IOS逆向（零）环境准备

Time_999

873人浏览 · 2023-11-01 16:23:49

Time_999 · 2023-11-01 16:23:49 发布

一、系统环境

[iPhone 6] IOS 12.5.8

[MacBook Pro] macOS Monterey 12.2.1

[Xcode] 13.4.1(13F100)

[Python] 3.7.3

二、设备环境

越狱

如果不清楚哪个版本的iphone可以越狱，就到(https://canijailbreak.com/)这个网站去查询看看自己的系统可以用哪个工具越狱然后下载越狱，或者使用爱思助手(https://www.i4.cn/)进行越狱。

#IOS 12.5.8版本使用checkra1n越狱(这种方式重启后就会失效，所以最好保持手机持续开机状态)

1.从官网下载checkra1n
https://checkra.in/

2.运行checkra1n按照界面提示操作

3.等待越狱完成


如果遇到USB Error(Error code:-10)就要更换下面的方式


使用命令行进行越狱：

1. cd /Applications/checkra1n.app/Contents/MacOS

2. ./checkra1n -cv

3. 先进入恢复模式
a.使用爱思助手
b.同时按住home键和开机键（持续10秒），出现苹果图标后，松开开机键，继续按住home键（直到出现 iTunes图标）

4. 进入DFU模式
同时长按home键和开机键（5秒），松开开机键，持续按住home键（10秒）

#越狱过程中可能会出现错误，多重试几遍最终会成功

越狱成功后打开设备上的checkra1n安装Cydia（网络原因需要一定时间）

2.安装越狱插件

Cydia中添加下面的软件源

ABCydia/雷锋源-雷锋源 | 最简洁的中文源

apt.bingner.com-Index of /

apt.cydia.love-Ant 蚂蚁源 | 最简洁的Cydia中文源

BigBoss-http://apt.thebigboss.org/repofiles/cydia

Chariz-Chariz

Cydiakk中文源-CydiaKK源中文网

Cydia刀八木-Cydia™(氵刀八木) | 最简洁的中文源

Delta-Delta: Cydia Repo

Dynastic Repo-Dynastic Repo Archive

Karen/Repo-Home :: Karen's Repo

ModMyi(Archive)-http://apt.modmyi.com

ZodTTD & MacCiti(Archive)-http://cydia.zodttd.com/repo/cydia

多米诺骨牌源-https://apt.wxhbts.vip

build.frida.re-build.frida.re

Cydia中搜索安装下面的插件

Apple File Conduit "2"
又称为"afc2add"简称"AFC2"，用于爱思助手访问IOS设备的用户和越狱目录

adv-cmds
查看进程信息的ps命令

AppSync Unified
用于安装和运行脱壳后的应用，原理是绕过系统对应用的签名验证

Filza File Manager
浏览手机文件、修改文件权限等

NewTerm 2
在手机上运行的终端工具

OpenSSH
SSH(Secure Shell)，用于pc远程连接到IOS设备输入命令操作,默认密码是"alpine"，安装OpenSSH并连接后最好是修改密码，修改密码命令是passwd，根据提示修改即可

Cydia Installer - 升级 Cydia 版本

Cydia Substrate - 安装触动精灵、触动精灵获取点击权限

iFile文件管理器- 查看越狱系统目录、安装 deb 文件

Substrate Safe Mode - 当系统异常时自动进入安全模式

安装插件后如果界面上没有出现图标就在iphone执行下面的命令刷新缓存

$ uicache -a

3.设备连接

3.1 ssh方式

设备ip地址查看方法：设置-无线局域网-连接的wifi名称最右边感叹号图标-- IP地址

$ ssh root@192.168.0.100

3.2 usb方式（动态调试时推荐使用）

mac安装usbmuxd(安装后才能使用iproxy)

$ brew install usbuxd

端口映射

$ iproxy 2222 22 [设备UUID]

如果要保持正常连接，上面输入这条命令的终端不能关闭，也不能按Ctrl+C中断

有多台设备同时连接到mac就需要输入设备UUID，否则不需要

连接设备

新开一个终端输入下面命令连接

$ ssh -p 2222 root@127.0.0.1

如果连接时出现 "Host Key verification failed"的错误，就需要根据输出的错误提示到mac目录找到known_hosts文件删除里面的127.0.0.1记录，再重新操作即可

4.文件传输

从mac复制文件到ios

$ scp -p 2222 ./1.txt root@127.0.0.1:/root/

从ios复制文件到mac

$ scp -p 2222 root@127.0.0.1:/root/1.txt ./

参考：

https://blog.csdn.net/yishengzhiai005/article/details/147085679

checkra1n越狱过程

macdeMacBook-Pro:MacOS mac$ ./checkra1n -cv
#
# Checkra1n beta 0.12.4
#
# Proudly written in nano
# (c) 2019-2021 Kim Jong Cracks
#
#========  Made by  =======
# argp, axi0mx, danyl931, jaywalker, kirb, littlelailo, nitoTV
# never_released, nullpixel, pimskeks, qwertyoruiop, sbingner, siguza
#======== Thanks to =======
# haifisch, jndok, jonseals, xerub, lilstevie, psychotea, sferrini
# Cellebrite (ih8sn0w, cjori, ronyrus et al.)
#==========================

 - [02/23/26 10:30:58] <Info>: Waiting for DFU devices
 - [02/23/26 10:33:56] <Verbose>: DFU mode device found
 - [02/23/26 10:33:56] <Info>: Exploiting
 - [02/23/26 10:33:56] <Verbose>: Attempting to perform checkm8 on 7000 11...
 - [02/23/26 10:33:56] <Info>: Checking if device is ready
 - [02/23/26 10:33:56] <Verbose>: == Checkm8 Preparation stage ==
 - [02/23/26 10:33:56] <Verbose>: DFU device disconnected
 - [02/23/26 10:33:56] <Verbose>: DFU mode device found
 - [02/23/26 10:33:56] <Error>: Unable to open device: e00002c5 (error code: -10)
 - [02/23/26 10:34:21] <Error>: Timed out in state 1, assuming we are back to square one with this device. (error code: -31)
 - [02/23/26 10:35:49] <Verbose>: DFU device disconnected
 - [02/23/26 10:43:40] <Verbose>: DFU mode device found
 - [02/23/26 10:43:40] <Info>: Exploiting
 - [02/23/26 10:43:40] <Verbose>: Attempting to perform checkm8 on 7000 11...
 - [02/23/26 10:43:40] <Info>: Checking if device is ready
 - [02/23/26 10:43:40] <Verbose>: == Checkm8 Preparation stage ==
 - [02/23/26 10:43:40] <Verbose>: DFU device disconnected
 - [02/23/26 10:43:40] <Verbose>: DFU mode device found
 - [02/23/26 10:43:41] <Info>: Setting up the exploit (this is the heap spray)
 - [02/23/26 10:43:41] <Verbose>: == Checkm8 Setup stage ==
 - [02/23/26 10:43:41] <Info>: Right before trigger (this is the real bug setup)
 - [02/23/26 10:43:41] <Verbose>: Entered initial checkm8 state after 3 steps, issuing DFU abort..
 - [02/23/26 10:43:41] <Verbose>: DFU device disconnected
 - [02/23/26 10:43:41] <Verbose>: DFU mode device found
 - [02/23/26 10:43:41] <Error>: Unable to open device: e00002c5 (error code: -10)
 - [02/23/26 10:44:07] <Error>: Timed out in state 2, assuming we are back to square one with this device. (error code: -31)
 - [02/23/26 10:56:03] <Verbose>: DFU device disconnected
 - [02/23/26 11:12:56] <Verbose>: DFU mode device found
 - [02/23/26 11:12:56] <Info>: Exploiting
 - [02/23/26 11:12:56] <Verbose>: Attempting to perform checkm8 on 7000 11...
 - [02/23/26 11:12:56] <Info>: Checking if device is ready
 - [02/23/26 11:12:56] <Verbose>: == Checkm8 Preparation stage ==
 - [02/23/26 11:12:57] <Verbose>: DFU device disconnected
 - [02/23/26 11:12:57] <Verbose>: DFU mode device found
 - [02/23/26 11:12:57] <Info>: Setting up the exploit (this is the heap spray)
 - [02/23/26 11:12:57] <Verbose>: == Checkm8 Setup stage ==
 - [02/23/26 11:12:57] <Info>: Right before trigger (this is the real bug setup)
 - [02/23/26 11:12:57] <Verbose>: Entered initial checkm8 state after 3 steps, issuing DFU abort..
 - [02/23/26 11:12:57] <Verbose>: DFU device disconnected
 - [02/23/26 11:12:57] <Verbose>: DFU mode device found
 - [02/23/26 11:12:57] <Verbose>: == Checkm8 Trigger stage ==
 - [02/23/26 11:12:58] <Verbose>: Checkmate!
 - [02/23/26 11:12:58] <Verbose>: DFU device disconnected
 - [02/23/26 11:12:58] <Verbose>: DFU mode device found
 - [02/23/26 11:12:58] <Verbose>: == Checkm8 Trying to run payload... ==
 - [02/23/26 11:12:58] <Verbose>: If everything went correctly, you should now have code execution.
 - [02/23/26 11:12:58] <Verbose>: DFU device disconnected
 - [02/23/26 11:12:59] <Info>: Entered download mode
 - [02/23/26 11:12:59] <Verbose>: Download mode device found
 - [02/23/26 11:12:59] <Info>: Booting...
 - [02/23/26 11:12:59] <Verbose>: Setting bootargs to: rootdev=md0
 - [02/23/26 11:13:00] <Verbose>: Download mode device disconnected
 - [02/23/26 11:13:21] <Info>: All Done
 - [02/23/26 11:13:21] <Verbose>: Bootstrap already installed, done
 - [02/23/26 11:15:29] <Verbose>: DFU mode device found
 - [02/23/26 11:15:29] <Info>: Exploiting
 - [02/23/26 11:15:29] <Verbose>: Attempting to perform checkm8 on 7000 11...
 - [02/23/26 11:15:29] <Info>: Checking if device is ready
 - [02/23/26 11:15:29] <Verbose>: == Checkm8 Preparation stage ==
 - [02/23/26 11:15:29] <Verbose>: DFU device disconnected
 - [02/23/26 11:15:29] <Verbose>: DFU mode device found
 - [02/23/26 11:15:30] <Info>: Setting up the exploit (this is the heap spray)
 - [02/23/26 11:15:30] <Verbose>: == Checkm8 Setup stage ==
 - [02/23/26 11:15:30] <Info>: Right before trigger (this is the real bug setup)
 - [02/23/26 11:15:30] <Verbose>: Entered initial checkm8 state after 3 steps, issuing DFU abort..
 - [02/23/26 11:15:30] <Verbose>: DFU device disconnected
 - [02/23/26 11:15:30] <Verbose>: DFU mode device found
 - [02/23/26 11:15:30] <Verbose>: == Checkm8 Trigger stage ==
 - [02/23/26 11:15:30] <Verbose>: Checkmate!
 - [02/23/26 11:15:30] <Verbose>: DFU device disconnected
 - [02/23/26 11:15:30] <Verbose>: DFU mode device found
 - [02/23/26 11:15:31] <Verbose>: == Checkm8 Trying to run payload... ==
 - [02/23/26 11:15:31] <Verbose>: If everything went correctly, you should now have code execution.
 - [02/23/26 11:15:31] <Verbose>: DFU device disconnected
 - [02/23/26 11:15:31] <Info>: Entered download mode
 - [02/23/26 11:15:31] <Verbose>: Download mode device found
 - [02/23/26 11:15:32] <Info>: Booting...
 - [02/23/26 11:15:32] <Verbose>: Setting bootargs to: rootdev=md0
 - [02/23/26 11:15:33] <Verbose>: Download mode device disconnected
 - [02/23/26 11:15:55] <Info>: All Done
 - [02/23/26 11:15:55] <Verbose>: Bootstrap already installed, done
 - [02/23/26 11:17:09] <Verbose>: DFU mode device found
 - [02/23/26 11:17:09] <Info>: Exploiting
 - [02/23/26 11:17:09] <Verbose>: Attempting to perform checkm8 on 7000 11...
 - [02/23/26 11:17:09] <Info>: Checking if device is ready
 - [02/23/26 11:17:09] <Verbose>: == Checkm8 Preparation stage ==
 - [02/23/26 11:17:09] <Verbose>: DFU device disconnected
 - [02/23/26 11:17:09] <Verbose>: DFU mode device found
 - [02/23/26 11:17:09] <Info>: Setting up the exploit (this is the heap spray)
 - [02/23/26 11:17:09] <Verbose>: == Checkm8 Setup stage ==
 - [02/23/26 11:17:09] <Info>: Right before trigger (this is the real bug setup)
 - [02/23/26 11:17:09] <Verbose>: Entered initial checkm8 state after 1 steps, issuing DFU abort..
 - [02/23/26 11:17:09] <Verbose>: DFU device disconnected
 - [02/23/26 11:17:09] <Verbose>: DFU mode device found
 - [02/23/26 11:17:10] <Verbose>: == Checkm8 Trigger stage ==
 - [02/23/26 11:17:10] <Verbose>: Checkmate!
 - [02/23/26 11:17:10] <Verbose>: DFU device disconnected
 - [02/23/26 11:17:10] <Verbose>: DFU mode device found
 - [02/23/26 11:17:10] <Verbose>: == Checkm8 Trying to run payload... ==
 - [02/23/26 11:17:10] <Verbose>: If everything went correctly, you should now have code execution.
 - [02/23/26 11:17:10] <Verbose>: DFU device disconnected
 - [02/23/26 11:17:11] <Info>: Entered download mode
 - [02/23/26 11:17:11] <Verbose>: Download mode device found
 - [02/23/26 11:17:11] <Info>: Booting...
 - [02/23/26 11:17:11] <Verbose>: Setting bootargs to: rootdev=md0
 - [02/23/26 11:17:12] <Verbose>: Download mode device disconnected
 - [02/23/26 11:17:34] <Info>: All Done
 - [02/23/26 11:17:34] <Verbose>: Bootstrap already installed, done
 - [02/23/26 11:18:06] <Verbose>: DFU mode device found
 - [02/23/26 11:18:06] <Info>: Exploiting
 - [02/23/26 11:18:06] <Verbose>: Attempting to perform checkm8 on 7000 11...
 - [02/23/26 11:18:06] <Info>: Checking if device is ready
 - [02/23/26 11:18:06] <Verbose>: == Checkm8 Preparation stage ==
 - [02/23/26 11:18:07] <Verbose>: DFU device disconnected
 - [02/23/26 11:18:07] <Verbose>: DFU mode device found
 - [02/23/26 11:18:07] <Error>: Unable to open device: e00002c5 (error code: -10)
 - [02/23/26 11:18:31] <Error>: Timed out in state 1, assuming we are back to square one with this device. (error code: -31)
 - [02/23/26 11:19:10] <Verbose>: DFU device disconnected
 - [02/23/26 11:20:37] <Verbose>: DFU mode device found
 - [02/23/26 11:20:37] <Info>: Exploiting
 - [02/23/26 11:20:37] <Verbose>: Attempting to perform checkm8 on 7000 11...
 - [02/23/26 11:20:37] <Info>: Checking if device is ready
 - [02/23/26 11:20:37] <Verbose>: == Checkm8 Preparation stage ==
 - [02/23/26 11:20:37] <Verbose>: DFU device disconnected
 - [02/23/26 11:20:37] <Verbose>: DFU mode device found
 - [02/23/26 11:20:37] <Info>: Setting up the exploit (this is the heap spray)
 - [02/23/26 11:20:37] <Verbose>: == Checkm8 Setup stage ==
 - [02/23/26 11:20:37] <Info>: Right before trigger (this is the real bug setup)
 - [02/23/26 11:20:37] <Verbose>: Entered initial checkm8 state after 3 steps, issuing DFU abort..
 - [02/23/26 11:20:37] <Verbose>: DFU device disconnected
 - [02/23/26 11:20:37] <Verbose>: DFU mode device found
 - [02/23/26 11:20:38] <Error>: Unable to open device: e00002c5 (error code: -10)
 - [02/23/26 11:21:05] <Error>: Timed out in state 2, assuming we are back to square one with this device. (error code: -31)
 - [02/23/26 11:21:33] <Verbose>: DFU device disconnected
 - [02/23/26 11:22:29] <Verbose>: DFU mode device found
 - [02/23/26 11:22:29] <Info>: Exploiting
 - [02/23/26 11:22:29] <Verbose>: Attempting to perform checkm8 on 7000 11...
 - [02/23/26 11:22:29] <Info>: Checking if device is ready
 - [02/23/26 11:22:29] <Verbose>: == Checkm8 Preparation stage ==
 - [02/23/26 11:22:29] <Verbose>: DFU device disconnected
 - [02/23/26 11:22:29] <Verbose>: DFU mode device found
 - [02/23/26 11:22:30] <Info>: Setting up the exploit (this is the heap spray)
 - [02/23/26 11:22:30] <Verbose>: == Checkm8 Setup stage ==
 - [02/23/26 11:22:30] <Info>: Right before trigger (this is the real bug setup)
 - [02/23/26 11:22:30] <Verbose>: Entered initial checkm8 state after 3 steps, issuing DFU abort..
 - [02/23/26 11:22:30] <Verbose>: DFU device disconnected
 - [02/23/26 11:22:30] <Verbose>: DFU mode device found
 - [02/23/26 11:22:30] <Verbose>: == Checkm8 Trigger stage ==
 - [02/23/26 11:22:30] <Verbose>: Checkmate!
 - [02/23/26 11:22:30] <Verbose>: DFU device disconnected
 - [02/23/26 11:22:30] <Verbose>: DFU mode device found
 - [02/23/26 11:22:31] <Verbose>: == Checkm8 Trying to run payload... ==
 - [02/23/26 11:22:31] <Verbose>: If everything went correctly, you should now have code execution.
 - [02/23/26 11:22:31] <Verbose>: DFU device disconnected
 - [02/23/26 11:22:31] <Info>: Entered download mode
 - [02/23/26 11:22:31] <Verbose>: Download mode device found
 - [02/23/26 11:22:32] <Info>: Booting...
 - [02/23/26 11:22:32] <Verbose>: Setting bootargs to: rootdev=md0
 - [02/23/26 11:22:33] <Verbose>: Download mode device disconnected
 - [02/23/26 11:22:53] <Info>: All Done
 - [02/23/26 11:22:53] <Verbose>: Bootstrap already installed, done
 - [02/23/26 11:23:25] <Verbose>: DFU mode device found
 - [02/23/26 11:23:25] <Info>: Exploiting
 - [02/23/26 11:23:25] <Verbose>: Attempting to perform checkm8 on 7000 11...
 - [02/23/26 11:23:25] <Info>: Checking if device is ready
 - [02/23/26 11:23:25] <Verbose>: == Checkm8 Preparation stage ==
 - [02/23/26 11:23:25] <Verbose>: DFU device disconnected
 - [02/23/26 11:23:25] <Verbose>: DFU mode device found
 - [02/23/26 11:23:26] <Error>: Unable to open device: e00002c5 (error code: -10)
 - [02/23/26 11:23:50] <Error>: Timed out in state 1, assuming we are back to square one with this device. (error code: -31)
 - [02/23/26 11:35:35] <Verbose>: DFU device disconnected
 - [02/23/26 11:43:20] <Verbose>: DFU mode device found
 - [02/23/26 11:43:21] <Info>: Exploiting
 - [02/23/26 11:43:21] <Verbose>: Attempting to perform checkm8 on 7000 11...
 - [02/23/26 11:43:21] <Info>: Checking if device is ready
 - [02/23/26 11:43:21] <Verbose>: == Checkm8 Preparation stage ==
 - [02/23/26 11:43:21] <Verbose>: DFU device disconnected
 - [02/23/26 11:43:21] <Verbose>: DFU mode device found
 - [02/23/26 11:43:21] <Error>: Unable to open device: e00002c5 (error code: -10)
 - [02/23/26 11:43:31] <Verbose>: DFU device disconnected
 - [02/23/26 11:43:31] <Verbose>: DFU mode device found
 - [02/23/26 11:43:31] <Error>: Unable to create a plug-in (e00002be) (error code: -6)
 - [02/23/26 11:43:31] <Verbose>: DFU mode device found
 - [02/23/26 11:43:31] <Info>: Setting up the exploit (this is the heap spray)
 - [02/23/26 11:43:31] <Verbose>: == Checkm8 Setup stage ==
 - [02/23/26 11:43:31] <Info>: Right before trigger (this is the real bug setup)
 - [02/23/26 11:43:31] <Verbose>: Entered initial checkm8 state after 1 steps, issuing DFU abort..
 - [02/23/26 11:43:31] <Verbose>: DFU device disconnected
 - [02/23/26 11:43:31] <Verbose>: DFU device disconnected
 - [02/23/26 11:43:31] <Verbose>: DFU mode device found
 - [02/23/26 11:43:32] <Verbose>: == Checkm8 Trigger stage ==
 - [02/23/26 11:43:32] <Verbose>: Checkmate!
 - [02/23/26 11:43:32] <Verbose>: DFU device disconnected
 - [02/23/26 11:43:57] <Error>: Timed out in state 3, assuming we are back to square one with this device. (error code: -31)
 - [02/23/26 11:51:31] <Verbose>: DFU mode device found
 - [02/23/26 11:51:31] <Info>: Exploiting
 - [02/23/26 11:51:31] <Verbose>: Attempting to perform checkm8 on 7000 11...
 - [02/23/26 11:51:31] <Info>: Checking if device is ready
 - [02/23/26 11:51:31] <Verbose>: == Checkm8 Preparation stage ==
 - [02/23/26 11:51:31] <Verbose>: DFU device disconnected
 - [02/23/26 11:51:31] <Verbose>: DFU mode device found
 - [02/23/26 11:51:32] <Info>: Setting up the exploit (this is the heap spray)
 - [02/23/26 11:51:32] <Verbose>: == Checkm8 Setup stage ==
 - [02/23/26 11:51:32] <Info>: Right before trigger (this is the real bug setup)
 - [02/23/26 11:51:32] <Verbose>: Entered initial checkm8 state after 3 steps, issuing DFU abort..
 - [02/23/26 11:51:32] <Verbose>: DFU device disconnected
 - [02/23/26 11:51:32] <Verbose>: DFU mode device found
 - [02/23/26 11:51:32] <Verbose>: == Checkm8 Trigger stage ==
 - [02/23/26 11:51:32] <Verbose>: Checkmate!
 - [02/23/26 11:51:33] <Verbose>: DFU device disconnected
 - [02/23/26 11:51:33] <Verbose>: DFU mode device found
 - [02/23/26 11:51:33] <Verbose>: == Checkm8 Trying to run payload... ==
 - [02/23/26 11:51:33] <Verbose>: If everything went correctly, you should now have code execution.
 - [02/23/26 11:51:33] <Verbose>: DFU device disconnected
 - [02/23/26 11:51:33] <Info>: Entered download mode
 - [02/23/26 11:51:33] <Verbose>: Download mode device found
 - [02/23/26 11:51:34] <Info>: Booting...
 - [02/23/26 11:51:34] <Verbose>: Setting bootargs to: rootdev=md0
 - [02/23/26 11:51:35] <Verbose>: Download mode device disconnected
 - [02/23/26 11:51:57] <Info>: All Done
 - [02/23/26 11:51:57] <Verbose>: Bootstrap already installed, done

2048 AI社区

有“AI”的1024 = 2048，欢迎大家加入2048 AI社区

更多推荐

Kubernetes CoreDNS 解析超时排查（ndots 与 NodeLocal DNSCache）

CoreDNS 超时先用 ClusterIP 直连排除数据面，再读 Pod的ndots 与 search。默认 ndots:5 让短名查询放大数倍，AAAA 再乘一倍。指标上区分 NXDOMAIN 瀑布和真正的 SERVFAIL/p99。NodeLocal DNSCache 降 RTT、不消灭放大；根上仍是 FQDN 或谨慎的 dnsConfig。改 DNS 全局配置必须可回滚，禁止先停 Core