rustymagnet3000

Static / Dynamic iOS app inspection

• Get unencrypted ipa
• Logs
• Files
• Build information
• Symbols
• Strings
• Applesign

pudquick

# Warning - because of how this works, it loads classes into memory namespace.
# Attempting to load a second Xcode to inspect within the same python run will result in errors
# If you need to inspect multiple, for now, just spin the inspection up under a second process

from Foundation import NSBundle

def xcode_info(app_path):
    # app_path = '/Applications/Xcode.app'
    DVTFoundation = NSBundle.bundleWithPath_('%s/Contents/SharedFrameworks/DVTFoundation.framework' % app_path)
    IDEKit = NSBundle.bundleWithPath_('%s/Contents/Frameworks/IDEKit.framework' % app_path)

bsodmike

Following mining and findings performed on EVGA GeForce GTX 1070 SC GAMING Black Edition Graphics Card cards.

First run nvidia-xconfig --enable-all-gpus then set about editing the xorg.conf file to correctly set the Coolbits option.

# /etc/X11/xorg.conf
Section "Device"
    Identifier     "Device0"
    Driver         "nvidia"
    VendorName     "NVIDIA Corporation"

pudquick

#!/usr/bin/python

import objc, CoreFoundation, Foundation, sys

class attrdict(dict): 
    __getattr__ = dict.__getitem__
    __setattr__ = dict.__setitem__

NetFS = attrdict()
# Can cheat and provide 'None' for the identifier, it'll just use frameworkPath instead

CodeBrauer

If you haven't installed any FUSE yet:

brew tap homebrew/fuse
brew install Caskroom/cask/osxfuse

1. brew install qemu ext4fuse
2. qemu-img convert -p -O vmdk snapshot.qcow2 system.vmdk This will take some time...
3. Download and register for a free licence of VMDK Mounter for Mac® OS X and install it.
4. Reboot your macOS device.

pudquick

from ctypes import CDLL, Structure, POINTER, c_int64, c_int32, c_int16, c_char, c_uint32
from ctypes.util import find_library
import time

c = CDLL(find_library("System"))

# https://opensource.apple.com/source/Libc/Libc-1158.50.2/include/NetBSD/utmpx.h.auto.html
# https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man3/endutxent.3.html#//apple_ref/doc/man/3/endutxent

BOOT_TIME     =  2

pudquick

from Foundation import NSBundle
import objc
CoreServices = NSBundle.bundleWithIdentifier_('com.apple.CoreServices')     

functions = [
             ('_LSCopyRunningApplicationArray', '@I'),
             ('_LSCopyApplicationInformation', '@I@@'),
            ]

constants = [

pudquick

import objc
from ctypes import c_char
from Foundation import NSBundle
Security = NSBundle.bundleWithIdentifier_('com.apple.security')

S_functions = [
               ('SecKeychainGetTypeID', 'I'),
               ('SecKeychainItemGetTypeID', 'I'),
               ('SecKeychainAddGenericPassword', 'i^{OpaqueSecKeychainRef=}I*I*I*o^^{OpaqueSecKeychainItemRef}'),
               ('SecKeychainOpen', 'i*o^^{OpaqueSecKeychainRef}'),

pudquick

from subprocess import Popen, PIPE, STDOUT, check_output
from mimetools import Message
from StringIO import StringIO
from urlparse import urlparse, parse_qs
from urllib import quote, basejoin, urlencode

DEV_SITE  = 'https://developer.apple.com'
AUTH_SITE = 'https://idmsa.apple.com'
AUTH_PATH = '/IDMSWebAuth/authenticate'
APPIDKEY_PATH = "/services-account/download?path=%s"

pudquick

# An overly complicated SIP config checker

# This is a technically interesting implementation because it does not rely on csrutil
# Instead it queries the kernel directly for the current configuration status
# This means, for example, in environments where SIP has been disabled and csrutil has
# been removed or modified (say, with DYLD_LIBRARY_PATH), as long as python can run you
# can still check status

# Additionally, checking the nvram csr-active-config setting isn't accurate now with
# 10.12.2+, since running "sudo csrutil clear" deletes the variable until reboot,