Introduction into Reverse Engineering and iOS Security
summary
Lab runs on an iPhone X running iOS 14 jailbroken and uses Hopper, lldb, Frida/FREDA server and Objection to dump a decrypted binary, inspect ~407 loaded frameworks, and hook runtime behavior. Objective‑C jailbreak checks get bypassed by injecting an always‑false closure (method swizzling in Obj‑C); Swift checks get bypassed by overwriting the return register X0 at runtime (modify registers for Swift static dispatch). FaceID is faked by swizzling OSAuthentication, keychain crypto inputs are dumped and recovered, SSL pinning is removed with an SSL Kill Switch; FishHook attempts to patch Swift symbols fail.
AI-written summary · about
chapters (10)
- 0:00Introduction to speaker
- 0:48Talk overview and motivation
- 2:58Setting up the lab environment
- 10:10Dumping the app binary
- 13:21Bypassing jailbreak detection in Objective-C
- 22:15Bypassing jailbreak detection in Swift
- 29:21Extracting secrets from memory
- 32:38Bypassing Face ID authentication
- 35:51Debugging crypto operations
- 37:36Closing remarks and resources
related talks
29miOS Runtime Manipulation (PWND)
45mCombat Reverse Engineering and Patching on Non-Jailbroken iOS Devices
58mUncovering OWASP’s Mobile Risks in iOS Apps
36mStealing user’s identity
49mHow to Hack Your Own Mobile App
47mBASHing iOS Applications
36mTesting iOS Apps without Jailbreak in 2018
40mStealing User's Identity