iOS Runtime Manipulation (PWND)
summary
Claims that jailbreak detection is bypassable on a jailbroken iOS 14 device by dumping a running app from memory, reversing the decrypted binary, and changing runtime behavior. Tools shown: Frida, Hopper, lldb over iProxy/SSH to dump the DBA (D vulnerable iOS banking application), set breakpoints, override registers, inject an AlwaysFalse function and use Objective‑C swizzling to resume sending money. Demonstrations also include extracting tokens, dumping keychain, SSL pinning and Face ID bypasses and noting 423 libraries loaded.
AI-written summary · about
chapters (16)
- 0:00iOS runtime manipulation
- 1:18Bypassing jailbreak detection
- 2:42Jailbroken iOS setup
- 5:49Extracting iOS app binary
- 9:03Finding detection function
- 11:07Debugging with lldb and Frida
- 13:15Calculating memory offsets
- 15:30Bypass with breakpoints
- 18:46Objective-C runtime registers
- 20:10Injecting dynamic function
- 21:12Swizzling methods
- 23:20Swift runtime challenges
- 24:05Extracting secrets and Face ID
- 25:08Breaking SSL pinning
- 25:52Secure iOS development
- 27:56Closing remarks
related talks
40mIntroduction into Reverse Engineering and iOS Security
43mRuntime Manipulation of Android and iOS Applications
36mTesting iOS Apps without Jailbreak in 2018
36mStealing user’s identity
58mUncovering OWASP’s Mobile Risks in iOS Apps
45mCombat Reverse Engineering and Patching on Non-Jailbroken iOS Devices
09mBypassing Jailbreak Detection
40mStealing User's Identity