iOS逆向----iOS12之后的静态砸壳

柔光的暖阳◎ 2023-02-27 05:48 32阅读 0赞

关于静态砸壳其实之前已经介绍过一个工具[Clutch][]，但是由于年久失修，导致其在iOS11之后变得不可用，动不动就kill -9。于是最近又开始研究了一下，发现了一款新的静态砸壳工具[flexdecrypt][]

首先连接到越狱的iPhone上，然后使用wget命令下载最新的deb（wget自行安装）：

iPhone:/tmp root# wget https://github.com/JohnCoates/flexdecrypt/releases/download/1.1/flexdecrypt.deb

然后直接安装：

iPhone:/tmp root# dpkg -i flexdecrypt.deb
    Selecting previously unselected package flexdecrypt.
    (Reading database ... 3858 files and directories currently installed.)
    Preparing to unpack flexdecrypt.deb ...
    Unpacking flexdecrypt (1.1) ...
    Setting up flexdecrypt (1.1) ...

安装完之后就可以使用了：

iPhone:/tmp root# flexdecrypt
    Error: Missing expected argument '<file>'
    
    OVERVIEW: A tool for decrypting apps and Mach-O binaries. Based on the Flex 3
    jailbreak app's source code. USAGE: flex-decrypt <subcommand> OPTIONS: --version Show the version. -h, --help Show help information. SUBCOMMANDS: file (default) Decrypt file. See 'flex-decrypt help <subcommand>' for detailed help.

看描述，flexdecrypt应该不如clutchname智能，因此只能先cd到要砸壳的app目录下，然后再进行砸壳，具体如何找App的路径可以参考[之前的博客][Link 1]，这里以砸Quantumult为例：

iPhone:/tmp root# cd /var/containers/Bundle/Application/
    iPhone:/var/containers/Bundle/Application/ root# cd 6B8B93D5-DB46-4AAE-A264-F1C93A689B65
    iPhone:/var/containers/Bundle/Application/6B8B93D5-DB46-4AAE-A264-F1C93A689B65 root# cd Quantumult.app/
    iPhone:/var/containers/Bundle/Application/6B8B93D5-DB46-4AAE-A264-F1C93A689B65/Quantumult.app root# flexdecrypt Quantumult
    Wrote decrypted image to /tmp/Quantumult

可以看到静态砸壳的速度是很快的，基本秒出，但是只有一行输出，告诉了你脱壳文件的位置，使用scp命令将文件取出：

➜  ~ scp -P 2222 root@127.0.0.1:"/tmp/Quantumult" ~/Desktop
    root@127.0.0.1's password:
    Quantumult                                                                                                                  100% 3235KB  34.9MB/s   00:00
    ➜  ~ cd Desktop
    ➜  Desktop otool -l Quantumult| grep crypt
         cryptoff 16384
        cryptsize 2703360
          cryptid 0

可以看出已经成功脱壳。

[Clutch]: https://blog.csdn.net/youshaoduo/article/details/84105040
[flexdecrypt]: https://github.com/paradiseduo/flexdecrypt
[Link 1]: https://blog.csdn.net/youshaoduo/article/details/81099876