ChiChou / bagbak

Yet another frida based iOS dumpdecrypted. Also decrypts app extensions
MIT License
1.12k stars 184 forks source link

SC_Info and _CodeSignature folders remain in subdirectories #123

Closed asdfzxcvbn closed 9 months ago

asdfzxcvbn commented 9 months ago

Describe the bug the SC_Info and _CodeSignature folders are removed from the app root, but are still present in subdirectories. for example, Payload/whatever.app/PlugIns/IntentsExtension.appex/SC_Info may still be present.

To Reproduce

  1. dump an app
  2. check subdirectories

Expected behavior all SC_Info and _CodeSignature folders are removed.

Screenshots If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

Additional context Add any other context about the problem here.

asdfzxcvbn commented 9 months ago

fixed for the PlugIns directory! however some frameworks still have the folders.

$ find . -name "SC_Info*"
./Frameworks/IGPyTorchFramework.framework/SC_Info
./Frameworks/FBSharedFramework.framework/SC_Info
./Frameworks/IGInAppPurchaseFramework.framework/SC_Info

$ find . -name "_CodeSignature*"
./Frameworks/IGPyTorchFramework.framework/_CodeSignature
./Frameworks/FBSharedFramework.framework/_CodeSignature
./Frameworks/IGInAppPurchaseFramework.framework/_CodeSignature