noobpk / frida-ios-hook

A tool that helps you easy trace classes, functions, and modify the return values of methods on iOS platform

Frida iOS hook

📍 A tool that helps you can easy using frida. It support script for trace classes, functions, and modify the return values of methods on iOS platform.

👉 For Android platform: frida-android-hook

👉 For Intercept Api was encrypted on iOS application: frida-ios-intercept-api

Env OS Support

OS	Supported	Noted
MacOS	✅	main
Linux	✅	sub
Windows	✅	sub

Compatible with

iOS	Frida	Frida-tools	Supported
15.7.4	16.1.3	12.2.1	✅

Feature

Running with python3.x

Support both spawn & attach script to process.

[+] Options:

	-p(--package)			Identifier of application ex: com.apple.AppStore
	-n(--name) 			Name of application ex: AppStore
	-s(--script) 			Using script format script.js
	-c(--check-version) 		Check for the newest version
	-u(--update) 			Update to the newest version

	[*] Dump decrypt IPA:

    	-d, --dump         Dump decrypt application.ipa
    	-o OUTPUT_IPA, --output=OUTPUT_IPA
                           Specify name of the decrypted IPA

	[*] Dump memory of Application:

	--dump-memory		Dump memory of application

	[*] HexByte Scan IPA:
	--hexbyte-scan		Scan or Patch IPA with byte patterns
	--pattern=PATTERN   Pattern for hexbytescan
	--address=ADDRESS   Address for hexbytescan
	-t TASK, --task=TASK
          			Task for hexbytescan

	[*] Information:

	--list-devices    List All Devices
	--list-apps       List The Installed apps
	--list-scripts    List All Scripts
	--logcat          Show system log of device
    	--shell, --ssh      Get the shell of connect device

	[*] Quick method:

	-m(--method)	  Support commonly used methods
				app-static(-n)
				bypass-jb(-p)
				bypass-ssl(-p)
				i-url-req(-n)
				i-crypto(-p)
	[*] reFlutter:

	--reflutter=FLUTTERFILE
                        File Flutter.ipa

📜 ChangeLog

Version: 3.9

	[+] Add:
		- Add backtrace to hooking.js
	[+] Change:
		- Update frida version
		- Update readme, changelog, requirement
	[+] Fix
		- Fix issue #85

See Full ChangeLog

Install

	[+] Latest version

		https://github.com/noobpk/frida-ios-hook/releases

	[+] Develop version

		git clone -b dev https://github.com/noobpk/frida-ios-hook

Environment

[+] Python >= v3.0 (Recommend to use pyenv or virtualenv)

1. cd frida-ios-hook/
2. python3 -m venv py-env
3. source py-env/bin/active

Build

1. pip3 install -r requirements.txt
3. python3 setup.py
4. cd frida-ios-hook
5. ./ioshook -h (--help)

Usage

See Full Usage as Wiki

If you run the script but it doesn't work, you can try the following: frida -U -f package -l script.js

📺 Demo Feature

Title	Link
Frida iOS Hook | Basic Usage | Install - List devices - List apps - List scripts - Logcat - Shell	https://youtu.be/xSndHgTdv4w
Frida iOS Hook | Basic Usage | Dump Decrypt IPA - Dump Memory App - Hexbyte-Scan IPA	https://youtu.be/AUsJ9_gnWAI
Frida iOS Hook | Basic Usage | App Static - Bypass Jailbreak - Bypass SSL - Intercept URL + Crypto	https://youtu.be/nWhKDSzArf8
Frida iOS Hook | Advance Usage | Memory Dump - Radare2 - Iaito	https://youtu.be/nUqE4EYWiEc

Frida-Script

Updated some frida scripts to help you with the pentest ios app. Filter script using spawn(S) or attach(A)

N	Spawn/Attach	Script Name	Script Description	Script Version
1	S	backtrace.js	Backtrace	1.0
2	S	bypass-flutter-ssl.js	Flutter bypass ssl pinning	1.0
3	S	bypass-jailbreak-1.js	Basic bypass jailbreak detection	1.0
4	S	bypass-ssl-ios13.js	iOS 13 bypass ssl pinning	1.0
5	S	dump-ios-url-scheme.js	Dump iOS url scheme when "openURL" is called	1.0
6	S	dump-ui.js	Dump the current on-screen User Interface structure	1.0
7	S+A	find-all-classes-methods.js	Dump all methods inside all classes	1.0
8	S+A	find-all-classes.js	Dump all classes used by the app	1.0
9	S+A	find-app-classes-methods.js	Dump all methods inside classes owned by the app only	1.0
10	S+A	find-app-classes.js	Dump classes owned by the app only	1.0
11	S+A	find-specific-method.js	Find a specific method in all classes	1.0
12	S+A	flutter_trace_function.js	iOS flutter trace function	1.0
13	S+A	hook-all-methods-of-all-classes-app-only.js	Hook all the methods of all the classes owned by the app	1.0
14	S+A	hook-all-methods-of-specific-class.js	Hook all the methods of a particular class	1.0
15	S+A	hook-specific-method-of-class.js	Hook a particular method of a specific class	1.0
16	S+A	intercept-nslog.js	Intercept calls to Apple's NSLog logging function	1.0
17	S+A	ios-app-static-analysis.js	iOS app static analysis	1.0
18	S	ios-biometric-bypass.js	iOS Biometric Bypass	1.0
19	S+A	ios-intercept-crypto-2.js	iOS Intercepts Crypto Operations 2	1.0
20	S+A	ios-intercept-crypto.js	iOS Intercepts Crypto Operations	1.0
21	S+A	ios-list-apps.js	iOS List Application	1.0
22	S+A	ios-url-scheme-fuzzing.js	iOS URL Scheme Fuzzing	1.0
23	S+A	pasteboard-monitoring.js	Monitor usage of pasteboard. Useful to show lack of secure attribute on sensitive fields allowing data copying.	1.0
24	S+A	raptor_frida_ios_autoIntercept.js	Raptor frida ios auto intercept	1.0
25	S+A	raptor_frida_ios_bypass1.js	Raptor frida ios bypass 1	1.0
26	S+A	raptor_frida_ios_bypass2.js	Raptor frida ios bypass 2	1.0
27	S+A	raptor_frida_ios_call.js	Raptor frida ios call	1.0
28	S+A	raptor_frida_ios_debug.js	Raptor frida ios debug	1.0
29	S+A	raptor_frida_ios_enum.js	Raptor frida ios enum	1.0
30	S+A	raptor_frida_ios_lowlevel1.js	Raptor frida ios low level 1	1.0
31	S+A	raptor_frida_ios_lowlevel2.js	Raptor frida ios low level 2	1.0
32	S+A	raptor_frida_ios_stalker.js	Raptor frida ios stalker	1.0
33	S+A	raptor_frida_ios_touchid.js	Raptor frida ios touchid	1.0
34	S+A	raptor_frida_ios_trace.js	Raptor frida ios trace	1.0
35	S+A	read-nsuserdefaults.js	Show contents of NSUserDefaults	1.0
36	S+A	read-plist-file.js	Show contents of a Plist file	1.0
37	S	replace-exported-method.js	Replace a module's exported function	1.0
38	S+A	show-all-methods-of-specific-class.js	Dump all methods of a particular class	1.0
39	S+A	show-argument-type-count-and-return-value-type.js	Show argument type & count and type of return value for a function in a class	1.0
40	S+A	show-instance-variables-for-specific-class.js	Show all instance variables of a particular class	1.0
41	S+A	show-modify-function-arguments.js	Show and modify arguments of a function inside a class	1.0
42	S+A	show-modify-method-return-value.js	Show and modify return value of a particular method inside a class	1.0
43	S+A	show_binarycookies.js	Show contents of Cookies.binarycookies file	1.0

Hexbytescan-Task

N	Task Name	Task Description
1	openssl_hook.json	OpenSSL 1.0.2 certificate pinning hook on arm64
2	openssl_1_1_0_hook.json	OpenSSL 1.1.0 certificate pinning hook for arm64, it modifies cmp instruction in tls_process_server_certificate method
3	openssl_hook_v2.json	OpenSSL 1.0.2 certificate pinning hook on arm64, improved pattern, possibly for different compiler version or slightly updated OpenSSL, use if first version does not find patch location. These hooks patch call to ssl_verify_cert_chain in ssl3_get_server_certificate.

Disclaimer

Because I am not a developer, so my coding skills might not be the best. Therefore, if this tool have any issue or not working for you, create an issue and i will try to fix it. Any suggestions for new feature and discussions are welcome!

frida-ios-hook's Issues

ModuleNotFoundError: No module named 'requests'

I got an error when I first installed and used dump memory with the Facebook app!
Please help me! Thanh ciu hihi

• Device: iPhone6s
• OS: iOS 14.4.2
• Frida version: 16.0.7
• Computer: Macbook Pro M1 Pro

How to run and use

I am noob in frida , any tut or video for how to use your project ?

Please support frida 16.0.1

Describe the bug
not compatible with frida 16.0.1

To Reproduce
Steps to reproduce the behavior:

1. update frida (pip install -U frida frida-tools)
2. update frida on Cydia.
3. run command
4. error

Screenshots
Screen Shot 2022-10-09 at 09 53 07

Desktop (please complete the following information):

• OS: 10.14.6
• Frida version: 16.0.1

Smartphone (please complete the following information):

• Device: iPhone8,4
• OS: iOS13.3.1
• Frida version: 16.0.1
• Jailbreak type: checkra1n
• Checkra1n ver: 0.12.4

Doesn't work with the latest frida version

Describe the bug
Running app-list or trying to spawn results in "unable to launch iOS app: The operation couldn’t be completed. Application info provider (FBSApplicationLibrary) returned nil for """

To Reproduce
Steps to reproduce the behavior:

1. Install latest frida on mac and iPhone
2. Try to use frida-ios-hook
3. unable to launch iOS app: The operation couldn’t be completed. Application info provider (FBSApplicationLibrary) returned nil for ""

Expected behavior
Process spawns or. I get a list of apps

add two requirements: requests and psutil

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: [e.g. iOS]
• Browser [e.g. chrome, safari]
• Version [e.g. 22]

Smartphone (please complete the following information):

• Device: [e.g. iPhone6]
• OS: [e.g. iOS8.1]
• Browser [e.g. stock browser, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

Get base address on iOS?

Sorry for being ignorant. Since Google sucks and always give me link to this repo, I have no choice but to ask here.
I want to hook binary of the game. All scripts examples here are just for Obj-c, so they are no use for me.
How can I get base with target address to hook? I tried this which works on Android but it doesn't work on iOS

Interceptor.attach(Module.findBaseAddress('global').add(0x101903A18)

connection lost

Device: iPhone8
OS: 15.6
Jailbreaked(Palera1n)

[x_x] The application may crash or lose connection.

ios 16.7.2 support?

i see failed to get the task for process and unable to attach to the specified process errors, but --list-apps works.

Add option for attach by PID

IDK Exactly why but attaching to an app is failing with

[x_x] Unable to find process with name MyApp. You need run app first.!!

just as fast fix, i've edited the all .attach method in hook.py file with hardcoded PID got via frida-ps -U and is working so seems, having an option to attach by PID (or get the PID via frida-ps -U as fallback?) can be useful

PS. also frida-trace -U -f net.myapp will crash with

Failed to attach: process with pid 7781 either refused to load frida-agent, or terminated during injection

so it's a more general frida issue

repeat install libimobiledevice,ideviceinstaller

Describe the bug
A clear and concise description of what the bug is.
config.py variable firstRun you write fristRun,so i run every time ,tip
Warning: libimobiledevice 1.3.0 is already installed and up-to-date.
To reinstall 1.3.0, run:
brew reinstall libimobiledevice
[14-06-22 09:55:08] [INFO] - [*] Install ideviceinstaller
Warning: ideviceinstaller 1.1.1 is already installed and up-to-date.
To reinstall 1.1.1, run:
brew reinstall ideviceinstaller

The `-n` argument

https://github.com/noobpk/frida-ios-hook/blob/master/frida-ios-hook/core/hook.py#L244

ModuleNotFoundError: No module named 'frida'

Steps to reproduce the behavior:

1. Ran command "python3 ioshook.py"
2. Produces
   Traceback (most recent call last):
   File "C:\frida\frida-ios-hook\core\hook.py", line 1, in
   import frida
   ModuleNotFoundError: No module named 'frida'

• OS: Windows 10

Not Detecting ideviceinstaller

Describe the bug
Not Detecting ideviceinstaller see error

To Reproduce
Steps to reproduce the behavior:

1. Install fresh Kali OS
2. Install ideviceinstaller
3. install frida-ios-hook
4. attempt to list apps with connected device that shows up

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

]
Desktop (please complete the following information):
Kali

Smartphone (please complete the following information):
iPhone 7 with checkra1n IOS 14.2

Additional context
Add any other context about the problem here.

TypeError: cannot read property [class name] of undefined, find-all-methods-all-classes.js

when running /find-all-methods-all-classes.js - many methods are listed, until class name has a "." (dot) in its name, for example:

Expected behavior
Should at least skip classes like that or try to list its methods (if those even are classes?)

• OS: macOS Mojave (intel, macbook pro), iOS 14.2, iPhone 7

How does one approach this issue?

Can't dump IPA - Unable to connect to port 2222 on 127.0.0.1 or ::1

Describe the bug
It always trying to connect to wrong IP and port if I try to dump regardless if I specified the IP and port in hook.js

[24-11-22 16:34:45] [ERROR] - [x_x] Something went wrong, please check your error message.
 Message - can only concatenate str (not "int") to str
[24-11-22 16:34:45] [INFO] - [*] Dumping...
[Errno None] Unable to connect to port 2222 on 127.0.0.1 or ::1

But app listing and SSH works fine, so the IP and port are correct

To Reproduce
Steps to reproduce the behavior:

1. python3 setup.py
2. python3 ioshook.py -d -p (package)

Desktop (please complete the following information):

• OS: Windows
• Version 11

Smartphone (please complete the following information):

• Device: iPad 9
• OS: iOS 14.6

AttributeError: 'str' object has no attribute 'decode'

Describe the bug
It fails to dump Mario Kart Tour on Windows

To Reproduce
Steps to reproduce the behavior:

1. Build for Windows

pip3 install -r requirements.txt
python3 setup.py
cd frida-ios-hook

2. Dump Mario Kart Tour using python3 ioshook -p com.nintendo.zaka -d

Logs

PS F:\Mobile-Modding\iOS\frida-ios-hook-new\frida-ios-hook> python3 ioshook -p com.nintendo.zaka -d


        _|    _|_|      _|_|_|      _|    _|                      _|
            _|    _|  _|            _|    _|    _|_|      _|_|    _|  _|
        _|  _|    _|    _|_|        _|_|_|_|  _|    _|  _|    _|  _|_|
        _|  _|    _|        _|      _|    _|  _|    _|  _|    _|  _|  _|
        _|    _|_|    _|_|_|        _|    _|    _|_|      _|_|    _|    _|
                        https://noobpk.github.io          #noobboy
                    Trace Class/Func & Modify Return Value

[*]___author___: @noobpk
[*]___version___: 3.8

[05-01-24 13:33:25] [ERROR] - [*] Iproxy process for port 2222 is dead.
[?] Do you want start iproxy 2222 22 (yes/no): yes
[05-01-24 13:33:29] [INFO] - [*] Start iproxy
waiting for connection
[05-01-24 13:33:31] [INFO] - [*] Dumping...
accepted connection, fd = 232
waiting for connection
Requesting connecion to USB device handle 15 (serial: 1995f8a7e2b9b18263745b75aa159bd40b29c488), port 22
run_ctos_loop: fd = 232
run_stoc_loop: fd = 232
[05-01-24 13:33:34] [INFO] - Connected (version 2.0, client OpenSSH_8.4)
[05-01-24 13:33:34] [INFO] - Authentication (password) successful!
[05-01-24 13:33:34] [INFO] - Start the target app com.nintendo.zaka
[05-01-24 13:33:34] [INFO] - Dumping Mario Kart to C:\Users\quocd\AppData\Local\Temp
 [frida-ios-dump]: Load  GTLR.framework success.
 [frida-ios-dump]: Load  UnityFramework.framework success.
 [Start Dump]:  /private/var/containers/Bundle/Application/AE45B6A3-8304-4820-9F87-018C415BDF42/zaka.app/zaka
0.00B [00:00, ?B/s]Traceback (most recent call last):
  File "D:\Python3\Lib\site-packages\frida\core.py", line 555, in _on_message
    callback(message, data)
  File "F:\Mobile-Modding\iOS\frida-ios-hook-new\frida-ios-hook\core\utils\dump.py", line 110, in on_message
    scp.get(scp_from, scp_to)
  File "D:\Python3\Lib\site-packages\scp.py", line 277, in get
    self._recv_all()
  File "D:\Python3\Lib\site-packages\scp.py", line 430, in _recv_all
    command[code](msg[1:])
  File "D:\Python3\Lib\site-packages\scp.py", line 480, in _recv_file
    self._progress(path, size, 0, self.peername)
  File "D:\Python3\Lib\site-packages\scp.py", line 147, in <lambda>
    self._progress = lambda *a: progress(*a[:3])
                                ^^^^^^^^^^^^^^^^
  File "F:\Mobile-Modding\iOS\frida-ios-hook-new\frida-ios-hook\core\utils\dump.py", line 95, in progress
    t.desc = os.path.basename(filename).decode("utf-8")
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'str' object has no attribute 'decode'
0.00B [00:00, ?B/s]
0.00B [00:00, ?B/s]Traceback (most recent call last):
  File "D:\Python3\Lib\site-packages\frida\core.py", line 555, in _on_message
    callback(message, data)
  File "F:\Mobile-Modding\iOS\frida-ios-hook-new\frida-ios-hook\core\utils\dump.py", line 128, in on_message
    scp.get(scp_from, scp_to, recursive=True)
  File "D:\Python3\Lib\site-packages\scp.py", line 277, in get
    self._recv_all()
  File "D:\Python3\Lib\site-packages\scp.py", line 430, in _recv_all
    command[code](msg[1:])
  File "D:\Python3\Lib\site-packages\scp.py", line 480, in _recv_file
    self._progress(path, size, 0, self.peername)
  File "D:\Python3\Lib\site-packages\scp.py", line 147, in <lambda>
    self._progress = lambda *a: progress(*a[:3])
                                ^^^^^^^^^^^^^^^^
  File "F:\Mobile-Modding\iOS\frida-ios-hook-new\frida-ios-hook\core\utils\dump.py", line 95, in progress
    t.desc = os.path.basename(filename).decode("utf-8")
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'str' object has no attribute 'decode'
0.00B [00:00, ?B/s]
0.00B [00:00, ?B/s]
[05-01-24 13:33:35] [INFO] - Generating "Mario Kart.ipa"
'app'
recv failed: connection reset

Desktop (please complete the following information):

• OS: Windows 11
• Browser: Chrome
• Version: 23H2

Smartphone (please complete the following information):

• Device: iPad 10.2 (2019)
• OS: iOS
• Browser: Safari
• Version: 14.6

ioshook --shell

Message - can only concatenate str (not "int") to str

frida_without_jailbreak_ipa.png mentioned in the README.md

I guess the file was just there in the folder but it's not used by the tool.

Error when I install it? looks like we are missing some required libraries?

When I use the setup.py install command, install in a venv. I get the following error when run the command. Not sure what libraries I'm missing?

Traceback (most recent call last):
  File "/home/randomuser/virtual-python3/bin/ioshook", line 11, in <module>
    load_entry_point('Frida-iOS-Hook==3.4', 'console_scripts', 'ioshook')()
  File "/home/randomuser/virtual-python3/lib/python3.9/site-packages/pkg_resources/__init__.py", line 489, in load_entry_point
    return get_distribution(dist).load_entry_point(group, name)
  File "/home/randomuser/virtual-python3/lib/python3.9/site-packages/pkg_resources/__init__.py", line 2852, in load_entry_point
    return ep.load()
  File "/home/randomuser/virtual-python3/lib/python3.9/site-packages/pkg_resources/__init__.py", line 2443, in load
    return self.resolve()
  File "/home/randomuser/virtual-python3/lib/python3.9/site-packages/pkg_resources/__init__.py", line 2449, in resolve
    module = __import__(self.module_name, fromlist=['__name__'], level=0)
ModuleNotFoundError: No module named 'core'

Hello, how do I hook MD5 encryption?

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like
A clear and concise description of what you want to happen.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Dump memory does not dump game binaries

It seems the Dump memory feature does not dump game binaries, especially Unity baed games with UnityFramefork binary. I searched for some pattern through all dump files using 010 editor but found nothing. I am missing something?

I know I can dump IPA but I would like to dump in real time to see changes

failed to get the task for process

When I'm trying to dump an app, I am getting following log:

[13-02-24 13:30:54] [INFO] - [] Iproxy process for port 2222 is alive.
[13-02-24 13:30:54] [INFO] - [] Dumping...
[13-02-24 13:30:54] [INFO] - Connected (version 2.0, client OpenSSH_9.2)
[13-02-24 13:30:55] [INFO] - Authentication (password) successful!
[13-02-24 13:30:55] [INFO] - Start the target app ...
failed to get the task for process 1507

I installed latest Frida and am jailbroken with palera1n on iOS 16.7, iPhone X.

Any idea what the issue might be?

Frida itself seems to work, like all test commands went through smoothly.

After executing the command once, the app is stuck and I have to restart the device to use it again.

ios-intercept-crypto-2.js TypeError: cannot read property 'toString' of undefined

IV:
TypeError: cannot read property 'toString' of undefined
at t (frida/runtime/hexdump.js:20)
at onEnter (C:\Users\legen\REPOS\frida-ios-hook\frida-ios-hook\frida-scripts\ios-intercept-crypto-2.js:55)
CCCrypt(operation: 0x1, CCAlgorithm: 0x0, CCOptions: 0x2, keyBytes: 0x281c80ca0, keyLength: 0x10, ivBuffer: 0x0, inBuffer: 0x10a3cc800, inLength: 0x5b0, outBuffer: 0x10a35dc20, outLength: 0x5c0, outCountPtr: 0x16b781138)

It won't properly dump the IV value of any of the intercepted CCCrypt methods

Frida not being recognized

Hello, I am also in the comments of the youtube video so this is a bit of a double post, I tried to setup frida on both a windows and Mac laptop and both times I was met with this strange error where frida wasn’t being recognized despite being installed:

./ioshook -h
Traceback (most recent call last):
File “/Users/user/Downloads/frida-ios-hook-3.7/frida-ios-hook/core/hook.py”, line 1, in import frida
ModuleNotFoundError: No module named “frida”

how do I fix this? Thank you

DumpDecrypt issue

Describe the bug
I run iProxy 2222 22 and I connect to my client via USB then immediately get an error saying Auth (password) failed. Is this a password on the app itself or a password i'm failing to pass along via iproxy??

To Reproduce
Steps to reproduce the behavior:

1. Connect device via USB.
2. On a terminal tab run iproxy 2222 22
3. On a seperate tab go to frida-ios-hook-3.7/frida-ios-hook/ folder after following install directions of latest release.
4. run ./ioshook -p [app identifier] --dump
5. See below for error message.

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots

Desktop (please complete the following information):

• OS: Ventura 13.0.1
• Hardware: M2

Smartphone (please complete the following information):

• Device: jailbroken iPhone 6
• OS: iOS12.5.6

Additional context
Tried frida-ios-dump too and it did not work as well.

Windows ERROR

windows ERROR

Your platform currently does not support.

https://i.imgur.com/6lbJN11.png

Missing credit

@noobpk I noticed you removed credit to original author: https://github.com/interference-security/frida-scripts/tree/master/iOS