search

ChiChou / bagbak

Yet another frida based iOS dumpdecrypted. Also decrypts app extensions
MIT License
1.12k stars 184 forks source link

unable to dump an appex/framework #120

Closed asdfzxcvbn closed 10 months ago

asdfzxcvbn commented 10 months ago

Describe the bug bagbak is great, and this is actually the last reoccuring issue i get from time to time. when dumping certain apps, it won't be able to dump a certain appex or framework, due to it being "unable to attach" to a pid. when dumping Google Voice, it can't dump an appex:

[info] app bundle downloaded
[decrypt] Frameworks/VoiceFramework.framework/VoiceFramework
[decrypt] VoiceApp
[decrypt] PlugIns/IntentsExtension.appex/IntentsExtension
Failed to attach to pid 83049, skipping...
Warning: Unable to dump PlugIns/NotificationExtension.appex/NotificationExtension

To Reproduce bagbak -fr Voice

Expected behavior for every appex to be dumped successfully.

Desktop (please complete the following information):

Additional context Add any other context about the problem here.

ChiChou commented 10 months ago

TL;DR

Use iOS 16 instead.

Analysis

Reproduced on Facebook app. However I can't do anything about it. Here are some details and steps that might help you troubleshoot for the future bugs.

frida -U -f /private/var/containers/Bundle/Application/{GUID}/Facebook.app/PlugIns/FBLockscreenWidgetExtension.appex/FBLockscreenWidgetExtension

You will get a

Spawning `/private/var/containers/Bundle/Application/E9EB375E-DE91-4905-8FD4-B7FF80605ACC/Facebook.app/PlugFailed to attach: unexpectedly timed out while initializing suspended process

idevicecrashreport gives the root cause.

Termination Description: DYLD, dyld: Using shared cache: 277C6D53-D739-3482-8AB8-9EEE68D8C0BC | Library not loaded: /System/Library/Frameworks/Charts.framework/Charts | Referenced from: /private/var/containers/Bundle/Application/E9EB375E-DE91-4905-8FD4-B7FF80605ACC/Facebook.app/PlugIns/FBLockscreenWidgetExtension.appex/FBLockscreenWidgetExtension | Reason: image not found
Triggered by Thread:  0

Thread 0 Crashed:
0   dyld                            0x0000000103383440 __abort_with_payload + 8
1   dyld                            0x000000010338b6e0 abort_with_payload_wrapper_internal + 104
2   dyld                            0x000000010338b714 __unw_set_reg.cold.1 + 0
3   dyld                            0x000000010333105c dyld::fastBindLazySymbol(ImageLoader**, unsigned long) + 0
4   dyld                            0x00000001033340b8 dyld::_main(macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long*) + 6316
5   dyld                            0x000000010332d258 dyldbootstrap::start(dyld3::MachOLoaded const*, int, char const**, dyld3::MachOLoaded const*, unsigned long*) + 476
6   dyld                            0x000000010332d038 _dyld_start + 56

It complains that Charts.framework is missing. Check Apple documentation, it is clearly written that this framework is only available on iOS 16.0+.

So MinimumOSVersion of Facebook app is wrong. You are not supposed to install it on iOS 14.

Regarding Google Voice, I didn't manage to install it because it's not available on my Apple ID's country. You can follow these instructions to find out what is going on.

ChiChou commented 10 months ago

This is exact the same issue https://github.com/ChiChou/bagbak/issues/115

ChiChou commented 10 months ago

Updated to wiki

asdfzxcvbn commented 10 months ago

ah alright, thanks for the clarification! my iphone 7 cant get ios 16, so i might upgrade to ios 15 soon. for now, i'll just use others' IPAs when bagbak doesnt work. thanks!