Microsoft Word - iOSAppReverseEngineering.docx

(Romina) #1

Figure 5- 15 Incoming Calls


5.3.2 Locate files


Since this feature was inside Settings App, my first reaction was to look for suspicious files


under "/Applications/Preferences.app" and "/System/Library/PreferenceBundles/". What I’ve


done is roughly described as follows.


-^ Change the system language to English


Because the iOS filesystem was in English, I had set the system language to English before


analyzing, so that I was more likely to find correspondence between keywords from filesystem


and keywords displayed on UI.


-^ Discover keyword "Accessibility"


After I had changed the system language, the four-level menu has been translated from


Chinese to “Settings” → “General” → “Accessibility” → “Incoming Calls”. The keyword


“Accessibility” caught my attention. The reason was that without combining the context,


“Accessibility” was too generic to contain “Incoming Calls”. So I sshed to iOS and greped the


whole filesystem with keyword “Accessibility”. The result was as follows:


FunMaker-4s:~ root# grep -r Accessibility /
grep: /Applications/Activator.app/Default-568h@2x~iphone.png: No such file or directory
grep: /Applications/Activator.app/Default.png: No such file or directory
grep: /Applications/Activator.app/Default~iphone.png: No such file or directory
grep: /Applications/Activator.app/LaunchImage- 700 - [email protected]: No such file or directory
Free download pdf