Hacker News Reader

Comment by leoh | Hacker News Reader

Isn't a theoretical large reason for jailbreaking (not your main phone) to be able to read the contents of all installed apps, say, via SSH? I don't know of another way to do this.

View on HN

Jailbreaking can be invaluable for legitimate security research. For example, frida is a powerful reverse engineering tool that allowing all sorts of scripting and dynamic instrumentation. It's functionality is very limited without jailbreaking.

https://frida.re/docs/ios

Looks a lot like dtrace

It is! Though DTrace doesn't really work on iOS... Apparently Apple ported it over but they've certainly never released it publicly. https://twitter.com/ahl/status/311883517820809216

Some tools you may want to look into. They're used for piracy 99% of the time, but interesting stuff all the same:

https://github.com/KJCracks/Clutch

https://forum.iphonecake.com/index.php?/topic/363020-cracker...

Yes, this is one of the things I use Linux Deploy (requires root) on my Android phone for. I do backups of all data this way and randomly browsing photos from Linux (nemo specifically) is also easy:

1. Open file manager

2. Click a bookmark that points to "sftp://tel"

3. I can now browse my phone, e.g. to view pictures or copy a previously taken screenshot. No need to take the phone out of your pocket and connect it over USB or anything.

"tel" is configured in ~/.ssh/config to point to the static IP of my phone. I have another ssh host called "hotspot" which points to the IP it uses when it functions as hotspot.

(Of course, this occasional convenience and full backups aren't the only things I would want root for.)

It doesn't install OpenSSH by default, but it does set up a root user with a default password "alpine". It's recommended that you change this.

I believe that the root user already exists with that password.

It looks like you're right. I guess I don't really understand then why we can't just log in as root in vanilla iOS

It technically is, but iOS apps are compiled ARM64 so decompiling them isn't trivial. It's often easier to find the app's config files and mess around, or to use an app like Flex that allows you to override return values for an app's methods.

https://twitter.com/flextweak

but iOS apps are compiled ARM64 so decompiling them isn't trivial

One of the fun things about Android is the ease of decompiling and recompiling Java, but if you're used to RE'ing native code for Windows or Linux, then I don't think it would be all that different?

Super interesting. I suspect Ghidra might support reasonably well.

Ghidra doesn't do a great job of decompiling Swift and ObjC which most most iOS apps would be written in now days. You are better off with something like Hopper. Hopper does a better job of decompiling Swift and ObjC but its decompiler output is no where near as good unfortunately.

It’s no unobfuscated Java, but it’s far from being complicated.

Reply on news.ycombinator.com