Create ios.md
This commit is contained in:
iddoeldor
GitHub
parent
0f47e4a616
commit
c76f1ce7da
369
scripts/ios.md
Normal file
369
scripts/ios.md
Normal file
@ -0,0 +1,369 @@
|
||||
|
||||
On the iDevice the file `/System/Library/Backup/Domains.plist` determines what files to backup.
|
||||
|
||||
There is a differentiation between "domains" and relative files.
|
||||
|
||||
For [More Info](https://www.theiphonewiki.com/wiki/ITunes_Backup).
|
||||
|
||||
From `Domains.plist` :
|
||||
```
|
||||
...
|
||||
RelativePathsToBackupAndRestore = (
|
||||
"Demo.mov",
|
||||
"Library/com.apple.itunesstored",
|
||||
"Library/AddressBook",
|
||||
"Library/Accounts # <rdar://problem/9489580> Twitter account isn't backed up (or restored)",
|
||||
"Library/Application Support/Front Row # <rdar://problem/11427805> ATV: paths that need to be backed up on AppleTV",
|
||||
"Library/Application Support/com.apple.Home/Wallpapers # <rdar://problem/27410171>",
|
||||
"Library/BackBoard # <rdar://problem/13752515> App Push notification settings don't seem to be backed up/restored",
|
||||
"Library/BulletinBoard # <rdar://problem/9281863> Backup /var/mobile/Library/BulletinBoard",
|
||||
"Library/Caches/com.apple.WebAppCache # <rdar://problem/6500854> Should back up offline application cache and databases for WebKit",
|
||||
"Library/Calendar",
|
||||
>> "Library/CallHistoryDB # <rdar://problem/16651783> Backup request for CallHistory.framework.",
|
||||
>> "Library/CallHistoryTransactions # <rdar://problem/16651783> Backup request for CallHistory.framework.",
|
||||
...
|
||||
RootPath = "/var/mobile";
|
||||
..
|
||||
...
|
||||
```
|
||||
|
||||
List device daemons w/ `$ launchctl list`
|
||||
```
|
||||
PID Status Label
|
||||
2696 0 com.apple.CoreAuthentication.daemon
|
||||
3719 0 com.apple.cloudphotod
|
||||
535 0 com.apple.homed
|
||||
513 0 com.apple.dataaccess.dataaccessd
|
||||
- 0 com.apple.iapauthd
|
||||
618 0 com.apple.cache_delete
|
||||
- 0 com.apple.BTServer.avrcp
|
||||
518 0 com.apple.CallHistorySyncHelper
|
||||
3568 0 UIKitApplication:com.apple.InCallService[0x287]
|
||||
502 0 com.apple.icloud.findmydeviced
|
||||
443 0 com.apple.telephonyutilities.callservicesd
|
||||
549 0 com.apple.icloud.fmfd
|
||||
....
|
||||
```
|
||||
|
||||
launchctl manual
|
||||
```
|
||||
Usage: launchctl <subcommand> ... | help [subcommand]
|
||||
Many subcommands take a target specifier that refers to a domain or service within that domain.
|
||||
The available specifier forms are:
|
||||
|
||||
system/[service-name]
|
||||
Targets the system-wide domain or service within. Root privileges are required to make modifications.
|
||||
|
||||
user/<uid>/[service-name]
|
||||
Targets the user domain or service within.
|
||||
A process running as the target user may make modifications. Root may modify any user's domain.
|
||||
User domains do not exist on iOS.
|
||||
|
||||
gui/<uid>/[service-name]
|
||||
Targets the GUI domain or service within. Each GUI domain is associated with a user domain, and a process running as
|
||||
the owner of that user domain may make modifications.
|
||||
Root may modify any GUI domain. GUI domains do not exist on iOS.
|
||||
|
||||
session/<asid>/[service-name]
|
||||
Targets a session domain or service within. A process running within the target security audit session may make
|
||||
modifications. Root may modify any session domain.
|
||||
|
||||
pid/<pid>/[service-name]
|
||||
Targets a process domain or service within. Only the process which owns the domain may modify it.
|
||||
Even root may not do so.
|
||||
|
||||
When using a legacy subcommand which manipulates a domain, the target domain is assumed to be the system domain.
|
||||
On iOS, there is no support for per-user domains, even though there is a mobile user.
|
||||
|
||||
Subcommands:
|
||||
..
|
||||
debug Configures the next invocation of a service for debugging.
|
||||
kill Sends a signal to the service instance.
|
||||
blame Prints the reason a service is running.
|
||||
print Prints a description of a domain or service.
|
||||
print-cache Prints information about the service cache.
|
||||
print-disabled Prints which services are disabled.
|
||||
plist Prints a property list embedded in a binary (targets the Info.plist by default).
|
||||
procinfo Prints port information about a process.
|
||||
hostinfo Prints port information about the host.
|
||||
runstats Prints performance statistics for a service.
|
||||
examine Runs the specified analysis tool against launchd in a non-reentrant manner.
|
||||
config Modifies persistent configuration parameters for launchd domains.
|
||||
dumpstate Dumps launchd state to stdout.
|
||||
list Lists information about services.
|
||||
start Starts the specified service.
|
||||
..
|
||||
or a given subcommand.
|
||||
```
|
||||
Output of proccess info for CallHistorySyncHelper
|
||||
`$ launchctl procinfo 549`
|
||||
|
||||
Added the content of referenced files (com.apple.CallHistorySyncHelper.plist)
|
||||
|
||||
```
|
||||
com.apple.CallHistorySyncHelper = {
|
||||
active count = 5
|
||||
path = /System/Library/LaunchDaemons/com.apple.CallHistorySyncHelper.plist
|
||||
state = running
|
||||
program = /System/Library/PrivateFrameworks/CallHistory.framework/Support/CallHistorySyncHelper
|
||||
arguments = {
|
||||
/System/Library/PrivateFrameworks/CallHistory.framework/Support/CallHistorySyncHelper
|
||||
}
|
||||
default environment = {
|
||||
PATH => /usr/bin:/bin:/usr/sbin:/sbin
|
||||
}
|
||||
environment = {
|
||||
XPC_SERVICE_NAME => com.apple.CallHistorySyncHelper
|
||||
}
|
||||
domain = com.apple.xpc.launchd.domain.system
|
||||
username = mobile
|
||||
minimum runtime = 10
|
||||
exit timeout = 5
|
||||
runs = 1
|
||||
successive crashes = 0
|
||||
excessive crashing = 0
|
||||
pid = 518
|
||||
immediate reason = ipc (mach)
|
||||
forks = 1
|
||||
execs = 1
|
||||
trampolined = 1
|
||||
started suspended = 0
|
||||
proxy started suspended = 0
|
||||
last exit code = (never exited)
|
||||
event triggers = {
|
||||
com.apple.callhistorysync.idslaunchnotification => {
|
||||
state = 0
|
||||
service = com.apple.CallHistorySyncHelper
|
||||
stream = com.apple.notifyd.matching
|
||||
descriptor = {
|
||||
"Notification" => "com.apple.callhistorysync.idslaunchnotification"
|
||||
}
|
||||
}
|
||||
}
|
||||
endpoints = {
|
||||
"com.apple.callhistory.pairedsync" = {
|
||||
port = 0x46907
|
||||
active = 1
|
||||
managed = 1
|
||||
reset = 0
|
||||
hide = 0
|
||||
}
|
||||
"com.apple.CallHistorySyncHelper" = {
|
||||
port = 0x46607
|
||||
active = 1
|
||||
managed = 1
|
||||
reset = 0
|
||||
hide = 0
|
||||
}
|
||||
"com.apple.CallHistorySyncHelper.aps" = {
|
||||
port = 0x4627b
|
||||
active = 1
|
||||
managed = 1
|
||||
reset = 0
|
||||
hide = 0
|
||||
}
|
||||
}
|
||||
dynamic endpoints = {
|
||||
}
|
||||
pid-local endpoints = {
|
||||
}
|
||||
instance-specific endpoints = {
|
||||
}
|
||||
event channels = {
|
||||
"com.apple.notifyd.matching" = {
|
||||
port = 0x46707
|
||||
active = 1
|
||||
managed = 1
|
||||
reset = 0
|
||||
hide = 0
|
||||
}
|
||||
}
|
||||
sockets = {
|
||||
}
|
||||
spawn type = adaptive
|
||||
jetsam priority = 3
|
||||
jetsam memory limit (active) = 6 MB
|
||||
jetsam memory limit (inactive) = 6 MB
|
||||
jetsamproperties category = daemon
|
||||
allowed to execute = 1
|
||||
submitted job. ignore execute allowed
|
||||
cpumon = default
|
||||
properties = {
|
||||
partial import = 0
|
||||
launchd bundle = 0
|
||||
xpc bundle = 0
|
||||
keepalive = 0
|
||||
runatload = 0
|
||||
dirty at shutdown = 0
|
||||
low priority i/o = 0
|
||||
low priority background i/o = 0
|
||||
exception handler = 0
|
||||
multiple instances = 0
|
||||
supports transactions = 1
|
||||
supports pressured exit = 1
|
||||
enter kdp before kill = 0
|
||||
wait for debugger = 0
|
||||
app = 0
|
||||
system app = 0
|
||||
inetd-compatible = 0
|
||||
inetd listener = 0
|
||||
abandon process group = 0
|
||||
one-shot = 0
|
||||
requires reap = 0
|
||||
event monitor = 0
|
||||
penalty box = 0
|
||||
pended non-demand spawn = 0
|
||||
role account = 0
|
||||
launch only once = 0
|
||||
system support = 0
|
||||
app-like = 0
|
||||
inferred program = 1
|
||||
ios home screen app = 0
|
||||
abandon coalition = 0
|
||||
extension = 0
|
||||
nano allocator = 0
|
||||
no initgroups = 0
|
||||
endpoints initialized = 1
|
||||
platform binary = 1
|
||||
disallow all lookups = 0
|
||||
}
|
||||
}
|
||||
program path = /System/Library/PrivateFrameworks/CallHistory.framework/Support/CallHistorySyncHelper
|
||||
Could not print Mach info for pid 518: 0x5
|
||||
bsd proc info = {
|
||||
pid = 518
|
||||
unique pid = 518
|
||||
ppid = 1
|
||||
pgid = 518
|
||||
status = stopped
|
||||
flags = 64-bit|session leader
|
||||
uid = 501
|
||||
svuid = 501
|
||||
ruid = 501
|
||||
gid = 501
|
||||
svgid = 501
|
||||
ruid = 501
|
||||
comm name = CallHistorySync
|
||||
long name = CallHistorySyncHelper
|
||||
controlling tty devnode = 0xffffffff
|
||||
controlling tty pgid = 0
|
||||
}
|
||||
pressured exit info = {
|
||||
dirty state tracked = 1
|
||||
dirty = 0
|
||||
pressured-exit capable = 1
|
||||
}
|
||||
jetsam priority = 0: idle
|
||||
jetsam memory limit = 6
|
||||
jetsam flags = (none)
|
||||
jetsam state = tracked,idle-exit
|
||||
entitlements = {
|
||||
"com.apple.private.ids.messaging" = (
|
||||
"com.apple.private.alloy.callhistorysync";
|
||||
);
|
||||
"com.apple.developer.icloud-services" = (
|
||||
"CloudKit";
|
||||
);
|
||||
"com.apple.application-identifier" = "CALLSYNCDB.com.apple.callhistory.sync-helper";
|
||||
"com.apple.developer.icloud-container-environment" = "production";
|
||||
"com.apple.private.aps-environment" = "production";
|
||||
"application-identifier" = "CALLSYNCDB.com.apple.callhistory.sync-helper";
|
||||
"aps-connection-initiate" = true;
|
||||
"com.apple.private.aps-connection-initiate" = true;
|
||||
"com.apple.private.ids.messaging.high-priority" = (
|
||||
"com.apple.private.alloy.callhistorysync";
|
||||
);
|
||||
"com.apple.accounts.appleaccount.fullaccess" = true;
|
||||
"aps-environment" = "production";
|
||||
"com.apple.private.tcc.allow" = (
|
||||
"kTCCServiceLiverpool";
|
||||
"kTCCServiceAddressBook";
|
||||
);
|
||||
};
|
||||
code signing info = valid
|
||||
ad-hoc signed
|
||||
get-task-allow entitlement
|
||||
installer entitlement
|
||||
require enforcement
|
||||
allowed mach-o
|
||||
platform dyld
|
||||
entitlements validated
|
||||
platform binary
|
||||
```
|
||||
Content of /System/Library/LaunchDaemons/com.apple.CallHistorySyncHelper.plist
|
||||
```
|
||||
{
|
||||
EnablePressuredExit = 1;
|
||||
EnableTransactions = 1;
|
||||
Label = "com.apple.CallHistorySyncHelper";
|
||||
LaunchEvents = {
|
||||
"com.apple.notifyd.matching" = {
|
||||
"com.apple.callhistorysync.idslaunchnotification" = {
|
||||
Notification = "com.apple.callhistorysync.idslaunchnotification";
|
||||
};
|
||||
};
|
||||
};
|
||||
MachServices = {
|
||||
"com.apple.CallHistorySyncHelper" = 1;
|
||||
"com.apple.CallHistorySyncHelper.aps" = 1;
|
||||
"com.apple.callhistory.pairedsync" = 1;
|
||||
};
|
||||
POSIXSpawnType = Adaptive;
|
||||
ProgramArguments = (
|
||||
"/System/Library/PrivateFrameworks/CallHistory.framework/Support/CallHistorySyncHelper"
|
||||
);
|
||||
UserName = mobile;
|
||||
}
|
||||
```
|
||||
Info about `CallHistorySyncHelper`
|
||||
```
|
||||
$ ls -la /System/Library/PrivateFrameworks/CallHistory.framework/Support/CallHistorySyncHelper
|
||||
-rwxr-xr-x 1 root wheel 279392 Aug 29 2016 CallHistorySyncHelper
|
||||
|
||||
$ file CallHistorySyncHelper
|
||||
Mach-O 64-bit 64-bit architecture=12 executable
|
||||
```
|
||||
|
||||
Frida REPL w/ `$ frida -U 518`
|
||||
|
||||
[Dump ios class hierarchy](https://github.com/iddoeldor/frida-snippets#dump-ios-class-hierarchy)
|
||||
```
|
||||
[iOS Device::PID::518]-> tree
|
||||
{
|
||||
"NSObject": {
|
||||
"CHLogger": {
|
||||
"ApplyLocalTransactions": {},
|
||||
"CHPairedSyncCoordinator": {},
|
||||
"CHPushConnectionDelegate": {},
|
||||
"MergeTransactions": {},
|
||||
"SignalHandler": {},
|
||||
"SyncXPCServer": {}
|
||||
},
|
||||
"CHSynchronizedLoggable": {
|
||||
"AutoSync": {},
|
||||
"CHIDSPeerDevice": {},
|
||||
"CHIDSServiceDelegate": {},
|
||||
"CloudKit": {},
|
||||
"SyncEngine": {},
|
||||
"TransactionLog": {}
|
||||
},
|
||||
"PBCodable": {
|
||||
"CHRecentCallPb": {},
|
||||
"TransactionsPb": {}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Tried to print `ObjC.classes.AutoSync` and the daemon shut down
|
||||
```
|
||||
PID Status Label
|
||||
- -43 com.apple.CallHistorySyncHelper
|
||||
```
|
||||
Get binary w/ Frida
|
||||
```
|
||||
cmd = Shell(['/bin/sh', '-c', "cat /System/Library/PrivateFrameworks/CallHistory.framework/Support/CallHistorySyncHelper"], None)
|
||||
cmd.exec()/push
|
||||
with open('~/CallHistorySyncHelper', 'wb+') as f:
|
||||
f.writelines(cmd.output)
|
||||
```
|
||||
Loading…
Reference in New Issue
Block a user