|
1 | | -# Frida Configuration in iOS |
| 1 | +# iOS Frida Configuration |
2 | 2 |
|
3 | 3 | <details> |
4 | 4 |
|
|
14 | 14 |
|
15 | 15 | ## Installing Frida |
16 | 16 |
|
17 | | -Go to **Cydia** app and add Frida’s repository by going to **Manage -> Sources -> Edit -> Add** and enter [**https://build.frida.re** ](https://build.frida.re). It will add a new source in the source list. Go to the **frida** **source**, now you should **install** the **Frida** package. |
| 17 | +Go to **Cydia/Sileo** app in your Jailbroken device and add Frida’s repository by going to **Manage -> Sources -> Edit -> Add** and enter [**https://build.frida.re** ](https://build.frida.re). It will add a new source in the source list. Go to the F**rida** **source**, now you should **install** the **Frida** package. |
18 | 18 |
|
19 | 19 |  |
20 | 20 |
|
21 | | -After installed, you can use in your PC the command `frida-ls-devices` and check that the device appears (your PC needs to be able to access it). Execute also `frida-ps -Uia` to check the running processes of the phone. |
| 21 | +If you are using **Corellium** you will need to download the Frida release from [https://github.com/frida/frida/releases](https://github.com/frida/frida/releases) (`frida-gadget-[yourversion]-ios-universal.dylib.gz`) and unpack and copy to the dylib location Frida asks for, e.g.: `/Users/[youruser]/.cache/frida/gadget-ios.dylib` |
| 22 | + |
| 23 | +After installed, you can use in your PC the command **`frida-ls-devices`** and check that the device appears (your PC needs to be able to access it).\ |
| 24 | +Execute also **`frida-ps -Uia`** to check the running processes of the phone. |
22 | 25 |
|
23 | 26 | ## Frida without Jailbroken device & without patching the app |
24 | 27 |
|
25 | 28 | Check this blog post about how to use Frida in non-jailbroken devices without patching the app: [https://mrbypass.medium.com/unlocking-potential-exploring-frida-objection-on-non-jailbroken-devices-without-application-ed0367a84f07](https://mrbypass.medium.com/unlocking-potential-exploring-frida-objection-on-non-jailbroken-devices-without-application-ed0367a84f07) |
26 | 29 |
|
| 30 | +## Frida Client Installation |
| 31 | + |
| 32 | +Install **frida tools**: |
| 33 | + |
| 34 | +```bash |
| 35 | +pip install frida-tools |
| 36 | +pip install frida |
| 37 | +``` |
| 38 | + |
| 39 | +With the Frida server installed and the device running and connected, **check** if the client is **working**: |
| 40 | + |
| 41 | +```bash |
| 42 | +frida-ls-devices # List devices |
| 43 | +frida-ps -Uia # Get running processes |
| 44 | +``` |
| 45 | + |
| 46 | +## Frida Trace |
| 47 | + |
| 48 | +```bash |
| 49 | +# Trace all methods of all classes |
| 50 | +frida-trace -U <program> -m "*[* *]" |
| 51 | + |
| 52 | +# Trace all methods with the word "authentication" from classes that start with "NE" |
| 53 | +frida-trace -U <program> -m "*[NE* *authentication*]" |
| 54 | +``` |
| 55 | + |
| 56 | +### Get all classes and methods |
| 57 | + |
| 58 | +* Get **all** available **classes** (filter by string) |
| 59 | + |
| 60 | +{% code title="/tmp/script.js" %} |
| 61 | +```javascript |
| 62 | +// frida -U <program> -l /tmp/script.js |
| 63 | + |
| 64 | +var filterClass = "filterstring"; |
| 65 | + |
| 66 | +if (ObjC.available) { |
| 67 | + for (var className in ObjC.classes) { |
| 68 | + if (ObjC.classes.hasOwnProperty(className)) { |
| 69 | + if (!filterClass || className.includes(filterClass)) { |
| 70 | + console.log(className); |
| 71 | + } |
| 72 | + } |
| 73 | + } |
| 74 | +} else { |
| 75 | + console.log("Objective-C runtime is not available."); |
| 76 | +} |
| 77 | +``` |
| 78 | +{% endcode %} |
| 79 | + |
| 80 | +* Get **all** **methods** of a **class** (filter by string) |
| 81 | + |
| 82 | +{% code title="/tmp/script.js" %} |
| 83 | +```javascript |
| 84 | +// frida -U <program> -l /tmp/script.js |
| 85 | + |
| 86 | +var specificClass = "YourClassName"; |
| 87 | +var filterMethod = "filtermethod"; |
| 88 | + |
| 89 | +if (ObjC.available) { |
| 90 | + if (ObjC.classes.hasOwnProperty(specificClass)) { |
| 91 | + var methods = ObjC.classes[specificClass].$ownMethods; |
| 92 | + for (var i = 0; i < methods.length; i++) { |
| 93 | + if (!filterMethod || methods[i].includes(filterClass)) { |
| 94 | + console.log(specificClass + ': ' + methods[i]); |
| 95 | + } |
| 96 | + } |
| 97 | + } else { |
| 98 | + console.log("Class not found."); |
| 99 | + } |
| 100 | +} else { |
| 101 | + console.log("Objective-C runtime is not available."); |
| 102 | +} |
| 103 | +``` |
| 104 | +{% endcode %} |
| 105 | + |
| 106 | +## Frida Android Tutorials |
| 107 | + |
| 108 | +{% content-ref url="../android-app-pentesting/frida-tutorial/" %} |
| 109 | +[frida-tutorial](../android-app-pentesting/frida-tutorial/) |
| 110 | +{% endcontent-ref %} |
| 111 | + |
27 | 112 | <details> |
28 | 113 |
|
29 | 114 | <summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary> |
|
0 commit comments