Skip to content

Instantly share code, notes, and snippets.

@su-vikas su-vikas/
Last active Jan 23, 2018

What would you like to do?
IDAPython script automating ptrace patching for an iOS binary
import idaapi
import idautils
import idc
num_imps = idaapi.get_import_module_qty()
print("[+] Found % d import(s)" % num_imps)
for i in xrange(0, num_imps):
name = idaapi.get_import_module_name(i)
if not name:
print("[-] Failed to get import module name for #%d" % i)
print("Walking-> %s" % name)
idaapi.enum_import_names(i, imp_cb)
possible_ptrace_dlsym_calls = []
def patch(addr):
nop = [0x00, 0xBF] # IN LE 00 BF nop in thumb mode (iphone uses thumb code]
addr = idc.next_head(addr)
mnem = GetMnem(addr)
dlsym_result_reg = None
if mnem == "MOV":
dlsym_result_reg = GetOpnd(addr, 0)
print("\t\t %08x: MOV %s, %s" % (addr, GetOpnd(addr, 0), GetOpnd(addr,1)))
while True:
addr = idc.next_head(addr)
mnem = GetMnem(addr)
if mnem == "BLX" and GetOpnd(addr, 0) == dlsym_result_reg:
print("\t\t\t %08x: BLX %s" % (addr, GetOpnd(addr, 0)))
# patch the code.
for i in xrange(len(nop)):
PatchByte(addr + i, nop[i])
def is_ptrace_called(addr):
check if ptrace is called.
looking for pattern dlsym, then check for PT_DENY_ATTACH = 0x1F.
print("Analyzing address: %x" % addr)
for i in xrange(0, 2):
addr = idc.next_head(addr)
mnem = GetMnem(addr)
if mnem == "BLX" and "_dlsym" in GetOpnd(addr, 0):
print("\t BLX mnemonic found at address: %x, operand: %s, count: %d" % (addr, GetOpnd(addr, 0), i))
# source function xrefs()
# Search for ptrace string
for string in idautils.Strings():
if "ptrace" in str(string):
print("PTRACE FOUND %x: len=%d type=%d " % (string.ea, string.length, string.strtype))
print("PTRACE referenced from:")
for xref in idautils.XrefsTo(string.ea):
print("----------- Completed ---------------")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.