Ipa installation by @NVISOSecurity #3100

TheDauntless · 2024-12-26T13:02:01Z

A cleanup of all the iOS signing / installing / running in debug mode.

I tried to be pragmatic, focussing on different techniques that work (I tested all of them, it was not a fun day) and also focussing on modern solutions rather than keep holding on to outdated ones.

This fixes #3090

sushi2k

Great content @TheDauntless! Also the warnings/tips for AppSync and libimobiledevice are spot on! I've reviewed the tools, planning to do the rest today or tomorrow.

tools/ios/MASTG-TOOL-0055.md

tools/ios/MASTG-TOOL-0118.md

sushi2k · 2024-12-30T09:23:04Z

tools/ios/MASTG-TOOL-0118.md

@@ -8,3 +8,6 @@ source: https://sideloadly.io/
 ---

 [Sideloadly](https://sideloadly.io/ "Sideloadly") allows you to obtain a valid signature for a given IPA file and then install it to a connected iOS device. In addition to signing and installing an IPA file, Sideloadly also allows you to inject tweaks, change the App or Bundle name or make other limited modifications to the IPA metadata. Sideloadly is available on both macOS and Windows.
+
+!!! warning "Do not use your personal Apple account"
+    To sign an IPA file, you will need a valid iOS developer account, either free or paid. Both types come with certain restrictions, as explained on the Sideloadly website. We recommend creating a dedicated developer account for signing test applications, and **not** using your personal Apple account.


What would be the restrictions when using a paid developer account?

Not sure I understand this comment.

You are writing:

To sign an IPA file, you will need a valid iOS developer account, either free or paid. Both types come with certain restrictions, as explained on the Sideloadly website.

I don't understand what the restrictions would be for a paid developer account. I also couldn't find anything on the sideloadly website.
A free account has a of course restrictions (7 days valid etc.)

Oh, right. I've linked to the technique now which explains it. The paid account still has restrictions (365 days), so I think the text still makes sense.

tools/ios/MASTG-TOOL-0055.md

tools/ios/MASTG-TOOL-0126.md

tools/ios/MASTG-TOOL-0127.md

Co-authored-by: Sven <sven@bsddaemon.org>

TheDauntless · 2024-12-30T11:02:57Z

Thanks for the review so far!

sushi2k

@TheDauntless reviewed more techniques, but not done yet. Thanks for the nice summary!

sushi2k · 2024-12-30T10:25:19Z

techniques/ios/MASTG-TECH-0055.md

-After the app has been installed on the device, it needs to be launched in debug mode. This is not the case when launching the app via springboard (the application will crash), but it is possible with various tools as explained in @MASTG-TECH-0056. When the application is running in debug mode, Frida can be injected into the process with name `Gadget`:
+If you've repackaged an application with a Frida Gadget, or if you want to attach @MASTG-TOOL-0057 to the application, you have to launch the application in debug mode. When you launch the application via SpringBoard, it will not launch in debug mode and the application will crash.
+
+After the application has been installed using @MASTG-TECH-TOOL-0056, you can launch it in debug mode using the following commands:


Suggested change

After the application has been installed using @MASTG-TECH-TOOL-0056, you can launch it in debug mode using the following commands:

After the application has been installed using @MASTG-TECH-0056, you can launch it in debug mode using the following commands.

> Note that the commands that are part of @MASTG-TOOL-0126 refer to the latest version available from Github. If you installed them via brew or other package managers, you may have an older version with different command line flags.

tools/ios/MASTG-TOOL-0055.md

sushi2k · 2024-12-30T13:10:49Z

tools/ios/MASTG-TOOL-0118.md

@@ -8,3 +8,6 @@ source: https://sideloadly.io/
 ---

 [Sideloadly](https://sideloadly.io/ "Sideloadly") allows you to obtain a valid signature for a given IPA file and then install it to a connected iOS device. In addition to signing and installing an IPA file, Sideloadly also allows you to inject tweaks, change the App or Bundle name or make other limited modifications to the IPA metadata. Sideloadly is available on both macOS and Windows.
+
+!!! warning "Do not use your personal Apple account"
+    To sign an IPA file, you will need a valid iOS developer account, either free or paid. Both types come with certain restrictions, as explained on the Sideloadly website. We recommend creating a dedicated developer account for signing test applications, and **not** using your personal Apple account.


You are writing:

To sign an IPA file, you will need a valid iOS developer account, either free or paid. Both types come with certain restrictions, as explained on the Sideloadly website.

I don't understand what the restrictions would be for a paid developer account. I also couldn't find anything on the sideloadly website.
A free account has a of course restrictions (7 days valid etc.)

techniques/ios/MASTG-TECH-0055.md

sushi2k · 2025-01-04T06:55:41Z

techniques/ios/MASTG-TECH-0055.md

+com.google.Maps, "24.50.0", "Google Maps"
+
+# Run in debug mode
+$ idevicedebug -d run sg.vp.UnCrackable1.QH868V5764


Unfortunately this always failed for my iOS 15.8.3 device (jailbroken). I couldn't find a DeveloperDiskImage for 15.8.3, but one for 15.7 but couldn't mount it. Were you testing this on macOS? I am using macOS sequoia 15.1.1 and Xcode 16.2

07:42:10 lockdown.c:278 lockdownd_stop_session(): success 07:42:10 idevice.c:1193 idevice_connection_disable_bypass_ssl(): Skipping bidirectional SSL shutdown. SSL error code: 5 07:42:10 idevice.c:1208 idevice_connection_disable_bypass_ssl(): SSL mode disabled 07:42:10 service.c:98 service_client_factory_start_service(): Could not start service com.apple.debugserver! Could not start com.apple.debugserver! Please make sure to mount the developer disk image first: 1) Get the iOS version from `ideviceinfo -k ProductVersion`. 2) Find the matching iPhoneOS DeveloperDiskImage.dmg files. 3) Run `ideviceimagemounter` with the above path.

It works on my machine / device:

macOS 15.2 (24C101)

XCode 16.2 (16C5032a)

iOS 15.8.3 (non-jb)

idevicedebug 1.3.0-260-gc8cdf20

In installed via Sideloadly

idevicedebug -d run sg.vp.UnCrackable12 working_directory: /private/var/mobile/Containers/Data/Application/9C89C011-33D7-421B-9934-B92488F49486 Setting logging bitmask... Setting maximum packet size... Setting working directory... Setting argv... app_argv[0] = /private/var/containers/Bundle/Application/F7FDC3A7-2055-46B8-A88B-2764BF84ACD2/UnCrackable Level 1.app/UnCrackable Level 1 Checking if launch succeeded... Setting thread... Continue running process...

Co-authored-by: Sven <sven@bsddaemon.org>

Jeroen Beckers added 7 commits December 26, 2024 06:50

Add libimobiledevice / update iproxy

f3da3a7

Streamline TECH-0079 provisioning profile

566208d

Update TECH-0092 for IPA signing

d39142b

Update TECH-0079 to add cert limitation

522c1af

Add Appsync unified tool

f6f8dca

Installing and injecting IPA files

679e62e

Fix ios debugging apps

e9ff817

github-actions bot added iOS fundamentals labels Dec 26, 2024

Jeroen Beckers added 3 commits December 26, 2024 13:04

Fix linting and small update

d95283f

Fix lint and reference

462784d

Spellcheck

6ec2102

sushi2k mentioned this pull request Dec 30, 2024

Add libimobiledevice / update iproxy (@NVISOSecurity) #3099

Closed

sushi2k requested changes Dec 30, 2024

View reviewed changes

TheDauntless and others added 4 commits December 30, 2024 11:59

Update tools/ios/MASTG-TOOL-0055.md

52dd898

Co-authored-by: Sven <sven@bsddaemon.org>

Update tools/ios/MASTG-TOOL-0055.md

e228714

Co-authored-by: Sven <sven@bsddaemon.org>

Update tools/ios/MASTG-TOOL-0126.md

ef4fabf

Co-authored-by: Sven <sven@bsddaemon.org>

Update tools/ios/MASTG-TOOL-0055.md

d28f7ae

Co-authored-by: Sven <sven@bsddaemon.org>

sushi2k reviewed Jan 4, 2025

View reviewed changes

TheDauntless and others added 9 commits January 4, 2025 22:10

Update techniques/ios/MASTG-TECH-0055.md

2ce8cbd

Co-authored-by: Sven <sven@bsddaemon.org>

Update techniques/ios/MASTG-TECH-0055.md

a2611b6

Co-authored-by: Sven <sven@bsddaemon.org>

Update techniques/ios/MASTG-TECH-0055.md

90f5347

Co-authored-by: Sven <sven@bsddaemon.org>

Update techniques/ios/MASTG-TECH-0055.md

1d36e50

Co-authored-by: Sven <sven@bsddaemon.org>

Update techniques/ios/MASTG-TECH-0055.md

5f77407

Co-authored-by: Sven <sven@bsddaemon.org>

Update techniques/ios/MASTG-TECH-0055.md

7f02dd7

Co-authored-by: Sven <sven@bsddaemon.org>

Update techniques/ios/MASTG-TECH-0055.md

cc66983

Co-authored-by: Sven <sven@bsddaemon.org>

Update techniques/ios/MASTG-TECH-0055.md

8f8cc97

Co-authored-by: Sven <sven@bsddaemon.org>

Apply suggestions from code review

317b37e

Co-authored-by: Sven <sven@bsddaemon.org>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ipa installation by @NVISOSecurity #3100

Ipa installation by @NVISOSecurity #3100

TheDauntless commented Dec 26, 2024 •

edited

Loading

sushi2k left a comment

sushi2k Dec 30, 2024

TheDauntless Dec 30, 2024

sushi2k Dec 30, 2024

TheDauntless Jan 4, 2025

TheDauntless commented Dec 30, 2024

sushi2k left a comment

sushi2k Dec 30, 2024

sushi2k Dec 30, 2024

sushi2k Jan 4, 2025

TheDauntless Jan 4, 2025

-After the application has been installed using @MASTG-TECH-TOOL-0056, you can launch it in debug mode using the following commands:
+After the application has been installed using @MASTG-TECH-0056, you can launch it in debug mode using the following commands.
+> Note that the commands that are part of @MASTG-TOOL-0126 refer to the latest version available from Github. If you installed them via brew or other package managers, you may have an older version with different command line flags.

Ipa installation by @NVISOSecurity #3100

Are you sure you want to change the base?

Ipa installation by @NVISOSecurity #3100

Conversation

TheDauntless commented Dec 26, 2024 • edited Loading

sushi2k left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TheDauntless commented Dec 30, 2024

sushi2k left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TheDauntless commented Dec 26, 2024 •

edited

Loading