In iOS reverse engineering, there is a key technology called "iOS App Decryption". Since the iOS 5 version, Apple has introduced an application encryption mechanism, which requires most applications to be shelled for reverse analysis. Therefore, developers, reverse engineers, and security researchers all need to understand this technology, because it is an essential process for iOS reversal. Let’s first look at the concepts of packing and unpacking in a broad sense.
Packing and unpacking
Packing and unpacking are concepts related to software security and reverse engineering. They are not only limited to the iOS platform, but also apply to other operating systems and platforms. They involve software protection and analysis technologies. The basic meaning of these two concepts will be introduced to you below.
Packaging
Packing refers to merging an executable file (such as an application, library file, etc.) with one or more additional shells (shells) to form a new executable file. The main purpose of this shell is to increase the security of the software, prevent unauthorized access and modification, and perform anti-debugging and anti-reverse engineering of the software. Packing technology is usually used by software developers or manufacturers to protect their intellectual property and source code.
On the Windows platform, special algorithms are used to change the encoding of EXE executable programs or DLL dynamic link library files (such as compression and encryption) to reduce file size or encrypt program encoding, or even avoid detection by anti-virus software. . Currently, the more commonly used shells include UPX, ASPack, PePack, PECompact and UPack, etc.
Unpacking
Unpacking refers to restoring a packed executable file to its original unpacked state so that it can be further analyzed, reverse engineered, or modified. Unpacking is usually used by security researchers, reverse engineers or hackers to bypass the protection mechanism of the packed software in order to obtain the internal logic of the protected software.
What is iOS shelling?
Compared to the iOS platform, the packing process comes from Apple’s official website. iOS shelling is when a reverse engineer strips an application of its encryption protection and restores it to an unencrypted version. Through this process, reverse engineers can obtain the original binary of the application, making code analysis and modification easier. Shell smashing provides reverse engineers with the ability to delve into the inner workings of an application, but it also requires operating within a legal and ethical framework.
iOS shell smashing tool
Implementing iOS shelling usually requires the use of specific tools that can help reverse engineers analyze and decrypt application binaries. Here are some commonly used tools:
Clutch: This is a commonly used iOS shell smashing tool that can help reverse engineers automatically decrypt applications. It supports multiple CPU architectures for easy use on different devices.
dumpdecrypted: This is another popular shell smashing tool that can be run on jailbroken devices to help extract decrypted versions of apps.
frida-ios-dump: A tool based on the Frida framework that can be used to decrypt iOS applications and export unencrypted binaries.
What can you do after breaking the shell?
Once the application has been successfully shelled, the reverse engineer can do more. The specific uses of shell smashing are:
Code analysis: Reverse engineers can gain an in-depth understanding of the application's logic and algorithms by reading unencrypted code, helping developers learn new technologies.
Customized development: After shelling, developers can develop customized functions, plug-ins and extensions for the application to enrich the functionality of the application.
Modify behavior: Reverse engineers can modify the behavior of the application, such as disabling ads, bypassing paid verification, etc.
Vulnerability discovery: After shelling, security researchers can more easily analyze applications and discover potential vulnerabilities and security risks.
Example: Using Clutch for iOS Shelling
The following is an example of using the Clutch tool to crack the iOS shell:
First, make sure your iOS device is jailbroken and the Clutch tool is installed. Open a terminal and connect to your device using SSH. Run the following command to unpack the specified application:
Clutch -iThis will list all installed apps and their app IDs.
Select the application you want to unshell and run the following command:
Clutch -d 应用IDThis will start the shelling process, decrypting the app’s binaries.
After the shelling is completed, you can find the decrypted application in the specified directory.