iOS Hooking With Objection
For this section the tool Objection is going to be used. Start by getting an objection's session executing something like:
You can execute also frida-ps -Uia
to check the running processes of the phone.
Basic Enumeration of the app
Local App Paths
env
: Find the paths where the application is stored inside the device
List Bundles, frameworks and libraries
ios bundles list_bundles
: List bundles of the applicationios bundles list_frameworks
: List external frameworks used by the applicationmemory list modules
: List loaded modules in memorymemory list exports <module_name>
: Exports of a loaded module
List classes of an APP
ios hooking list classes
: List classes of the appios hooking search classes <search_term>
: Search a class that contains a string. You can search some uniq term that is related to the main app package name to find the main classes of the app like in the example:
List class methods
ios hooking list class_methods
: List methods of a specific classios hooking search methods <search_term>
: Search a method that contains a string
Basic Hooking
Now that you have enumerated the classes and modules used by the application you may have found some interesting class and method names.
Hook all methods of a class
ios hooking watch class <class_name>
: Hook all the methods of a class, dump all the initial parameters and returns
Hook a single method
ios hooking watch method "-[<class_name> <method_name>]" --dump-args --dump-return --dump-backtrace
: Hook an specific method of a class dumping the parameters, backtraces and returns of the method each time it's called
Change Boolean Return
ios hooking set return_value "-[<class_name> <method_name>]" false
: This will make the selected method return the indicated boolean
Generate hooking template
ios hooking generate simple <class_name>
:
Last updated