ios安全学习资料汇总

电玩女神 2022-07-17 02:08 308阅读 0赞

文章出处：[https://github.com/pandazheng/IosHackStudy][https_github.com_pandazheng_IosHackStudy]

### (1) IOS安全学习网站收集： ###

[http://samdmarshall.com][http_samdmarshall.com]  
[https://www.exploit-db.com][https_www.exploit-db.com]  
[https://reverse.put.as][https_reverse.put.as]  
[http://highaltitudehacks.com/security/][http_highaltitudehacks.com_security]  
[http://www.dllhook.com/][http_www.dllhook.com]  
[http://www.securitylearn.net/archives/][http_www.securitylearn.net_archives]  
[http://securitycompass.github.io/iPhoneLabs/index.html][http_securitycompass.github.io_iPhoneLabs_index.html]  
[http://security.ios-wiki.com][http_security.ios-wiki.com]  
[http://www.opensecuritytraining.info/IntroARM.html][http_www.opensecuritytraining.info_IntroARM.html]  
[https://truesecdev.wordpress.com/][https_truesecdev.wordpress.com]  
[http://resources.infosecinstitute.com/ios-application-security-part-1-setting-up-a-mobile-pentesting-platform/][http_resources.infosecinstitute.com_ios-application-security-part-1-setting-up-a-mobile-pentesting-platform]  
[http://esoftmobile.com/2014/02/14/ios-security/][http_esoftmobile.com_2014_02_14_ios-security]  
[http://bbs.iosre.com][http_bbs.iosre.com]  
[http://bbs.chinapyg.com][http_bbs.chinapyg.com]  
[http://blog.pangu.io/][http_blog.pangu.io]  
[http://yonsm.net/][http_yonsm.net]  
[http://nianxi.net/][http_nianxi.net]  
[http://cocoahuke.com/][http_cocoahuke.com]  
[https://blog.0xbbc.com][https_blog.0xbbc.com]  
[http://blog.imaou.com/][http_blog.imaou.com]  
[https://github.com/pandazheng/iOSAppReverseEngineering][https_github.com_pandazheng_iOSAppReverseEngineering]  
[http://drops.wooyun.org][http_drops.wooyun.org]  
[http://bbs.pediy.com][http_bbs.pediy.com]  
[http://www.blogfshare.com/][http_www.blogfshare.com]  
[https://github.com/michalmalik/osx-re-101][https_github.com_michalmalik_osx-re-101]  
[http://blog.qwertyoruiop.com/][http_blog.qwertyoruiop.com]  
[https://github.com/secmobi/wiki.secmobi.com][https_github.com_secmobi_wiki.secmobi.com]  
[http://contagioexchange.blogspot.com/][http_contagioexchange.blogspot.com]  
[http://contagiominidump.blogspot.com/][http_contagiominidump.blogspot.com]  
[https://github.com/secmobi][https_github.com_secmobi]  
[https://www.owasp.org/index.php/OWASP\_Mobile\_Security\_Project\#tab=Guide\_Development\_Project][https_www.owasp.org_index.php_OWASP_Mobile_Security_Project_tab_Guide_Development_Project]  
[http://blog.dornea.nu/2014/10/29/howto-ios-apps-static-analysis/][http_blog.dornea.nu_2014_10_29_howto-ios-apps-static-analysis]  
[http://www.dllhook.com/post/58.html][http_www.dllhook.com_post_58.html]  
[http://thexploit.com/category/secdev/][http_thexploit.com_category_secdev]  
[https://github.com/secmobi/wiki.secmobi.com][https_github.com_secmobi_wiki.secmobi.com]  
[https://github.com/mdsecresearch][https_github.com_mdsecresearch]  
[http://sectools.org/tag/os-x/][http_sectools.org_tag_os-x]  
[http://googleprojectzero.blogspot.com/][http_googleprojectzero.blogspot.com]  
[http://googleprojectzero.blogspot.com/2014/10/more-mac-os-x-and-iphone-sandbox.html][http_googleprojectzero.blogspot.com_2014_10_more-mac-os-x-and-iphone-sandbox.html]  
[http://www.macexploit.com/][http_www.macexploit.com]  
[https://code.google.com/p/google-security-research/issues/list?can=1&q=iOS&sort=-id&colspec=ID%20Type%20Status%20Priority%20Milestone%20Owner%20Summary][https_code.google.com_p_google-security-research_issues_list_can_1_q_iOS_sort_-id_colspec_ID_20Type_20Status_20Priority_20Milestone_20Owner_20Summary]  
[https://code.google.com/p/google-security-research/issues/list?can=1&q=OSX&sort=-id&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=tiles][https_code.google.com_p_google-security-research_issues_list_can_1_q_OSX_sort_-id_colspec_ID_Type_Status_Priority_Milestone_Owner_Summary_cells_tiles]  
[http://googleprojectzero.blogspot.com/2014/11/pwn4fun-spring-2014-safari-part-ii.html][http_googleprojectzero.blogspot.com_2014_11_pwn4fun-spring-2014-safari-part-ii.html]  
[https://www.blackhat.com/docs/us-15/materials/us-15-Lei-Optimized-Fuzzing-IOKit-In-iOS-wp.pdf][https_www.blackhat.com_docs_us-15_materials_us-15-Lei-Optimized-Fuzzing-IOKit-In-iOS-wp.pdf]  
[https://www.youtube.com/watch?v=rxUgw5bEG3Y][https_www.youtube.com_watch_v_rxUgw5bEG3Y]  
[https://www.theiphonewiki.com/wiki/Firmware][https_www.theiphonewiki.com_wiki_Firmware]  
[http://www.trustedbsd.org/mac.html][http_www.trustedbsd.org_mac.html]  
[http://googleprojectzero.blogspot.com/2014/10/more-mac-os-x-and-iphone-sandbox.html][http_googleprojectzero.blogspot.com_2014_10_more-mac-os-x-and-iphone-sandbox.html]  
[https://code.google.com/p/google-security-research/issues/list?can=1&q=OSX&sort=-id&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=tiles][https_code.google.com_p_google-security-research_issues_list_can_1_q_OSX_sort_-id_colspec_ID_Type_Status_Priority_Milestone_Owner_Summary_cells_tiles]  
[https://support.apple.com/zh-cn/HT205731][https_support.apple.com_zh-cn_HT205731]  
[https://www.apple.com/support/security/][https_www.apple.com_support_security]  
[http://opensource.apple.com/tarballs/][http_opensource.apple.com_tarballs]  
[https://mobile-security.zeef.com/oguzhan.topgu][https_mobile-security.zeef.com_oguzhan.topgu]  
[http://www.powerofcommunity.net][http_www.powerofcommunity.net]  
[http://cn.0day.today/exploits][http_cn.0day.today_exploits]  
[https://recon.cx/2016/training/trainingios-osx.html][https_recon.cx_2016_training_trainingios-osx.html]  
[https://www.exploit-db.com/osx-rop-exploits-evocam-case-study/][https_www.exploit-db.com_osx-rop-exploits-evocam-case-study]  
[https://www.offensive-security.com/vulndev/evocam-remote-buffer-overflow-on-osx/][https_www.offensive-security.com_vulndev_evocam-remote-buffer-overflow-on-osx]  
[https://www.yumpu.com/en/document/view/7010924/ios-kernel-heap-armageddon][https_www.yumpu.com_en_document_view_7010924_ios-kernel-heap-armageddon]  
[http://contagiodump.blogspot.com/][http_contagiodump.blogspot.com]  
[http://www.dllhook.com/post/138.html][http_www.dllhook.com_post_138.html]  
[http://shell-storm.org/blog/Return-Oriented-Programming-and-ROPgadget-tool/][http_shell-storm.org_blog_Return-Oriented-Programming-and-ROPgadget-tool]  
[https://medium.com/@harryworld/100-days-of-osx-development-e61591fcb8c8\#.vxyuyse12][https_medium.com_harryworld_100-days-of-osx-development-e61591fcb8c8_.vxyuyse12]  
[http://www.poboke.com/study/reverse][http_www.poboke.com_study_reverse]  
[https://www.offensive-security.com/vulndev/evocam-remote-buffer-overflow-on-osx/][https_www.offensive-security.com_vulndev_evocam-remote-buffer-overflow-on-osx]  
[https://www.exploit-db.com/osx-rop-exploits-evocam-case-study/][https_www.exploit-db.com_osx-rop-exploits-evocam-case-study]  
[http://phrack.org/issues/69/1.html][http_phrack.org_issues_69_1.html]  
[https://www.exploit-db.com/docs/28479.pdf][https_www.exploit-db.com_docs_28479.pdf]  
[https://speakerdeck.com/milkmix/ios-malware-myth-or-reality][https_speakerdeck.com_milkmix_ios-malware-myth-or-reality]

### (2) IOS安全优秀博客文章 ###

[http://datatheorem.github.io/TrustKit/][http_datatheorem.github.io_TrustKit]  
[http://ho.ax/posts/2012/02/resolving-kernel-symbols/][http_ho.ax_posts_2012_02_resolving-kernel-symbols]  
[http://www.securitylearn.net/tag/pentesting-ios-apps/][http_www.securitylearn.net_tag_pentesting-ios-apps]  
[https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/][https_truesecdev.wordpress.com_2015_04_09_hidden-backdoor-api-to-root-privileges-in-apple-os-x]  
[https://github.com/secmobi/wiki.secmobi.com][https_github.com_secmobi_wiki.secmobi.com]  
[http://bbs.iosre.com/t/debugserver-lldb-gdb/65][http_bbs.iosre.com_t_debugserver-lldb-gdb_65]  
[http://bbs.pediy.com/showthread.php?t=193859][http_bbs.pediy.com_showthread.php_t_193859]  
[http://bbs.pediy.com/showthread.php?t=192657&viewgoodnees=1&prefixid=][http_bbs.pediy.com_showthread.php_t_192657_viewgoodnees_1_prefixid]  
[http://blog.darkrainfall.org/2013/01/os-x-internals/][http_blog.darkrainfall.org_2013_01_os-x-internals]  
[http://dvlabs.tippingpoint.com/blog/2009/03/06/reverse-engineering-iphone-appstore-binaries][http_dvlabs.tippingpoint.com_blog_2009_03_06_reverse-engineering-iphone-appstore-binaries]  
[http://drops.wooyun.org/papers/5309][http_drops.wooyun.org_papers_5309]  
[http://www.blogfshare.com/category/ios-secure][http_www.blogfshare.com_category_ios-secure]  
[https://www.safaribooksonline.com/library/view/hacking-and-securing/9781449325213/ch08s04.html][https_www.safaribooksonline.com_library_view_hacking-and-securing_9781449325213_ch08s04.html]  
[http://soundly.me/osx-injection-override-tutorial-hello-world/][http_soundly.me_osx-injection-override-tutorial-hello-world]  
[https://nadavrub.wordpress.com/2015/07/23/injecting-code-to-an-ios-appstore-app/][https_nadavrub.wordpress.com_2015_07_23_injecting-code-to-an-ios-appstore-app]  
[http://blog.dewhurstsecurity.com/][http_blog.dewhurstsecurity.com]  
[https://github.com/project-imas][https_github.com_project-imas]  
[https://github.com/iSECPartners][https_github.com_iSECPartners]  
[https://www.nowsecure.com/blog/][https_www.nowsecure.com_blog]  
[http://lightbulbone.com/][http_lightbulbone.com]  
[http://www.tanhao.me/pieces/1515.html/][http_www.tanhao.me_pieces_1515.html]  
[http://dongaxis.github.io/][http_dongaxis.github.io]  
[https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/][https_truesecdev.wordpress.com_2015_04_09_hidden-backdoor-api-to-root-privileges-in-apple-os-x]

### (3) IOS安全优秀GitHub ###

Contains all example codes for O'Reilly's iOS 9 Swift Programming Cookbook  
[https://github.com/vandadnp/iOS-9-Swift-Programming-Cookbook][https_github.com_vandadnp_iOS-9-Swift-Programming-Cookbook]  
XCodeGhost清除脚本  
[https://github.com/pandazheng/XCodeGhost-Clean][https_github.com_pandazheng_XCodeGhost-Clean]  
Apple OS X ROOT提权API后门  
[https://github.com/tihmstar/rootpipe\_exploit][https_github.com_tihmstar_rootpipe_exploit]  
Effortless and universal SSL pinning for iOS and OS X  
[https://github.com/datatheorem/TrustKit][https_github.com_datatheorem_TrustKit]  
Patch PE, ELF, Mach-O binaries with shellcode  
[https://github.com/secretsquirrel/the-backdoor-factory][https_github.com_secretsquirrel_the-backdoor-factory]  
iReSign allows iDevice app bundles (.ipa) files to be signed or resigned with a digital certificate from Apple for distribution  
[https://github.com/maciekish/iReSign][https_github.com_maciekish_iReSign]  
A Mach-O Load Command deobfuscator  
[https://github.com/x43x61x69/Mach-O-Prettifier][https_github.com_x43x61x69_Mach-O-Prettifier]  
Dylib插入Mach-O文件  
[https://github.com/Tyilo/insert\_dylib][https_github.com_Tyilo_insert_dylib]  
dylib injector for mach-o binaries  
[https://github.com/KJCracks/yololib][https_github.com_KJCracks_yololib]  
Fast iOS executable dumper  
[https://github.com/KJCracks/Clutch][https_github.com_KJCracks_Clutch]  
Binary distribution of the libimobiledevice library for Mac OS X  
[https://github.com/benvium/libimobiledevice-macosx][https_github.com_benvium_libimobiledevice-macosx]  
python utilities related to dylib hijacking on OS X  
[https://github.com/synack/DylibHijack][https_github.com_synack_DylibHijack]  
OSX dylib injection  
[https://github.com/scen/osxinj][https_github.com_scen_osxinj]  
IOS IPA package refine and resign  
[https://github.com/Yonsm/iPAFine][https_github.com_Yonsm_iPAFine]  
ROP Exploitation  
[https://github.com/JonathanSalwan/ROPgadget][https_github.com_JonathanSalwan_ROPgadget]  
Class-dump any Mach-o file without extracting it from dyld\_shared\_cache  
[https://github.com/limneos/classdump-dyld][https_github.com_limneos_classdump-dyld]  
Scan an IPA file and parses its info.plist  
[https://github.com/apperian/iOS-checkIPA][https_github.com_apperian_iOS-checkIPA]  
A PoC Mach-O infector via library injection  
[https://github.com/gdbinit/osx\_boubou][https_github.com_gdbinit_osx_boubou]  
IOS-Headers  
[https://github.com/MP0w/iOS-Headers][https_github.com_MP0w_iOS-Headers]  
Interprocess Code injection for Mac OS X  
[https://github.com/rentzsch/mach\_inject][https_github.com_rentzsch_mach_inject]  
OS X Auditor is a free Mac OS X computer forensics tool  
[https://github.com/jipegit/OSXAuditor][https_github.com_jipegit_OSXAuditor]  
remove PIE for osx  
[https://github.com/CarinaTT/MyRemovePIE][https_github.com_CarinaTT_MyRemovePIE]  
A TE executable format loader for IDA  
[https://github.com/gdbinit/TELoader][https_github.com_gdbinit_TELoader]  
Mobile Security Framework  
[https://github.com/ajinabraham/Mobile-Security-Framework-MobSF][https_github.com_ajinabraham_Mobile-Security-Framework-MobSF]  
A library that enables dynamically rebinding symbols in Mach-O binaries running on iOS  
[https://github.com/facebook/fishhook][https_github.com_facebook_fishhook]  
OSX and iOS related security tools  
[https://github.com/ashishb/osx-and-ios-security-awesome][https_github.com_ashishb_osx-and-ios-security-awesome]  
Introspy-Analyzer  
[https://github.com/iSECPartners/Introspy-Analyzer][https_github.com_iSECPartners_Introspy-Analyzer]  
Dumps decrypted mach-o files from encrypted iPhone applications from memory to disk  
[https://github.com/stefanesser/dumpdecrypted][https_github.com_stefanesser_dumpdecrypted]  
Simple Swift wrapper for Keychain that works on iOS and OS X  
[https://github.com/kishikawakatsumi/KeychainAccess][https_github.com_kishikawakatsumi_KeychainAccess]  
idb is a tool to simplify some common tasks for iOS pentesting and research  
[https://github.com/dmayer/idb][https_github.com_dmayer_idb]  
Pentesting apps using Parse as a backend  
[https://github.com/igrekde/ParseRevealer][https_github.com_igrekde_ParseRevealer]  
The iOS Reverse Engineering Toolkit  
[https://github.com/Vhacker/iRET][https_github.com_Vhacker_iRET]  
XNU - Mac OS X kernel  
[https://github.com/opensource-apple/xnu][https_github.com_opensource-apple_xnu]  
Code injection + payload communications for OSX  
[https://github.com/mhenr18/injector][https_github.com_mhenr18_injector]  
iOS related code  
[https://github.com/samdmarshall/iOS-Internals][https_github.com_samdmarshall_iOS-Internals]  
OSX injection tutorial: Hello World  
[https://github.com/arbinger/osxinj\_tut][https_github.com_arbinger_osxinj_tut]  
Reveal Loader dynamically loads libReveal.dylib (Reveal.app support) into iOS apps on jailbroken devices  
[https://github.com/heardrwt/RevealLoader][https_github.com_heardrwt_RevealLoader]  
NSUserDefaults category with AES encrypt/decrypt keys and values  
[https://github.com/NZN/NSUserDefaults-AESEncryptor][https_github.com_NZN_NSUserDefaults-AESEncryptor]  
Blackbox tool to disable SSL certificate validation  
[https://github.com/iSECPartners/ios-ssl-kill-switch][https_github.com_iSECPartners_ios-ssl-kill-switch]  
应用逆向工程 抽奖插件  
[https://github.com/iosre/iosrelottery][https_github.com_iosre_iosrelottery]  
Untested iOS Tweak to hook OpenSSL functions  
[https://github.com/nabla-c0d3/iOS-hook-OpenSSL][https_github.com_nabla-c0d3_iOS-hook-OpenSSL]  
IOS .plist encryptor project. Protect your \*.plist files from jailbroken  
[https://github.com/FelipeFMMobile/ios-plist-encryptor][https_github.com_FelipeFMMobile_ios-plist-encryptor]  
Re-codesigning tool for iOS ipa file  
[https://github.com/hayaq/recodesign][https_github.com_hayaq_recodesign]  
Scans iPhone/iPad/iPod applications for PIE flags  
[https://github.com/stefanesser/.ipa-PIE-Scanner][https_github.com_stefanesser_.ipa-PIE-Scanner]  
xnu local privilege escalation via cve-2015-1140 IOHIDSecurePromptClient injectStringGated heap overflow | poc||gtfo  
[https://github.com/kpwn/vpwn][https_github.com_kpwn_vpwn]  
MachOView  
[https://github.com/gdbinit/MachOView][https_github.com_gdbinit_MachOView]  
A cross-platform protocol library to communicate with iOS devices  
[https://github.com/libimobiledevice/libimobiledevice][https_github.com_libimobiledevice_libimobiledevice]  
WireLurkerDetector  
[https://github.com/pandazheng/WireLurker][https_github.com_pandazheng_WireLurker]  
Released in accordance with GPL licensing  
[https://github.com/p0sixspwn/p0sixspwn][https_github.com_p0sixspwn_p0sixspwn]  
xnu local privilege escalation via cve-2015  
[https://github.com/kpwn/tpwn][https_github.com_kpwn_tpwn]  
A simple universal memory editor (game trainer) on OSX/iOS  
[https://github.com/pandazheng/HippocampHairSalon][https_github.com_pandazheng_HippocampHairSalon]  
BinaryCookieReader源码  
[https://github.com/pandazheng/BinaryCookieReader][https_github.com_pandazheng_BinaryCookieReader]  
Tiamo's bootloader  
[https://github.com/pandazheng/macosxbootloader][https_github.com_pandazheng_macosxbootloader]  
incomplete ios 8.4.1 jailbreak by Kim Jong Cracks  
[https://github.com/pandazheng/yalu][https_github.com_pandazheng_yalu]  
Security Scanner for OSX  
[https://github.com/openscanner/XGuardian][https_github.com_openscanner_XGuardian]  
Sample kernel extension that demonstrates how to hide from kextstat  
[https://github.com/rc0r/KextHider][https_github.com_rc0r_KextHider]  
Example Mac OS X kernel extension that resolves symbols from the running kernel image  
[https://github.com/snare/KernelResolver][https_github.com_snare_KernelResolver]  
Sample Mac OS X (Mountain Lion) kernel extension that demonstrates how to hide files by hijacking getdirentries syscalls  
[https://github.com/rc0r/FileHider][https_github.com_rc0r_FileHider]  
Sample Mac OS X (Mountain Lion) kernel extension that demonstrates how to hide a process by modifying allproc and pidhashtbl  
[https://github.com/rc0r/ProcessHider][https_github.com_rc0r_ProcessHider]  
The Mach-O disassembler. Now 64bit and Xcode 6 compatible  
[https://github.com/x43x61x69/otx][https_github.com_x43x61x69_otx]  
A Mach-O binary codesign remover  
[https://github.com/x43x61x69/codeunsign][https_github.com_x43x61x69_codeunsign]  
A Mach-O Load Command deobfuscator  
[https://github.com/x43x61x69/Mach-O-Prettifier][https_github.com_x43x61x69_Mach-O-Prettifier]  
Very simple keylogger for self-quantifying on Mac OS X  
[https://github.com/dannvix/keylogger-osx][https_github.com_dannvix_keylogger-osx]  
Manage iOS devices through iTunes lib  
[https://github.com/xslim/mobileDeviceManager][https_github.com_xslim_mobileDeviceManager]  
Detects the hardware, software and display of the current iOS or Mac OS X device at runtime  
[https://github.com/lmirosevic/GBDeviceInfo][https_github.com_lmirosevic_GBDeviceInfo]  
Python Arsenal for Reverse Engineering  
[http://pythonarsenal.com/][http_pythonarsenal.com]  
A OS X crypto ransomware PoC  
[https://github.com/gdbinit/gopher][https_github.com_gdbinit_gopher]

### (4) IOS安全优秀书籍 ###

《Hacking and Securing iOS Applications》  
《Mac OS X and iOS Internals:To the Apple’s Core》  
《OS X and iOS Kernel Programming》  
《OS X ABI Mach-O File Format》  
《The Mac Hacker’s Handbook》  
《Mac OS X Interals:A Systems Approach》  
《黑客攻防技术宝典-IOS实战篇》  
《IOS应用安全攻防实战》  
《IOS应用逆向工程》  
《IOS取证实战》  
《安全技术大系：IOS取证分析》

### (5) IOS安全Twitter ###

[https://twitter.com/Technologeeks][https_twitter.com_Technologeeks]  
[https://twitter.com/osxreverser][https_twitter.com_osxreverser]  
[https://twitter.com/Morpheus\_\_\_\_\_\_][https_twitter.com_Morpheus]

### (6) OSX/IOS Exploit分析文章 ###

CVE-2016-1749  
[http://turingh.github.io/2016/04/29/CVE-2016-1749%E5%86%85%E6%A0%B8%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8CPOC%E5%88%86%E6%9E%90/][http_turingh.github.io_2016_04_29_CVE-2016-1749_E5_86_85_E6_A0_B8_E4_BB_A3_E7_A0_81_E6_89_A7_E8_A1_8CPOC_E5_88_86_E6_9E_90]

CVE-2016-1757  
[http://googleprojectzero.blogspot.com/2016/03/race-you-to-kernel.html][http_googleprojectzero.blogspot.com_2016_03_race-you-to-kernel.html]  
[https://github.com/gdbinit/mach\_race][https_github.com_gdbinit_mach_race]

CVE-2016-1824  
[http://marcograss.github.io/security/apple/cve/2016/05/16/cve-2016-1824-apple-iohidfamily-racecondition.html][http_marcograss.github.io_security_apple_cve_2016_05_16_cve-2016-1824-apple-iohidfamily-racecondition.html]

[IOS越狱中使用到的漏洞列表][IOS]

### ipsw ###

[ios10 ipsw][]  
[https://ipsw.me/all][https_ipsw.me_all]  
[https://www.alliphone.com][https_www.alliphone.com]  
[https://www.theiphonewiki.com/wiki/Firmware\_Keys][https_www.theiphonewiki.com_wiki_Firmware_Keys]  
[http://pastebin.com/FRMfanmT][http_pastebin.com_FRMfanmT][https://www.reddit.com/r/jailbreak/comments/4nyz1p/discussion\_decrypted\_kernel\_cache\_ios\_10/d48cgd7][https_www.reddit.com_r_jailbreak_comments_4nyz1p_discussion_decrypted_kernel_cache_ios_10_d48cgd7][https://www.nowsecure.com/blog/2014/04/14/ios-kernel-reversing-step-by-step/][https_www.nowsecure.com_blog_2014_04_14_ios-kernel-reversing-step-by-step]  
[http://www.iphonehacks.com/download-iphone-ios-firmware][http_www.iphonehacks.com_download-iphone-ios-firmware]

--------------------

### Mac下的一些软件 ###

[http://sqwarq.com/detectx/][http_sqwarq.com_detectx]

[https_github.com_pandazheng_IosHackStudy]: https://github.com/pandazheng/IosHackStudy
[http_samdmarshall.com]: http://samdmarshall.com/
[https_www.exploit-db.com]: https://www.exploit-db.com/
[https_reverse.put.as]: https://reverse.put.as/
[http_highaltitudehacks.com_security]: http://highaltitudehacks.com/security/
[http_www.dllhook.com]: http://www.dllhook.com/
[http_www.securitylearn.net_archives]: http://www.securitylearn.net/archives/
[http_securitycompass.github.io_iPhoneLabs_index.html]: http://securitycompass.github.io/iPhoneLabs/index.html
[http_security.ios-wiki.com]: http://security.ios-wiki.com/
[http_www.opensecuritytraining.info_IntroARM.html]: http://www.opensecuritytraining.info/IntroARM.html
[https_truesecdev.wordpress.com]: https://truesecdev.wordpress.com/
[http_resources.infosecinstitute.com_ios-application-security-part-1-setting-up-a-mobile-pentesting-platform]: http://resources.infosecinstitute.com/ios-application-security-part-1-setting-up-a-mobile-pentesting-platform/
[http_esoftmobile.com_2014_02_14_ios-security]: http://esoftmobile.com/2014/02/14/ios-security/
[http_bbs.iosre.com]: http://bbs.iosre.com/
[http_bbs.chinapyg.com]: http://bbs.chinapyg.com/
[http_blog.pangu.io]: http://blog.pangu.io/
[http_yonsm.net]: http://yonsm.net/
[http_nianxi.net]: http://nianxi.net/
[http_cocoahuke.com]: http://cocoahuke.com/
[https_blog.0xbbc.com]: https://blog.0xbbc.com/
[http_blog.imaou.com]: http://blog.imaou.com/
[https_github.com_pandazheng_iOSAppReverseEngineering]: https://github.com/pandazheng/iOSAppReverseEngineering
[http_drops.wooyun.org]: http://drops.wooyun.org/
[http_bbs.pediy.com]: http://bbs.pediy.com/
[http_www.blogfshare.com]: http://www.blogfshare.com/
[https_github.com_michalmalik_osx-re-101]: https://github.com/michalmalik/osx-re-101
[http_blog.qwertyoruiop.com]: http://blog.qwertyoruiop.com/
[https_github.com_secmobi_wiki.secmobi.com]: https://github.com/secmobi/wiki.secmobi.com
[http_contagioexchange.blogspot.com]: http://contagioexchange.blogspot.com/
[http_contagiominidump.blogspot.com]: http://contagiominidump.blogspot.com/
[https_github.com_secmobi]: https://github.com/secmobi
[https_www.owasp.org_index.php_OWASP_Mobile_Security_Project_tab_Guide_Development_Project]: https://www.owasp.org/index.php/OWASP_Mobile_Security_Project#tab=Guide_Development_Project
[http_blog.dornea.nu_2014_10_29_howto-ios-apps-static-analysis]: http://blog.dornea.nu/2014/10/29/howto-ios-apps-static-analysis/
[http_www.dllhook.com_post_58.html]: http://www.dllhook.com/post/58.html
[http_thexploit.com_category_secdev]: http://thexploit.com/category/secdev/
[https_github.com_mdsecresearch]: https://github.com/mdsecresearch
[http_sectools.org_tag_os-x]: http://sectools.org/tag/os-x/
[http_googleprojectzero.blogspot.com]: http://googleprojectzero.blogspot.com/
[http_googleprojectzero.blogspot.com_2014_10_more-mac-os-x-and-iphone-sandbox.html]: http://googleprojectzero.blogspot.com/2014/10/more-mac-os-x-and-iphone-sandbox.html
[http_www.macexploit.com]: http://www.macexploit.com/
[https_code.google.com_p_google-security-research_issues_list_can_1_q_iOS_sort_-id_colspec_ID_20Type_20Status_20Priority_20Milestone_20Owner_20Summary]: https://code.google.com/p/google-security-research/issues/list?can=1&q=iOS&sort=-id&colspec=ID%20Type%20Status%20Priority%20Milestone%20Owner%20Summary
[https_code.google.com_p_google-security-research_issues_list_can_1_q_OSX_sort_-id_colspec_ID_Type_Status_Priority_Milestone_Owner_Summary_cells_tiles]: https://code.google.com/p/google-security-research/issues/list?can=1&q=OSX&sort=-id&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=tiles
[http_googleprojectzero.blogspot.com_2014_11_pwn4fun-spring-2014-safari-part-ii.html]: http://googleprojectzero.blogspot.com/2014/11/pwn4fun-spring-2014-safari-part-ii.html
[https_www.blackhat.com_docs_us-15_materials_us-15-Lei-Optimized-Fuzzing-IOKit-In-iOS-wp.pdf]: https://www.blackhat.com/docs/us-15/materials/us-15-Lei-Optimized-Fuzzing-IOKit-In-iOS-wp.pdf
[https_www.youtube.com_watch_v_rxUgw5bEG3Y]: https://www.youtube.com/watch?v=rxUgw5bEG3Y
[https_www.theiphonewiki.com_wiki_Firmware]: https://www.theiphonewiki.com/wiki/Firmware
[http_www.trustedbsd.org_mac.html]: http://www.trustedbsd.org/mac.html
[https_support.apple.com_zh-cn_HT205731]: https://support.apple.com/zh-cn/HT205731
[https_www.apple.com_support_security]: https://www.apple.com/support/security/
[http_opensource.apple.com_tarballs]: http://opensource.apple.com/tarballs/
[https_mobile-security.zeef.com_oguzhan.topgu]: https://mobile-security.zeef.com/oguzhan.topgu
[http_www.powerofcommunity.net]: http://www.powerofcommunity.net/
[http_cn.0day.today_exploits]: http://cn.0day.today/exploits
[https_recon.cx_2016_training_trainingios-osx.html]: https://recon.cx/2016/training/trainingios-osx.html
[https_www.exploit-db.com_osx-rop-exploits-evocam-case-study]: https://www.exploit-db.com/osx-rop-exploits-evocam-case-study/
[https_www.offensive-security.com_vulndev_evocam-remote-buffer-overflow-on-osx]: https://www.offensive-security.com/vulndev/evocam-remote-buffer-overflow-on-osx/
[https_www.yumpu.com_en_document_view_7010924_ios-kernel-heap-armageddon]: https://www.yumpu.com/en/document/view/7010924/ios-kernel-heap-armageddon
[http_contagiodump.blogspot.com]: http://contagiodump.blogspot.com/
[http_www.dllhook.com_post_138.html]: http://www.dllhook.com/post/138.html
[http_shell-storm.org_blog_Return-Oriented-Programming-and-ROPgadget-tool]: http://shell-storm.org/blog/Return-Oriented-Programming-and-ROPgadget-tool/
[https_medium.com_harryworld_100-days-of-osx-development-e61591fcb8c8_.vxyuyse12]: https://medium.com/@harryworld/100-days-of-osx-development-e61591fcb8c8#.vxyuyse12
[http_www.poboke.com_study_reverse]: http://www.poboke.com/study/reverse
[http_phrack.org_issues_69_1.html]: http://phrack.org/issues/69/1.html
[https_www.exploit-db.com_docs_28479.pdf]: https://www.exploit-db.com/docs/28479.pdf
[https_speakerdeck.com_milkmix_ios-malware-myth-or-reality]: https://speakerdeck.com/milkmix/ios-malware-myth-or-reality
[http_datatheorem.github.io_TrustKit]: http://datatheorem.github.io/TrustKit/
[http_ho.ax_posts_2012_02_resolving-kernel-symbols]: http://ho.ax/posts/2012/02/resolving-kernel-symbols/
[http_www.securitylearn.net_tag_pentesting-ios-apps]: http://www.securitylearn.net/tag/pentesting-ios-apps/
[https_truesecdev.wordpress.com_2015_04_09_hidden-backdoor-api-to-root-privileges-in-apple-os-x]: https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/
[http_bbs.iosre.com_t_debugserver-lldb-gdb_65]: http://bbs.iosre.com/t/debugserver-lldb-gdb/65
[http_bbs.pediy.com_showthread.php_t_193859]: http://bbs.pediy.com/showthread.php?t=193859
[http_bbs.pediy.com_showthread.php_t_192657_viewgoodnees_1_prefixid]: http://bbs.pediy.com/showthread.php?t=192657&viewgoodnees=1&prefixid=
[http_blog.darkrainfall.org_2013_01_os-x-internals]: http://blog.darkrainfall.org/2013/01/os-x-internals/
[http_dvlabs.tippingpoint.com_blog_2009_03_06_reverse-engineering-iphone-appstore-binaries]: http://dvlabs.tippingpoint.com/blog/2009/03/06/reverse-engineering-iphone-appstore-binaries
[http_drops.wooyun.org_papers_5309]: http://drops.wooyun.org/papers/5309
[http_www.blogfshare.com_category_ios-secure]: http://www.blogfshare.com/category/ios-secure
[https_www.safaribooksonline.com_library_view_hacking-and-securing_9781449325213_ch08s04.html]: https://www.safaribooksonline.com/library/view/hacking-and-securing/9781449325213/ch08s04.html
[http_soundly.me_osx-injection-override-tutorial-hello-world]: http://soundly.me/osx-injection-override-tutorial-hello-world/
[https_nadavrub.wordpress.com_2015_07_23_injecting-code-to-an-ios-appstore-app]: https://nadavrub.wordpress.com/2015/07/23/injecting-code-to-an-ios-appstore-app/
[http_blog.dewhurstsecurity.com]: http://blog.dewhurstsecurity.com/
[https_github.com_project-imas]: https://github.com/project-imas
[https_github.com_iSECPartners]: https://github.com/iSECPartners
[https_www.nowsecure.com_blog]: https://www.nowsecure.com/blog/
[http_lightbulbone.com]: http://lightbulbone.com/
[http_www.tanhao.me_pieces_1515.html]: http://www.tanhao.me/pieces/1515.html/
[http_dongaxis.github.io]: http://dongaxis.github.io/
[https_github.com_vandadnp_iOS-9-Swift-Programming-Cookbook]: https://github.com/vandadnp/iOS-9-Swift-Programming-Cookbook
[https_github.com_pandazheng_XCodeGhost-Clean]: https://github.com/pandazheng/XCodeGhost-Clean
[https_github.com_tihmstar_rootpipe_exploit]: https://github.com/tihmstar/rootpipe_exploit
[https_github.com_datatheorem_TrustKit]: https://github.com/datatheorem/TrustKit
[https_github.com_secretsquirrel_the-backdoor-factory]: https://github.com/secretsquirrel/the-backdoor-factory
[https_github.com_maciekish_iReSign]: https://github.com/maciekish/iReSign
[https_github.com_x43x61x69_Mach-O-Prettifier]: https://github.com/x43x61x69/Mach-O-Prettifier
[https_github.com_Tyilo_insert_dylib]: https://github.com/Tyilo/insert_dylib
[https_github.com_KJCracks_yololib]: https://github.com/KJCracks/yololib
[https_github.com_KJCracks_Clutch]: https://github.com/KJCracks/Clutch
[https_github.com_benvium_libimobiledevice-macosx]: https://github.com/benvium/libimobiledevice-macosx
[https_github.com_synack_DylibHijack]: https://github.com/synack/DylibHijack
[https_github.com_scen_osxinj]: https://github.com/scen/osxinj
[https_github.com_Yonsm_iPAFine]: https://github.com/Yonsm/iPAFine
[https_github.com_JonathanSalwan_ROPgadget]: https://github.com/JonathanSalwan/ROPgadget
[https_github.com_limneos_classdump-dyld]: https://github.com/limneos/classdump-dyld
[https_github.com_apperian_iOS-checkIPA]: https://github.com/apperian/iOS-checkIPA
[https_github.com_gdbinit_osx_boubou]: https://github.com/gdbinit/osx_boubou
[https_github.com_MP0w_iOS-Headers]: https://github.com/MP0w/iOS-Headers
[https_github.com_rentzsch_mach_inject]: https://github.com/rentzsch/mach_inject
[https_github.com_jipegit_OSXAuditor]: https://github.com/jipegit/OSXAuditor
[https_github.com_CarinaTT_MyRemovePIE]: https://github.com/CarinaTT/MyRemovePIE
[https_github.com_gdbinit_TELoader]: https://github.com/gdbinit/TELoader
[https_github.com_ajinabraham_Mobile-Security-Framework-MobSF]: https://github.com/ajinabraham/Mobile-Security-Framework-MobSF
[https_github.com_facebook_fishhook]: https://github.com/facebook/fishhook
[https_github.com_ashishb_osx-and-ios-security-awesome]: https://github.com/ashishb/osx-and-ios-security-awesome
[https_github.com_iSECPartners_Introspy-Analyzer]: https://github.com/iSECPartners/Introspy-Analyzer
[https_github.com_stefanesser_dumpdecrypted]: https://github.com/stefanesser/dumpdecrypted
[https_github.com_kishikawakatsumi_KeychainAccess]: https://github.com/kishikawakatsumi/KeychainAccess
[https_github.com_dmayer_idb]: https://github.com/dmayer/idb
[https_github.com_igrekde_ParseRevealer]: https://github.com/igrekde/ParseRevealer
[https_github.com_Vhacker_iRET]: https://github.com/Vhacker/iRET
[https_github.com_opensource-apple_xnu]: https://github.com/opensource-apple/xnu
[https_github.com_mhenr18_injector]: https://github.com/mhenr18/injector
[https_github.com_samdmarshall_iOS-Internals]: https://github.com/samdmarshall/iOS-Internals
[https_github.com_arbinger_osxinj_tut]: https://github.com/arbinger/osxinj_tut
[https_github.com_heardrwt_RevealLoader]: https://github.com/heardrwt/RevealLoader
[https_github.com_NZN_NSUserDefaults-AESEncryptor]: https://github.com/NZN/NSUserDefaults-AESEncryptor
[https_github.com_iSECPartners_ios-ssl-kill-switch]: https://github.com/iSECPartners/ios-ssl-kill-switch
[https_github.com_iosre_iosrelottery]: https://github.com/iosre/iosrelottery
[https_github.com_nabla-c0d3_iOS-hook-OpenSSL]: https://github.com/nabla-c0d3/iOS-hook-OpenSSL
[https_github.com_FelipeFMMobile_ios-plist-encryptor]: https://github.com/FelipeFMMobile/ios-plist-encryptor
[https_github.com_hayaq_recodesign]: https://github.com/hayaq/recodesign
[https_github.com_stefanesser_.ipa-PIE-Scanner]: https://github.com/stefanesser/.ipa-PIE-Scanner
[https_github.com_kpwn_vpwn]: https://github.com/kpwn/vpwn
[https_github.com_gdbinit_MachOView]: https://github.com/gdbinit/MachOView
[https_github.com_libimobiledevice_libimobiledevice]: https://github.com/libimobiledevice/libimobiledevice
[https_github.com_pandazheng_WireLurker]: https://github.com/pandazheng/WireLurker
[https_github.com_p0sixspwn_p0sixspwn]: https://github.com/p0sixspwn/p0sixspwn
[https_github.com_kpwn_tpwn]: https://github.com/kpwn/tpwn
[https_github.com_pandazheng_HippocampHairSalon]: https://github.com/pandazheng/HippocampHairSalon
[https_github.com_pandazheng_BinaryCookieReader]: https://github.com/pandazheng/BinaryCookieReader
[https_github.com_pandazheng_macosxbootloader]: https://github.com/pandazheng/macosxbootloader
[https_github.com_pandazheng_yalu]: https://github.com/pandazheng/yalu
[https_github.com_openscanner_XGuardian]: https://github.com/openscanner/XGuardian
[https_github.com_rc0r_KextHider]: https://github.com/rc0r/KextHider
[https_github.com_snare_KernelResolver]: https://github.com/snare/KernelResolver
[https_github.com_rc0r_FileHider]: https://github.com/rc0r/FileHider
[https_github.com_rc0r_ProcessHider]: https://github.com/rc0r/ProcessHider
[https_github.com_x43x61x69_otx]: https://github.com/x43x61x69/otx
[https_github.com_x43x61x69_codeunsign]: https://github.com/x43x61x69/codeunsign
[https_github.com_dannvix_keylogger-osx]: https://github.com/dannvix/keylogger-osx
[https_github.com_xslim_mobileDeviceManager]: https://github.com/xslim/mobileDeviceManager
[https_github.com_lmirosevic_GBDeviceInfo]: https://github.com/lmirosevic/GBDeviceInfo
[http_pythonarsenal.com]: http://pythonarsenal.com/
[https_github.com_gdbinit_gopher]: https://github.com/gdbinit/gopher
[https_twitter.com_Technologeeks]: https://twitter.com/Technologeeks
[https_twitter.com_osxreverser]: https://twitter.com/osxreverser
[https_twitter.com_Morpheus]: https://twitter.com/Morpheus______
[http_turingh.github.io_2016_04_29_CVE-2016-1749_E5_86_85_E6_A0_B8_E4_BB_A3_E7_A0_81_E6_89_A7_E8_A1_8CPOC_E5_88_86_E6_9E_90]: http://turingh.github.io/2016/04/29/CVE-2016-1749%E5%86%85%E6%A0%B8%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8CPOC%E5%88%86%E6%9E%90/
[http_googleprojectzero.blogspot.com_2016_03_race-you-to-kernel.html]: http://googleprojectzero.blogspot.com/2016/03/race-you-to-kernel.html
[https_github.com_gdbinit_mach_race]: https://github.com/gdbinit/mach_race
[http_marcograss.github.io_security_apple_cve_2016_05_16_cve-2016-1824-apple-iohidfamily-racecondition.html]: http://marcograss.github.io/security/apple/cve/2016/05/16/cve-2016-1824-apple-iohidfamily-racecondition.html
[IOS]: https://www.theiphonewiki.com/wiki/Jailbreak_Exploits#Exploits_which_are_used_in_order_to_jailbreak_8.x
[ios10 ipsw]: http://alliphone.com/2015/11/ios-10-download-links-ipsw.html
[https_ipsw.me_all]: https://ipsw.me/all
[https_www.alliphone.com]: https://www.alliphone.com/
[https_www.theiphonewiki.com_wiki_Firmware_Keys]: https://www.theiphonewiki.com/wiki/Firmware_Keys
[http_pastebin.com_FRMfanmT]: http://pastebin.com/FRMfanmT
[https_www.reddit.com_r_jailbreak_comments_4nyz1p_discussion_decrypted_kernel_cache_ios_10_d48cgd7]: https://www.reddit.com/r/jailbreak/comments/4nyz1p/discussion_decrypted_kernel_cache_ios_10/d48cgd7
[https_www.nowsecure.com_blog_2014_04_14_ios-kernel-reversing-step-by-step]: https://www.nowsecure.com/blog/2014/04/14/ios-kernel-reversing-step-by-step/
[http_www.iphonehacks.com_download-iphone-ios-firmware]: http://www.iphonehacks.com/download-iphone-ios-firmware
[http_sqwarq.com_detectx]: http://sqwarq.com/detectx/