Microsoft Word - iOSAppReverseEngineering.docx

(Romina) #1

iPad 2 armv7


iPad mini armv7


The New iPad armv7


iPad with Retina display armv7s


iPad Air arm64


iPad Air 2 arm64


iPad mini with Retina display arm64


iPad mini 3 arm64


iPod touch 5 armv7


Table 4-1 iOS 8 Compatible devices


My device is iPhone 5, its matching ARM type is armv7s. Copy the raw debugserver from


iOS to “/Users/snakeninny/” on OSX.


snakeninnysiMac:~ snakeninny$ scp root@iOSIP:/Developer/usr/bin/debugserver
~/debugserver

Then help it lose some weight:


snakeninnysiMac:~ snakeninny$ lipo - thin armv7s ~/debugserver - output ~/debugserver

Note that you need to change “armv7s” here to the corresponding ARM type of your


device.



  1. Grant task_for_pid permission to debugserver


Download http://iosre.com/ent.xml to “/Users/snakeninny/” on OSX, then run the


following command:


snakeninnysiMac:~ snakeninny$ /opt/theos/bin/ldid -Sent.xml debugserver

Note, there is no space between “-S” and “ent.xml”.


If everything goes fine, ldid will take less than 5 seconds to finish its job. But if ldid gets stuck


and times out, just try another workaround: Download http://iosre.com/ent.plist to


“/Users/snakeninny/”, then run the following command:


snakeninnysiMac:~ snakeninny$ codesign -s - --entitlements ent.plist -f debugserver


  1. Copy the modified debugserver back to iOS


Copy the modified debugserver to iOS and grant it execute permission with the following


commands:


snakeninnysiMac:~ snakeninny$ scp ~/debugserver root@iOSIP:/usr/bin/debugserver
snakeninnysiMac:~ snakeninny$ ssh root@iOSIP
Free download pdf