iOS逆向使用frida-ios-dump砸壳

问题总结

1，使用usbmuxd SSH连接手机

iOS 12 需要用cydia在手机上安装 openssh，后才能连接ssh，执行命令

iproxy 2222 22

ssh -p 2222 root@127.0.0.1
root@127.0.0.1's password:

需要输入密码 iPhone root权限默认密码alpine
注意：这里有时候如果你外接鼠标了会连接错误，需要把鼠标拔掉或者指定id连接

2, dump.py 应用名或bundle id进行砸壳.

执行导出ipa操作时报错 ~/.cache/frida/gadget-ios.dylib

参考这个网址

$ gunzip frida-gadget-xx.y.zz-ios-universal.dylib.gz
$ mkdir -p ~/.cache/frida
$ cp frida-gadget-xx.y.zz-ios-universal.dylib ~/.cache/frida/gadget-ios.dylib

下载frida-gadget-xx.y.zz-ios-universal.dylib.gz，解压缩后执行命令 然后把文件copy到目标文件夹，注意改名字gadget-ios.dylib

3，导出文件时报权限问题报错

zip I/O error: Permission denied
zip error: Could not create output file (/opt/dump/frida-ios-dump/抖音短视频.ipa)
Command '(u'zip', u'-qr', u'/opt/dump/frida-ios-dump/\u6296\u97f3\u77ed\u89c6\u9891.ipa', u'./Payload')' returned non-zero exit status 15

解决办法：在命令行前面加了 sudo提升权限

frida-ios-dump git:(master) sudo python dump.py com.ss.iphone.ugc.Aweme
Start the target app com.ss.iphone.ugc.Aweme
Dumping 抖音短视频 to /tmp
[frida-ios-dump]: ByteRtcEngineKit.framework has been loaded.
[frida-ios-dump]: AgoraRtcEngineKit.framework has been loaded.
[frida-ios-dump]: EffectSDK_iOSShell.framework has been loaded.
start dump /var/containers/Bundle/Application/CED00218-4BAA-45BC-A92E-1694482BF9F0/Aweme.app/Aweme
Aweme.fid: 100%|██████████| 117M/117M [00:03<00:00, 34.6MB/s]
start dump /private/var/containers/Bundle/Application/CED00218-4BAA-45BC-A92E-1694482BF9F0/Aweme.app/Frameworks/AgoraRtcEngineKit.framework/AgoraRtcEngineKit
AgoraRtcEngineKit.fid: 100%|██████████| 7.69M/7.69M [00:00<00:00, 20.3MB/s]
start dump /private/var/containers/Bundle/Application/CED00218-4BAA-45BC-A92E-1694482BF9F0/Aweme.app/Frameworks/ByteRtcEngineKit.framework/ByteRtcEngineKit
ByteRtcEngineKit.fid: 100%|██████████| 7.80M/7.80M [00:00<00:00, 20.7MB/s]
start dump /var/containers/Bundle/Application/CED00218-4BAA-45BC-A92E-1694482BF9F0/Aweme.app/Frameworks/EffectSDK_iOSShell.framework/EffectSDK_iOSShell
EffectSDK_iOSShell.fid: 100%|██████████| 20.8M/20.8M [00:00<00:00, 30.8MB/s]
Assets.car: 384MB [00:25, 16.0MB/s]
0.00B [00:00, ?B/s]Generating "抖音短视频.ipa"
0.00B [00:00, ?B/s]
➜  frida-ios-dump git:(master)