290 words
1 minutes
ios 逆向笔记

jailbreak#

https://dkxuanye.cn/?cat=116 good toturials :)

https://iosre.com/t/ios%E5%AE%89%E5%85%A8%E5%92%8C%E9%80%86%E5%90%91%E7%B3%BB%E5%88%97%E6%95%99%E7%A8%8B/22761

WinRa1n 2.0 is a good tool :)

or use 爱斯助手 the usb ones method

frida#

frida https://frida.re/docs/ios/#with-jailbreak

image-20240204162351683

you don’t have to connect with computer via usb cab

image-20240204162634031

windows can’t connect with ios via usb… it seems like that it’s drive should be changed…

but we can solve this problem by wireless remote connect

0x00 备注

  我们经常用旧的手机来做越狱和调试, 这个usb连接真的是差强人意, 老是关键时刻掉线

0x01 iPhone ssh运行:

frida-server -l 0.0.0.0

0x02 MacOS 中运行 :

frida-ps -H 192.168.111.120

0x03 执行frida操作

frida-trace -H 192.168.1.3:1337 -i "open*"

记得加上-H IP

# listen on 127.0.0.1:27042 (the default)
$ frida-server

# listen on all interfaces
$ frida-server -l 0.0.0.0

# listen on a specific interface
$ frida-server -l 192.168.1.3

# listen on a specific interface and port
$ frida-server -l 192.168.1.3:1337

# connect to specific IP
$ frida-trace -H 192.168.1.3 -i "open*"

# connect to specific IP/port
$ frida-trace -H 192.168.1.3:1337 -i "open*"

cyz1nappleID

install shit#

image-20240205170313074

image-20240205170423763

image-20240205173052838

framework like lsp: theos

connect iphone by ssh#

ssh is similar to adb, it connects window with ios

image-20240204155711390

if type yes, next time even if it’s the same ip address but a difference SHA256, it will raise middle attack (?)

default password alpine

other user

ssh mobile@192.168.1.5(iphone ip address)

change password#

image-20240205181307565

server ip changed it shows man-in-middle attack#

delete rsa key in PC

vim know_hosts

move the cursor to the fine row, typedd to delete this row

pushEsc and type :wq

image-20240205191119086

image-20240205192001840

Share VPN#

they should be LAN

ur vpn android device

v2yan: change socks5 and http port as the same number, allow coonections from the LAN

image-20240204154717911

ur vpn not found window device

image-20240204154849614

ios

image-20240204155023783

this is clash. also change http and socks port and allow LAN

image-20240204155140042

image-20240204155441166

image-20240204155509561

useful address#

http://zhaoboy9692.github.io/repo

ios 逆向笔记
https://zycreverse.netlify.app/posts/ios-reverse/ios_reverse/
Author
会写点代码的本子画手
Published at
2024-04-01