Hacking and Securing iOS Applications by Jonathan Zdziarski

Author:Jonathan Zdziarski [Jonathan Zdziarski]
Language: eng
Format: epub, mobi, pdf
Tags: COMPUTERS / Security / General
ISBN: 9781449318734
Publisher: O'Reilly Media
Published: 2012-01-17T16:00:00+00:00

Warning

Ensure you are in the application directory on your desktop, and that the PhotoVault binary exists in your current working directory. You’re overwriting a portion of data in the file, and leaving the remaining data intact, so if you aren’t in the correct working directory, a new file will be created and will be corrupt.

Resetting the cryptid

When you began this process, the output of otool -f displayed a cryptid value of 1, indicating that the section was encrypted. Since you’ve now overwritten the encrypted data with unencrypted data, the cryptid must be set to 0 in order for applications reading the Mach-O header to parse the file properly, and not assume the section is encrypted.

Using a hex editor such as 0xED, open the PhotoVault binary you’ve modified and jump to the address that you pasted over the encrypted data (1781760, or 0x1B3000). Now jump back approximately 0x1000 bytes and you’ll see the load commands for dynamically linked libraries. These will look like pathnames beginning with /usr/lib and /System/Library/Frameworks. Continue to scroll up just a bit until you get to the beginning of this list. You should see the very first library follow a chunk of unreadable data preceded by the path /usr/lib/dyld (the path to the dynamic linker). Approximately 28 bytes (and this truly just an approximation, as offsets are likely to change), you should see a byte with a value of 0x01 (see Figure 7-1). Ensure that your hex editor is in overwrite mode, and change this byte to 0x00, then save the file. If you’ve edited the correct byte, rerunning the otool command will display the armv7 segment to have a cryptid value of 0 instead of 1:

$ otool -l PhotoVault | grep crypt cryptoff 8192 cryptsize 1441792 cryptid 1 cryptoff 8192 cryptsize 1429504 cryptid 0

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.