iOS逆向----iOS12之后的静态砸壳

关于静态砸壳其实之前已经介绍过一个工具Clutch,但是由于年久失修,导致其在iOS11之后变得不可用,动不动就kill -9。于是最近又开始研究了一下,发现了一款新的静态砸壳工具flexdecrypt

首先连接到越狱的iPhone上,然后使用wget命令下载最新的deb(wget自行安装):

iPhone:/tmp root# wget https://github.com/JohnCoates/flexdecrypt/releases/download/1.1/flexdecrypt.deb

然后直接安装:

iPhone:/tmp root# dpkg -i flexdecrypt.deb
Selecting previously unselected package flexdecrypt.
(Reading database ... 3858 files and directories currently installed.)
Preparing to unpack flexdecrypt.deb ...
Unpacking flexdecrypt (1.1) ...
Setting up flexdecrypt (1.1) ...

安装完之后就可以使用了:

iPhone:/tmp root# flexdecrypt
Error: Missing expected argument '<file>'

OVERVIEW: A tool for decrypting apps and Mach-O binaries. Based on the Flex 3
jailbreak app's source code.

USAGE: flex-decrypt <subcommand>

OPTIONS:
  --version               Show the version.
  -h, --help              Show help information.

SUBCOMMANDS:
  file (default)          Decrypt file.

  See 'flex-decrypt help <subcommand>' for detailed help.

看描述,flexdecrypt应该不如clutchname智能,因此只能先cd到要砸壳的app目录下,然后再进行砸壳,具体如何找App的路径可以参考之前的博客,这里以砸Quantumult为例:

iPhone:/tmp root# cd /var/containers/Bundle/Application/
iPhone:/var/containers/Bundle/Application/ root# cd 6B8B93D5-DB46-4AAE-A264-F1C93A689B65
iPhone:/var/containers/Bundle/Application/6B8B93D5-DB46-4AAE-A264-F1C93A689B65 root# cd Quantumult.app/
iPhone:/var/containers/Bundle/Application/6B8B93D5-DB46-4AAE-A264-F1C93A689B65/Quantumult.app root# flexdecrypt Quantumult
Wrote decrypted image to /tmp/Quantumult

可以看到静态砸壳的速度是很快的,基本秒出,但是只有一行输出,告诉了你脱壳文件的位置,使用scp命令将文件取出:

➜  ~ scp -P 2222 root@127.0.0.1:"/tmp/Quantumult" ~/Desktop
root@127.0.0.1's password:
Quantumult                                                                                                                  100% 3235KB  34.9MB/s   00:00
➜  ~ cd Desktop
➜  Desktop otool -l Quantumult| grep crypt
     cryptoff 16384
    cryptsize 2703360
      cryptid 0

可以看出已经成功脱壳。

已标记关键词 清除标记
©️2020 CSDN 皮肤主题: 酷酷鲨 设计师:CSDN官方博客 返回首页