Microsoft Word - iOSAppReverseEngineering.docx

(Romina) #1

Figure 5- 17 A complaint email to Shoghian


I was stuck on this problem for nearly half a month. During that period, I was always


thinking, what could iOS do inside the setter? Since preferences specifier plist used


PostNotification to notify changes of configuration files to other processes, and the


configuration of AccessibilitySettings was associated with MobilePhone, which happened to be


the mode of inter-process communication. Would accessibilitySetPreference:specifier: change


the configuration file and post a notification? To verify my guesses, I made use of


LibNotifyWatch by limneos to observe if there were any related notifications through manually


changing the configuration of “Incoming Calls”. Unexpectedly, it really made me a lucky hit.


FunMaker-4s:~ root# grep LibNotifyWatch: /var/log/syslog
Nov 26 00:09:20 FunMaker-4s Preferences[6488]: LibNotifyWatch: <CFNotificationCenter
0x1e875600 [0x39b4b100]> postNotificationName:UIViewAnimationDidCommitNotification
object:UIViewAnimationState userInfo:{
Nov 26 00:09:20 FunMaker-4s Preferences[6488]: LibNotifyWatch: <CFNotificationCenter
0x1e875600 [0x39b4b100]> postNotificationName:UIViewAnimationDidStopNotification
object:<UIViewAnimationState: 0x1ea74f20> userInfo:{
......
Nov 26 00:09:21 FunMaker-4s Preferences[6488]: LibNotifyWatch:
CFNotificationCenterPostNotification center=<CFNotificationCenter 0x1dd86bd0
[0x39b4b100]> name=com.apple.accessibility.defaultrouteforcall userInfo=(null)
deliverImmediately=1
Nov 26 00:09:21 FunMaker-4s Preferences[6488]: LibNotifyWatch: notify_post
com.apple.accessibility.defaultrouteforcall
......

I’ve found two notifications named “com.apple.accessibility.defaultrouteforcall”.


Combining them with previous mentioned deductions, there was no need to further explain.

Free download pdf