HOPPER DISASSEMBLER APP STORE PATCH
HOPPER DISASSEMBLER APP STORE FREE

For simplicity, I already renamed the jailbreak function to a better name (sub_jailbreakdetection) in the screenshots below. By analyzing the Xrefs of these functions, you can easily identify the actual jailbreak detection routine(s). These functions are commonly used to detect if the device is jailbroken but not frequently used otherwise. Most of the time jailbreak detection routines are quite easy to spot, just look for functions like “lstat” or “exit”.

HOPPER DISASSEMBLER APP STORE FREE

Of course you are free to use any disassembler you like. Binary Ninjas does only provide limited annotation but you can still get some quick results if you are not used to ARM assembly, especially when using the Medium Level IL. However, I will use Binary Ninja here due the great and simple patching features. When it comes to statically analyzing iOS apps, the Hopper disassembler is (my) tool of choice, mainly because of the good automated annotation for Objective-C based code. The IPA files was then copied on our local system using scp. As iOS applications are encrypted for the specific device, we used “ Clutch” to dump to binary in a decrypted IPA file.

We installed the app via the app store on a jailbroken device. I will illustrate the entire process (unpacking/patching/repacking/signing) on the jailbreak detection, not the certificate pinning feature. Of course this requires re-signing the app, however our approach (using Cydia Impactor) makes the entire process less painful.

HOPPER DISASSEMBLER APP STORE PATCH

The main issue was the problem that we were not able to hook the “- isEqualToString” method correctly, and as it looks we were not the first with this problem.ĭue to timing constrains, we deviced to no longer deal with this issue and directly patch the binary of the iOS application itself. But while it was quite easy to bypass the jailbreak detection by hooking commonly used functions like “lstat”, we had several issues with the certificate pinning. We used a jailbroken device for our analysis, hence we didn’t need to modify the app. Thankfully, the fine folks at MWR Labs released a great blog post where they described each step in detail. Signing/repacking iOS applicatons can be a bit challenging, especially if you have no background in iOS app development. Of course this breaks the signature of the app, therefore it must be resigned and repacked. It is also possible to use Frida on non-jailbroken devices, however this requires to add the (signed) FridaGadget.dylib to the application. Using Frida on a jailbroken device has the advantage that you can avoid a modification of the app binary as the Frida server injects the agent at runtime. In cases like this, we commonly use a dynamic Instrumentation framework like Frida to bypass these protections so that we can freely interact with the application and intercept the communication with the server side backend. Like many business applications, the developers integrated common protections, including jailbreak detection and certificate pinning. We recently had to test a iOS application for one of our customers. This works way easier then using XCode or the codesign tool. TL:DR: You can use Cydia Impactor to resign a patched iOS app.

Hopper disassembler app store