iPhone 可执行文件 (MACH-O) 解密
我一直在 iPhone 上玩弄/调试/反汇编二进制文件。
第一个障碍是二进制文件是加密的，反汇编者无法读取它们。这可以通过从 gdb 转储解密的文件内容来解决。
我的问题是关于所有 MACH-O 可执行文件的二进制文件解密（在程序启动时即时完成），这些可执行文件的 LC_ENCRYPTION_INFO 部分中的 crypto_id 设置为 1。
- 有没有可以为您解密文件的工具？有什么建议吗？
- 有关于该流程如何运作的信息吗？显然是 AES 加密？使用什么键？用你的复制很容易吗？ 自己的程序？
感谢您的指点！
I've been playing around with/debugging/disassembling binaries on the iPhone.
The first obstacle is that the binaries are encrypted and dissembler can not read them. This can be overcome by dumping the decrypted file content from gdb.
My question is about the decryption of binaries (which is done on the fly upon program start) for all MACH-O executable which have the encryption_id in LC_ENCRYPTION_INFO section, set to 1.
- is there a tool that decrypts files for you? Any recommendations?
- is there info available on how the process works? Apparently it's
AES encryption? What key is used? Is it easy to replicate with your
own program?
Thanks for any pointers!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
简短回答
从 AppStore 下载的应用程序中，主二进制文件的 TEXT 部分的一部分已加密，如加载命令
LC_ENCRYTPION_INFO{_64}所示。此加密不是由开发人员执行的，加密是在您下载应用程序时发生的。每个应用程序都会使用登录期间创建的公钥/私钥对为您在该设备上的 AppStore 帐户进行加密。
二进制文件在加载时由内核解密，因此本质上，当您想要解密二进制文件时，您可以在加载后将其从内存中转储。这意味着您需要“参与其中”，这需要越狱设备。如今，如果您正在进行研究，您会使用像 Frida 这样的工具将自己插入到过程中，并且许多python 脚本 和纯 JavaScript 工具正是这样做的。
Stefan Esser 的项目 dumpdecrypted（来自 2011 年）用 C 语言简洁地说明了二进制图像解密步骤。
无论如何，从设备上获取应用程序的解密版本都会破坏该应用程序，因为它不再有效签名，并且需要重新签名整个应用程序包。要重新签署该应用程序需要 Apple 开发者帐户。
这一切意味着什么？
只要越狱存在，所有 iOS 应用程序都容易受到重新打包攻击、静态和动态分析。
The short answer
A portion of the main binary's TEXT section in an app downloaded from the AppStore is encrypted as indicated by the load command
LC_ENCRYTPION_INFO{_64}.This encryption is not performed by the developer, the encryption occurs when you download the app. Each app is encrypted for your AppStore account on that device with a public/private key pair created during sign-in.
The binary is decrypted by the kernel when it is loaded, so in essence, when you want to decrypt the binary you dump it from memory after it has loaded. This means you'll need to be 'in the process' which requires a jailbroken device. These days, if you're doing research you would use a tool like Frida to insert yourself into the process and many python scripts and pure javascript tools do exactly this.
The binary image decryption step is succinctly illustrated in C by Stefan Esser's project dumpdecrypted (from 2011).
In any case, getting a decrypted version of the app off the device will break the app since it is no longer validly signed and will require re-signing the entire app bundle. To re-sign the app would require an Apple developer account.
What does this all mean?
All iOS apps are susceptible to repackaging attacks, static and dynamic analysis as long as jailbreaks exist.