![ЧТО ТЕПЕРЬ?
push {r4, r7, lr}
add r7, sp, #4
sub sp, #8
mov r4, r0
movw r0, 0x99dc
movt r0, 0x21
movw r2, 0xf216
movt r2, 0x21
add r0, pc
add r2, pc
ldr r1, [r0, #0]
ldr r0, [r2, #0]
blx 0x1e4bac
movw r1, 0x99ca
mov r2, r4
movt r1, 0x21
add r1, pc
ldr r1, [r1, #0]
blx 0x1e4bac
ARMv7
pushl %ebp
movl %esp,%ebp
subl $0x28,%esp
movl %edi,0xfc(%ebp)
movl 0x08(%ebp),%edi
movl %ebx,0xf4(%ebp)
movl %esi,0xf8(%ebp)
calll 0x00001842
popl %ebx
movb $__mh_bundle_header,0x69(%edi)
movl 0x18(%ebp),%eax
testl %eax,%eax
je 0x00001923
movl 0x18(%ebp),%eax
movl %edi,(%esp)
movl %eax,0x08(%esp)
movl 0x00009d6a(%ebx),%eax
movl %eax,0x04(%esp)
calll 0x0000c10d
i386
pushq %rbp
movq %rsp,%rbp
movq %r12,0xf0(%rbp)
movq %r13,0xf8(%rbp)
movq %rdi,%r12
movq %rbx,0xe8(%rbp)
subq $0x30,%rsp
movq 0x0000be4a(%rip),%rax
testq %r8,%r8
movq %rdx,0xd8(%rbp)
movl %ecx,0xd4(%rbp)
movq %r8,%r13
movb $__mh_bundle_header,(%rdi,%rax)
je 0x00000cd5
movq %r8,%rdx
leaq 0x0000aaa9(%rip),%rsi
call *0x0000aaa3(%rip)
testq %rax,%rax
jne 0x00000c53
x86_64
@__smirnov__](https://image.slidesharecdn.com/smirnov-reverse-engineering-techforum-130415103643-phpapp02/85/Smirnov-reverse-engineering-techforum-23-320.jpg)
![ARMV7 AND OTX
((0x99a2 & 0xffff) | (0x21<<16)) + (0x3d96 + 4) & ~1
methnames[selrefs[0x21d73c]] = “setWelcomeVC:”
00003d8c movw
r0,
0x99a2
00003d90 movs
r2,
#0
00003d92 movt
r0,
0x21
00003d96 add
r0,
pc
00003d98 ldr
r1,
[r0,
#0]
00003d9a mov
r0,
r4
00003d9c blx
0x1e4bac
младшие 16 bit
1 аргумент = nil
старшие 16 bit
+ Program Counter
r1 = *address
указатель на объект в r0
вызов objc_msgSend
@__smirnov__](https://image.slidesharecdn.com/smirnov-reverse-engineering-techforum-130415103643-phpapp02/85/Smirnov-reverse-engineering-techforum-28-320.jpg)
![SELECTOR
__objc_selrefs__objc_selrefs
mem offset value
0x21D738 0x1756CE
0x21D73C 0x1756D6
0x21D740 0x1756E4
••• •••
__objc_methname__objc_methname
mem offset 0x1756B0
defaultCenterremoveObserver:releasese
tWelcomeVC:deallocallocmainScreenb
oundsinitWithFrame:autoreleasesetWind
ow:setupInitialLoadingWindowsetAppId:se
tDaysUntilPrompt:setUsesUntilPrompt:set
SignificantEventsUntilPrompt:setTimeBefo
defaultCenterremoveObserver:releasese
tWelcomeVC:deallocallocmainScreenb
oundsinitWithFrame:autoreleasesetWind
ow:setupInitialLoadingWindowsetAppId:se
tDaysUntilPrompt:setUsesUntilPrompt:set
SignificantEventsUntilPrompt:setTimeBefo
methnames[selrefs[0x21d73c]] = “setWelcomeVC:”
arch_offset + sect_file_start + ( target_addr - sect_mem_start )
@__smirnov__](https://image.slidesharecdn.com/smirnov-reverse-engineering-techforum-130415103643-phpapp02/85/Smirnov-reverse-engineering-techforum-30-320.jpg)
![DYLD
blx 0x1e4bac
__TEXT, __symbolstub1__TEXT, __symbolstub1__TEXT, __symbolstub1
001e4ba8 ldr pc,
[pc,
#1728]
001e4bac ldr pc,
[pc,
#1728]
001e4bb0 ldr pc,
[pc,
#1728]
111100100101110101100 ARM MODE
__DATA, __lazysymbol__DATA, __lazysymbol
001e5270 001749cc
001e5274 001749d8
001e5278 001749e4
0x1e4bac + 8 + 1728 = 0x1e5274 _stub_helper _objc_msgSend
1 2
@__smirnov__](https://image.slidesharecdn.com/smirnov-reverse-engineering-techforum-130415103643-phpapp02/85/Smirnov-reverse-engineering-techforum-31-320.jpg)
Smirnov reverse-engineering-techforum
- 2. Александр Смирнов Руководитель группы разработки, iOS Почта alex.smirnov@corp.mail.ru @__smirnov__
- 4. О ЧЕМ ПОЙДЕТ РЕЧЬ • Зачем ? • Какие есть подходы ? • Инструментарий • Mach-O binary • Decrypting apps,ASLR,THUMB2/ARM • Asm, Prologue, EIP addressing, Msgs, DYLD • Откуда начинать анализ @__smirnov__
- 6. ЗАЧЕМ ЭТО НУЖНО ? • Это весело • Анализ конкурирующих продуктов • Совместимость с проприетарным программным обеспечением • Аудит безопасности Это весело! @__smirnov__
- 7. МЕТОДЫ АНАЛИЗА System Level Code Level Network traffic sniffing Disassembling/Decompiling Анализ I/O активности Debugging Общий анализ системных вызовов ObjC Runtime @__smirnov__
- 8. TOOLSET otool/otx дизассемблер gdb/lldb class-dump получаем информацию об objc классах из mach-o MachOView удобное представление mach-o заголовков, сегментов, секций lipo манипулирование fat файлами hexdump/0xED cycript воздействуем на приложение в runtime python/ruby/perl @__smirnov__
- 10. MACH-O HEADER 0xCAFEBABE0xFEEDFACF0xFEEDFACE 32bit 64bit FAT @__smirnov__
- 11. SEGMENTS AND SECTIONS Load command 1 cmd LC_SEGMENT cmdsize 532 segname __TEXT vmaddr 0x00001000 vmsize 0x00027000 fileoff 0 filesize 159744 maxprot 0x00000007 initprot 0x00000005 nsects 7 flags 0x0 Section sectname __text segname __TEXT addr 0x00002848 size 0x0001b86c offset 6216 align 2^2 (4) reloff 0 nreloc 0 flags 0x80000400 reserved1 0 reserved2 0 @__smirnov__
- 12. __OBJC SEGMENT class-dump by Steve Nygard __message_refs __instance_vars __cls_refs __inst_meth __symbols __cls_meth __module_info __cat_cls_meth __class __protocol_ext __meta_class __cat_inst_meth @__smirnov__
- 13. CLASS-DUMP @interface Alfred1PwdPreferences : NSObject <AlfredPreferencePane> { Alfred1PwdPreferencesViewController *viewController; } - (unsigned long long)sortPriority; // IMP=0x0000000100089e9f - (BOOL)isPowerpack; // IMP=0x0000000100089e94 - (id)paneGroup; // IMP=0x0000000100089e87 - (id)paneView; // IMP=0x0000000100089dfb - (id)paneIcon; // IMP=0x0000000100089d49 - (id)paneName; // IMP=0x0000000100089d3c - (id)paneUID; // IMP=0x0000000100089d2f - (void)dealloc; // IMP=0x0000000100089ce5 @end @__smirnov__
- 14. ШИФРОВАНИЕ ПРИЛОЖЕНИЙ This file is encrypted cryptid: 0x00000001, cryptoff: 0x00002000, cryptsize: 0x001e2000 @__smirnov__
- 16. DECRYPT APPSTORE BINARY Load command 12 cmd LC_ENCRYPTION_INFO cmdsize 20 cryptoff 8192 cryptsize 1974272 cryptid 1 STEP 1 - otool смещение размер зашифровано @__smirnov__
- 17. ASLR User Space ASLR представлен в iOS 4.3 0x1000 becomes 0x54000 Address Space Layout Randomization — случайное изменение расположения в адресном пространстве процесса важных структур, а именно: образа исполняемого файла, подгружаемых библиотек, кучи и стека. KASLR представлен в iOS 6.0 @__smirnov__
- 18. DECRYPT APPSTORE BINARY STEP 2 - gdb (gdb) info mach-regions Region from 0x54000 to 0x238000 (r-x, max r-x; copy, private, not- reserved) (2 sub-regions) ... from 0x238000 to 0x292000 (rw-, max rw-; copy, private, not- reserved) (2 sub-regions) ... (gdb) x/4x 0x54000 0x54000: 0xfeedface 0x0000000c 0x00000009 0x00000002 0x1000 переехало в 0x54000 @__smirnov__
- 19. DECRYPT APPSTORE BINARY STEP 2.5 - gdb Section sectname __text segname __TEXT addr 0x00003d38 size 0x00170520 offset 11576 (gdb) x/10i (0x54000+11576)|1 0x56d39: push {r4, r7, lr} 0x56d3b: add r7, sp, #4 0x56d3d: sub sp, #8 0x56d3f: mov r4, r0 0x56d41: movw r0, #39388 ; 0x99dc 0x56d45: movt r0, #33 ; 0x21 (0x54000+11576)|1 @__smirnov__
- 20. THUMB MODE ARM MODE THUMB2 MODE 32bit long instructions 16 to 32bit long instructions 0x56d38 0x56d39LSB bit 1010110110100111000 1010110110100111001 @__smirnov__
- 21. DECRYPT APPSTORE BINARY STEP 2.5 - gdb cryptoff TARGET __TEXT0x0 0x0 0x54000 __TEXT+cryptoff 0x54000+8192 __TEXT+cryptoff+cryptsize 0x54000+8192+1974272 @__smirnov__
- 22. DECRYPT APPSTORE BINARY STEP 3 - patcharchitecture 0 cputype 12 cpusubtype 9 capabilities 0x0 offset 4096 size 2494896 align 2^12 (4096) fat header mach header arch0 arch0 content mach header arch1 arch0 content 0x0 0x1000 architecture 1 cputype 12 cpusubtype 11 capabilities 0x0 offset 2502656 size 2490624 align 2^12 (4096) 0x263000 4096 2490624 arch_offset + cryptoffset @__smirnov__
- 23. ЧТО ТЕПЕРЬ? push {r4, r7, lr} add r7, sp, #4 sub sp, #8 mov r4, r0 movw r0, 0x99dc movt r0, 0x21 movw r2, 0xf216 movt r2, 0x21 add r0, pc add r2, pc ldr r1, [r0, #0] ldr r0, [r2, #0] blx 0x1e4bac movw r1, 0x99ca mov r2, r4 movt r1, 0x21 add r1, pc ldr r1, [r1, #0] blx 0x1e4bac ARMv7 pushl %ebp movl %esp,%ebp subl $0x28,%esp movl %edi,0xfc(%ebp) movl 0x08(%ebp),%edi movl %ebx,0xf4(%ebp) movl %esi,0xf8(%ebp) calll 0x00001842 popl %ebx movb $__mh_bundle_header,0x69(%edi) movl 0x18(%ebp),%eax testl %eax,%eax je 0x00001923 movl 0x18(%ebp),%eax movl %edi,(%esp) movl %eax,0x08(%esp) movl 0x00009d6a(%ebx),%eax movl %eax,0x04(%esp) calll 0x0000c10d i386 pushq %rbp movq %rsp,%rbp movq %r12,0xf0(%rbp) movq %r13,0xf8(%rbp) movq %rdi,%r12 movq %rbx,0xe8(%rbp) subq $0x30,%rsp movq 0x0000be4a(%rip),%rax testq %r8,%r8 movq %rdx,0xd8(%rbp) movl %ecx,0xd4(%rbp) movq %r8,%r13 movb $__mh_bundle_header,(%rdi,%rax) je 0x00000cd5 movq %r8,%rdx leaq 0x0000aaa9(%rip),%rsi call *0x0000aaa3(%rip) testq %rax,%rax jne 0x00000c53 x86_64 @__smirnov__
- 25. I386 Prologue pushl %ebp movl %esp,%ebp subl $0x28,%esp Application Binary Interface сохраняем stack frame новый stack frame место на стеке @__smirnov__
- 26. EIP RELATIVE ADDRESSING 0000183d calll 0x00001842 00001842 popl %ebx ••• ••• 0000185c movl 0x00009d6a(%ebx),%eax 0x9d6a + 0x1842 = 0xb5ac offset eip address трюк для получения значения eip eax = *(0x9d6a+ebx) @__smirnov__
- 27. OBJC_MSGSEND id objc_msgSend(id theReceiver, SEL theSelector, ...) 80% вызовов @__smirnov__
- 28. ARMV7 AND OTX ((0x99a2 & 0xffff) | (0x21<<16)) + (0x3d96 + 4) & ~1 methnames[selrefs[0x21d73c]] = “setWelcomeVC:” 00003d8c movw r0, 0x99a2 00003d90 movs r2, #0 00003d92 movt r0, 0x21 00003d96 add r0, pc 00003d98 ldr r1, [r0, #0] 00003d9a mov r0, r4 00003d9c blx 0x1e4bac младшие 16 bit 1 аргумент = nil старшие 16 bit + Program Counter r1 = *address указатель на объект в r0 вызов objc_msgSend @__smirnov__
- 29. ВСЕ ЕЩЕ ВНИМАТЕЛЬНЫ ? @__smirnov__
- 30. SELECTOR __objc_selrefs__objc_selrefs mem offset value 0x21D738 0x1756CE 0x21D73C 0x1756D6 0x21D740 0x1756E4 ••• ••• __objc_methname__objc_methname mem offset 0x1756B0 defaultCenterremoveObserver:releasese tWelcomeVC:deallocallocmainScreenb oundsinitWithFrame:autoreleasesetWind ow:setupInitialLoadingWindowsetAppId:se tDaysUntilPrompt:setUsesUntilPrompt:set SignificantEventsUntilPrompt:setTimeBefo defaultCenterremoveObserver:releasese tWelcomeVC:deallocallocmainScreenb oundsinitWithFrame:autoreleasesetWind ow:setupInitialLoadingWindowsetAppId:se tDaysUntilPrompt:setUsesUntilPrompt:set SignificantEventsUntilPrompt:setTimeBefo methnames[selrefs[0x21d73c]] = “setWelcomeVC:” arch_offset + sect_file_start + ( target_addr - sect_mem_start ) @__smirnov__
- 31. DYLD blx 0x1e4bac __TEXT, __symbolstub1__TEXT, __symbolstub1__TEXT, __symbolstub1 001e4ba8 ldr pc, [pc, #1728] 001e4bac ldr pc, [pc, #1728] 001e4bb0 ldr pc, [pc, #1728] 111100100101110101100 ARM MODE __DATA, __lazysymbol__DATA, __lazysymbol 001e5270 001749cc 001e5274 001749d8 001e5278 001749e4 0x1e4bac + 8 + 1728 = 0x1e5274 _stub_helper _objc_msgSend 1 2 @__smirnov__
- 32. ЗАКОНЧИМ ТЕМ ОТКУДА НАЧАТЬ • Отслеживание ввода данных • Места использования данных • Известные методы • Class-dump • Известные константы • Используемые библиотеки @__smirnov__
- 33. @__smirnov__