砸壳、Theos

砸壳概述

原理：MachO文件是明文，苹果加密后变成加壳文件。安装到手机，加壳文件跑在手机上，系统解密变成MachO文件，dyld加载MachO文件。砸壳？不知道解密方式？

DRM(数字版权管理)检查，检查通过，从App的可执行文件中，即MachO选择合适的架构用dyld加载，加载过程中操作系统会进行解密，使用dyld加载解密的MachO 解密工具不会做解密逻辑，只会遍历loadcommond信息，对应解密后的数据。从内存中dump出来然后生成新的MachO文件

Clutch

dumpdecrypted

原理：动态库运行因为DYLD，帮我们链接所有动态库，包括MachO，由于DYLD加载了MachO，App才可以执行，而MachO加载的时候所依赖的动态库又被DYLD链接，所以我们自己的动态库才可以执行，也就是说，砸壳的动态库，要想执行，需要被DYLD加载，而且一个动态库没有执行能力的，加载的时候一定要依附在一个进程上面

//拷贝到手机,文件夹拷贝加 -r
$ scp -P 12345 dumpdecrypted.dylib root@localhost:/~
//DYLD需要配置的环境变量 
$ DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/2E792188-A786-43EA-A13A-78F27B6A38FD/Keep.app/Keep

mach-o decryption dumper
DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.

[+] detected 64bit ARM binary in memory.
[+] offset to cryptid found: @0x1000c8fc8(from 0x1000c8000) = fc8
[+] Found encrypted data at address 00004000 of length 45711360 bytes - type 1.
[+] Opening /private/var/mobile/Containers/Bundle/Application/2E792188-A786-43EA-A13A-78F27B6A38FD/Keep.app/Keep for reading.
[+] Reading header
[+] Detecting header type
[+] Executable is a plain MACH-O image
[+] Opening Keep.decrypted for writing.
[+] Copying the not encrypted start of the file
[+] Dumping the decrypted data into the file
[+] Copying the not encrypted remainder of the file
[+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset fc8
[+] Closing original file
[+] Closing dump file

//得到MachO文件,单一架构arm64
Keep.decrypted

Theos配置

//常用的方式
$ brew install ldid //安装
$ brew uninstall ldid //卸载
$ brew search ldid //搜索
$ brew upgrade ldid //更新
$ brew list //查看列表
$ brew update //更新Homebrew

//查看已安装的THEOS
$ echo $THEOS
//配置Vim
$ vim ~/.bash_profile
//键入
export ANDROID_HOME=~/Library/Android/sdk
export THEOS=/opt/theos
export CY=/opt/cycript
export QLshell=~/QLshell
export PATH=$ANDROID_HOME/tools:$ANDROID_HOME/platform-tools:$THEOS/bin/:$CY:$QLshell:$PATH
//立即生效
$ source .zshrc
//查看
$ cd $THEOS/bin
$ ls
deb_build_num.sh   fakeroot.sh        install.mergeDir   nic.pl
//查看是否配置成功/opt/theos/bin
$ echo $PATH
/tools:/platform-tools:/opt/theos/bin:/opt/cycript_0:/Users/qionglinfu/QLshell:/opt/MonkeyDev/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
//然后在哪里都可以敲啦
$ nic.pl

使用Theos窃取微信密码

关于Theos的坑!!!!