ [4] http://www.hopperapp.com/ http://www.hopperapp.com/ [5] http://stevenygard.com/projects/class-dump/ http://stevenygard.com/projects/class-dump/ [6] http://www.cycript.org/ http://www.cycript.org/ [7] http://iphonedevwiki.net/index.php/Debugserver http://iphonedevwiki.net/index.php/Debugserver
- coldpie 12y ago
  Oh crap, I didn't know IDA was free for non-commercial use. I thought it was like Photoshop: prohibitively expensive for most users, so everyone pirates it. I'm going to have to give that a shot.
  - TillE 12y ago
    An old version is free, and lacking the decompiler. It's a good tool, but it's really not IDA Pro.
  - reubenmorais 12y ago
    IDA is not the expensive part, the Hex-Rays decompiler is. A single license can cost up to $2000 :(
  - edeion 12y ago
    Maybe you'd like Radare, which is free software. http://www.radare.org/y/ http://www.radare.org/y/
    - coldpie 12y ago
      Thank you for the link.
  - udalov 12y ago
    The free version is also Windows-only

Very interesting. How did you go about reverse engineering it? Would you mind sharing?

by geekam 12y ago

Very interesting. How did you go about reverse engineering it? Would you mind sharing?

Sure! It's a combination of static and dynamic analysis. I have a jailbroken phone, which allows me to access any file on the filesystem and decrypt any App Store binaries[1]. The first step is to find in which binaries the functionality lives. I know from searching that AirDrop lives in Sharing.framework[2], which has a supporting daemon, sharingd. Then, I open the binaries in a disassembler like IDA Pro[3] or Hopper[4] to determine how they work. Running class-dump is also helpful[5]. If I need to inspect a process like sharingd at runtime, I use Cycript[6], which gives me an Objective-C REPL into the process, or LLDB[7]. [1] https://github.com/stefanesser/dumpdecrypted https://github.com/stefanesser/dumpdecrypted [2] https://github.com/JaviSoto/iOS8-Runtime-Headers/tree/master/PrivateFrameworks/Sharing.framework https://github.com/JaviSoto/iOS8-Runtime-Headers/tree/master... [3] https://www.hex-rays.com/products/ida/ https://www.hex-rays.com/products/ida/ [4] http://www.hopperapp.com/ http://www.hopperapp.com/ [5] http://stevenygard.com/projects/class-dump/ http://stevenygard.com/projects/class-dump/ [6] http://www.cycript.org/ http://www.cycript.org/ [7] http://iphonedevwiki.net/index.php/Debugserver http://iphonedevwiki.net/index.php/Debugserver

coldpie 12y ago
Oh crap, I didn't know IDA was free for non-commercial use. I thought it was like Photoshop: prohibitively expensive for most users, so everyone pirates it. I'm going to have to give that a shot.
- TillE 12y ago
  An old version is free, and lacking the decompiler. It's a good tool, but it's really not IDA Pro.
- reubenmorais 12y ago
  IDA is not the expensive part, the Hex-Rays decompiler is. A single license can cost up to $2000 :(
- edeion 12y ago
  Maybe you'd like Radare, which is free software. http://www.radare.org/y/ http://www.radare.org/y/
  - coldpie 12y ago
    Thank you for the link.
- udalov 12y ago
  The free version is also Windows-only