ios逆向-frida安装爬坑

Mac 电脑本身已经安装python2,
因为Xcode的原因，也存在python3,
通过以上的python环境安装frida，经过了好长时间也没能安装成功。
然后采用下载python3的方法、安装frida.

一： 安装工具

1.下载python3安装（我下载的是3.8.1）。
2.在 ~/.bash_profile里面配置路径alias python="/usr/local/bin/python3"
3.在终端输入：pip3 install frida_tools,会出现下面错误。

 Running setup.py install for frida ... error
    ERROR: Command errored out with exit status 1:
     command: /Library/Frameworks/Python.framework/Versions/3.8/bin/python3.8 -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/private/var/folders/lg/z3cxc9rd0rl0yrwng3kp840r0000gn/T/pip-install-3dqu7nkc/frida/setup.py'"'"'; __file__='"'"'/private/var/folders/lg/z3cxc9rd0rl0yrwng3kp840r0000gn/T/pip-install-3dqu7nkc/frida/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record /private/var/folders/lg/z3cxc9rd0rl0yrwng3kp840r0000gn/T/pip-record-e2hgfydo/install-record.txt --single-version-externally-managed --compile
         cwd: /private/var/folders/lg/z3cxc9rd0rl0yrwng3kp840r0000gn/T/pip-install-3dqu7nkc/frida/
    Complete output (13 lines):
    running install
    running build
    running build_py
    creating build
    creating build/lib.macosx-10.9-x86_64-3.8
    creating build/lib.macosx-10.9-x86_64-3.8/frida
    copying frida/__init__.py -> build/lib.macosx-10.9-x86_64-3.8/frida
    copying frida/core.py -> build/lib.macosx-10.9-x86_64-3.8/frida
    running build_ext
    looking for prebuilt extension in home directory, i.e. /Users/luopan/frida-12.10.4-py3.8-macosx-10.9-x86_64.egg
    prebuilt extension not found in home directory, will try downloading it
    querying pypi for available prebuilds
    error: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)>
    ----------------------------------------
ERROR: Command errored out with exit status 1: /Library/Frameworks/Python.framework/Versions/3.8/bin/python3.8 -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/private/var/folders/lg/z3cxc9rd0rl0yrwng3kp840r0000gn/T/pip-install-3dqu7nkc/frida/setup.py'"'"'; __file__='"'"'/private/var/folders/lg/z3cxc9rd0rl0yrwng3kp840r0000gn/T/pip-install-3dqu7nkc/frida/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record /private/var/folders/lg/z3cxc9rd0rl0yrwng3kp840r0000gn/T/pip-record-e2hgfydo/install-record.txt --single-version-externally-managed --compile Check the logs for full command output.

4.找到下面文件点击更新。重新执行第3步，frida安装成功。

image.png

5.配置Frida-iOS-dump环境

sudo mkdir /opt/dump && cd /opt/dump && sudo git clone https://github.com/AloneMonkey/frida-ios-dump

6.安装依赖

sudo pip install -r /opt/dump/frida-ios-dump/requirements.txt --upgrade

7.设置别名dump.py

vim ~/.bash_profile   
alias dump.py="/opt/dump/frida-ios-dump/dump.py"
source ~/.bash_profile

二： 查看效果

1.一个终端输入

iproxy 2222 22

2. 链接手机，另一个终端

ssh -p 2222 root@127.0.0.1

注意1.2我自己使用的自己本地之前的连接方式

3.查看当前安装应用

cd /opt/dump/frida-ios-dump
dump.py -l

问题一：[ImportError: No module named frida

改变dump.py里面phtyon的运行环境为安装frida的环境
修改 `#!/usr/bin/env python` 为 `#!/usr/bin/env python3`
解决方法

问题二：Authentication failed

dump.py里的ssh登录User和Password配错了

4.开始dump，脱壳后的App.ipa会放在当前目录中

dump.py  boundId（./dump.py boundId）

dump.py -l 查看需要砸壳的应用。

注意：

把frida-ios-dump放到opt/dump/路径下面，因为权限问题会导致dump.py boundId生成不了ipa包。
建议在桌面路径下存放dump.py boundId(直接在dump.py路径下执行./dump.py boundId)。