search

KJCracks / Clutch

Fast iOS executable dumper
3.69k stars 647 forks source link

Can't dump any apps - iOS 11 #198

Closed Znapi closed 5 years ago

Znapi commented 6 years ago

First off, following the README exactly won't build because of missing provisioning profiles, but I could get it to compile with xcodebuild clean build CODE_SIGN_IDENTITY="" or by opening Xcode and setting it to use my Personal Team. Running Clutch results in Killed: 9, however. I had to sign it on the device with jtool (I'm using LiberiOS for the jailbreak), and I had to compile with -arch arm64 because jtool doesn't work on fat binaries.

Specifically, here's how I compiled it, with a fresh copy of Clutch:

xcodebuild -arch arm64 clean build CODE_SIGN_IDENTITY=""

And then, on device:

jtool --sign platform --ent Clutch.entitlements --inplace Clutch

Where Clutch.entitlements was copied from the repo, with the addition of <key>platform-application</key><true/>. So now it's signed:

# jtool --ent Clutch
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>platform-application</key>
    <true/>
    <key>get-task-allow</key>
    <true/>
    <key>task_for_pid-allow</key>
    <true/>
    <key>com.apple.backboardd.debugapplications</key>
    <true/>
    <key>com.apple.springboard.debugapplications</key>
    <true/>
    <key>run-unsigned-code</key>
    <true/>
    <key>com.apple.private.librarian.can-get-application-info</key>
    <true/>
    <key>com.apple.private.mobileinstall.allowedSPI</key>
    <array>
        <string>Lookup</string>
        <string>CopyInstalledAppsForLaunchServices</string>
    </array>
</dict>
</plist>

# jtool --sig Clutch
Blob at offset: 310368 (3456 bytes) is an embedded signature
Code Directory (2695 bytes)
        Version:     20200
        Flags:       none
        Platform Binary
        CodeLimit:   0x4bc60
        Identifier:  usr/bin/Clutch (0x58)
        CDHash:      4690fd241d9623a539775f8f0773aab6b9ee2eb55170271e96faa9cbd4b89266 (computed)
        # of Hashes: 76 code + 5 special
        Hashes @263 size: 32 Type: SHA-256
 Empty requirement set (12 bytes)
Entitlements (702 bytes) (use --ent to view)
#
# codesign -vvvvv -d Clutch
Executable=/Users/znapi/Desktop/Clutch
Identifier=usr/bin/Clutch
Format=Mach-O thin (arm64)
CodeDirectory v=20200 size=2695 flags=0x0(none) hashes=76+5 location=embedded
Platform identifier=1
OSPlatform=37
OSSDKVersion=721408
OSVersionMin=524288
Hash type=sha256 size=32
CandidateCDHash sha256=4690fd241d9623a539775f8f0773aab6b9ee2eb5
Hash choices=sha256
Page size=4096
    -5=12714fe0a25447ede98720247310078e3a25ea28f306201b80fb5ec05812f729
    -4=0000000000000000000000000000000000000000000000000000000000000000
    -3=0000000000000000000000000000000000000000000000000000000000000000
    -2=987920904eab650e75788c054aa0b0524e6a80bfc71aa32df8d237a61743f986
CDHash=4690fd241d9623a539775f8f0773aab6b9ee2eb5
/Users/znapi/Desktop/Clutch: no signature
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements count=0 size=12

Now it can run, but it always fails. Attempting to dump Spotify:

# Clutch -b 10
2017-12-30 16:55:44.208 Clutch[297:10603] command: Only dump binary files from specified bundleID
Zipping Spotify.app
ASLR slide: 0x100cb0000
Dumping <MessagesExtension> (arm64)
Patched cryptid (64bit segment)
Failed to dump a page :(
Error: Failed to dump <MessagesExtension> with arch arm64

2017-12-30 16:55:44.875 Clutch[297:10616] failed operation :(
2017-12-30 16:55:44.875 Clutch[297:10616] application <NSOperationQueue: 0x13702b8f0>{name = 'NSOperationQueue 0x13702b8f0'}
Error: Failed to dump <MessagesExtension>

2017-12-30 16:55:44.875 Clutch[297:10616] failed operation :(
2017-12-30 16:55:44.875 Clutch[297:10616] application <NSOperationQueue: 0x13702b8f0>{name = 'NSOperationQueue 0x13702b8f0'}
Error: Can't execute task_for_pid! Do you have the right permissions/entitlements?

Failed to find address of header!
Error: Failed to dump <Spotify> with arch arm64

2017-12-30 16:55:44.877 Clutch[297:10614] failed operation :(
2017-12-30 16:55:44.877 Clutch[297:10614] application <NSOperationQueue: 0x135f507e0>{name = 'NSOperationQueue 0x135f507e0'}
Error: Failed to dump <Spotify>

2017-12-30 16:55:44.878 Clutch[297:10614] failed operation :(
2017-12-30 16:55:44.878 Clutch[297:10614] application <NSOperationQueue: 0x135f507e0>{name = 'NSOperationQueue 0x135f507e0'}
Zipping MessagesExtension.appex
FAILED: <Spotify bundleID: com.spotify.client>
Finished dumping com.spotify.client in 2.2 seconds

Attempting to dump Gmail:

# Clutch -b 18
2017-12-30 16:58:28.537 Clutch[315:11103] command: Only dump binary files from specified bundleID
Zipping Gmail.app
ASLR slide: 0x102e2c000
Dumping <ShareExtension> (arm64)
Patched cryptid (64bit segment)
Failed to dump a page :(
Error: Failed to dump <ShareExtension> with arch arm64

2017-12-30 16:58:29.278 Clutch[315:11111] failed operation :(
2017-12-30 16:58:29.278 Clutch[315:11111] application <NSOperationQueue: 0x141d48640>{name = 'NSOperationQueue 0x141d48640'}
Error: Failed to dump <ShareExtension>

2017-12-30 16:58:29.278 Clutch[315:11111] failed operation :(
2017-12-30 16:58:29.278 Clutch[315:11111] application <NSOperationQueue: 0x141d48640>{name = 'NSOperationQueue 0x141d48640'}
Error: Could not obtain mach port, either the process is dead (codesign error?) or entitlements were not properly signed!

Error: Failed to dump <Gmail> with arch arm64

2017-12-30 16:58:29.333 Clutch[315:11110] failed operation :(
2017-12-30 16:58:29.333 Clutch[315:11110] application <NSOperationQueue: 0x141d37360>{name = 'NSOperationQueue 0x141d37360'}
Error: Failed to dump <Gmail>

2017-12-30 16:58:29.333 Clutch[315:11110] failed operation :(
2017-12-30 16:58:29.333 Clutch[315:11110] application <NSOperationQueue: 0x141d37360>{name = 'NSOperationQueue 0x141d37360'}
Zipping ShareExtension.appex
FAILED: <Gmail bundleID: com.google.Gmail>
Finished dumping com.google.Gmail in 6.9 seconds
palmerc commented 6 years ago

I'm seeing the same. I believe the issue is arm64, not iOS 11. I get the same issue on current apps on iOS 9 and 10 devices. If I download an older app with 32-bit only it works.

Tatsh commented 6 years ago

We are not testing iOS 11 until Liberios is complete.

Dry05 commented 6 years ago

Try this https://github.com/KJCracks/Clutch/issues/22

palmerc commented 6 years ago

Try the clutch.conf?

ian-mcdowell commented 6 years ago

I'm seeing the same thing here. Looks like task_for_pid is failing, even though task_for_pid-allow is in the entitlements. Anyone get past this?

palmerc commented 6 years ago

We should recompile with the DEBUG flag to see if it provides any clues. It'll be a little while before I'll get a chance to try it.

NinjaLikesCheez commented 6 years ago

Is AMFI patched in Liberios? (I’ve not played with it yet)

palmerc commented 6 years ago

While the title of this Issue has iOS 11 in it, it is not an iOS 11 issue. It is a 64-bit code problem

Znapi commented 6 years ago

Edited the title accordingly. This is my only iDevice, so I can't test any 32 bit apps.

palmerc commented 6 years ago

I don't have a jailbroken device this weekend, but can someone run Clutch re-compiled with the DEBUG option on? Either do it in the Xcode project or you can do it without the IDE using CMake.

I've added CMake to my fork of Clutch and you can compile it with:

mkdir build
cd build
cmake -D CMAKE_BUILD_TYPE=Debug ..
cmake --build .

https://github.com/palmerc/Clutch

Then if necessary build ldid and add the entitlements. I've got a couple of scripts for that as well. Or if you want to skip that you can just use the ARM64 binary I just compiled.

Clutch.zip

Znapi commented 6 years ago

Here's attempting to dump Spotify on iOS 11.1.

-bash-3.2# Clutch -b --verbose 10
2018-01-14 17:39:47.254 Clutch65[415:13381] command: Print verbose messages
2018-01-14 17:39:47.257 Clutch65[415:13381] command: Only dump binary files from specified bundleID
main | using number
Now dumping com.spotify.client
Binary | ######## bundle URL file:///private/var/containers/Bundle/Application/7362059C-E303-4C7A-A336-C93E78BC90CB
Preparing to dump <Spotify>
Path: /var/containers/Bundle/Application/7362059C-E303-4C7A-A336-C93E78BC90CB/Spotify.app/Spotify
Binary | ######## bundle URL file:///private/var/containers/Bundle/Application/7362059C-E303-4C7A-A336-C93E78BC90CB/Spotify.app/PlugIns/
Preparing to dump <MessagesExtension>
Path: /var/containers/Bundle/Application/7362059C-E303-4C7A-A336-C93E78BC90CB/Spotify.app/PlugIns/MessagesExtension.appex/MessagesExtension
Zipping Spotify.app
BundleDumpOperation | Finding compatible dumper for binary <MessagesExtension> with arch cputype: 16777228
Dumper | Segment cputype: 16777228, cpusubtype: 0
Dumper | Device cputype: 16777228, cpusubtype: 0
Dumper | Dumper supports cputype 16777228
BundleDumpOperation | Found compatible dumper <ARM64Dumper: 0x102cb8620> for binary <MessagesExtension> with arch arm64
ARM64Dumper | 64bit dumping: arch arm64 offset 0
ARM64Dumper | FOUND __TEXT SEGMENT
ARM64Dumper | FOUND ENCRYPTION INFO: cryptoff 16384 | cryptsize 278528 | cryptid 1
ARM64Dumper | FOUND CODE SIGNATURE: dataoff 424352 | datasize 15552
ARM64Dumper | found all required load commands for <MessagesExtension> arm64
Dumper | to MH_PIE or not to MH_PIE, that is the question
Dumper | got the pid 416 /var/containers/Bundle/Application/7362059C-E303-4C7A-A336-C93E78BC90CB/Spotify.app/PlugIns/MessagesExtension.appex/MessagesExtension
ARM64Dumper | 0 424352 872415232
ARM64Dumper | Found CSSLOT_CODEDIRECTORY
ARM64Dumper | Codesign Pages 104
ASLRDisabler | Found main binary mach-o image @ 0x104f58000!
ASLR slide: 0x104f58000
Dumper | checksum size 2080
Dumping <MessagesExtension> (arm64)
Patched cryptid (64bit segment)
Failed to dump a page :(
ARM64Dumper | done dumping
Error: Failed to dump <MessagesExtension> with arch arm64

2018-01-14 17:39:47.914 Clutch65[415:13388] failed operation :(
2018-01-14 17:39:47.914 Clutch65[415:13388] application <NSOperationQueue: 0x102b39ba0>{name = 'NSOperationQueue 0x102b39ba0'}
Error: Failed to dump <MessagesExtension>

2018-01-14 17:39:47.914 Clutch65[415:13388] failed operation :(
2018-01-14 17:39:47.914 Clutch65[415:13388] application <NSOperationQueue: 0x102b39ba0>{name = 'NSOperationQueue 0x102b39ba0'}
BundleDumpOperation | Finding compatible dumper for binary <Spotify> with arch cputype: 16777228
Dumper | Segment cputype: 16777228, cpusubtype: 0
Dumper | Device cputype: 16777228, cpusubtype: 0
Dumper | Dumper supports cputype 16777228
BundleDumpOperation | Found compatible dumper <ARM64Dumper: 0x109679420> for binary <Spotify> with arch arm64
ARM64Dumper | 64bit dumping: arch arm64 offset 0
ARM64Dumper | FOUND __TEXT SEGMENT
ARM64Dumper | FOUND ENCRYPTION INFO: cryptoff 16384 | cryptsize 48283648 | cryptid 1
ARM64Dumper | FOUND CODE SIGNATURE: dataoff 61472464 | datasize 791040
ARM64Dumper | found all required load commands for <Spotify> arm64
Dumper | to MH_PIE or not to MH_PIE, that is the question
Dumper | got the pid 417 /var/containers/Bundle/Application/7362059C-E303-4C7A-A336-C93E78BC90CB/Spotify.app/Spotify
Error: Could not obtain mach port, either the process is dead (codesign error?) or entitlements were not properly signed!

Error: Failed to dump <Spotify> with arch arm64

2018-01-14 17:39:47.922 Clutch65[415:13387] failed operation :(
2018-01-14 17:39:47.923 Clutch65[415:13387] application <NSOperationQueue: 0x102b36250>{name = 'NSOperationQueue 0x102b36250'}
BundleDumpOperation | operation hash 4340806144
BundleDumpOperation | operation hash 4340718768
BundleDumpOperation | operation hash 4340815008
BundleDumpOperation | operation hash 4201234
Error: Failed to dump <Spotify>

2018-01-14 17:39:47.924 Clutch65[415:13387] failed operation :(
2018-01-14 17:39:47.924 Clutch65[415:13387] application <NSOperationQueue: 0x102b36250>{name = 'NSOperationQueue 0x102b36250'}
BundleDumpOperation | operation hash 4340806144
BundleDumpOperation | operation hash 4340815008
BundleDumpOperation | operation hash 4201234
Zipping MessagesExtension.appex
FAILED: <Spotify bundleID: com.spotify.client>
Finished dumping com.spotify.client in 2.3 seconds
holyswordman commented 6 years ago

Because In ios 11, when clutch trys to spawn a child process to get task in order to dump the binary, the child is immediately killed by sandbox if its parent pid is not 1 (Console app shows "Sandbox: hook..execve() killing ... only launchd is allowed to spawn untrusted binaries"). As a result, the clutch cannot get the task because the child process is dead already.

palmerc commented 6 years ago

Except I’m seeing this on iOS 9 and 10 as well.

On 16 Jan 2018, at 14:48, HolySwordman notifications@github.com wrote:

Because In ios 11, when clutch trys to spawn a child process to get task in order to dump the binary, the child is immediately killed by sandbox if its parent pid is not 1 (Console app shows "Sandbox: hook..execve() killing ... only launchd is allowed to spawn untrusted binaries"). As a result, the clutch cannot get the task because the child process is dead already.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/KJCracks/Clutch/issues/198#issuecomment-357965517, or mute the thread https://github.com/notifications/unsubscribe-auth/AAgifrgL6yNKgpk3sqy-yVPtpqvfPxK1ks5tLKizgaJpZM4RPvQR.

holyswordman commented 6 years ago

Entitlement file seems need to change, we need to add "com.apple.system-task-ports" in ios 11 as well. i only have ios11 device to test.


e.g.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>platform-application</key>
    <true/>
    <key>com.apple.system-task-ports</key>
    <true/>
    <key>task_for_pid-allow</key>
    <true/>
    <key>get-task-allow</key>
    <true/>
          ...........
</dict>
</plist>
qkaiser commented 6 years ago

I think what happens is this:

  1. Clutch tries to spawn the target application in order to dump its code from memory. https://github.com/KJCracks/Clutch/blob/b3979b693f471a519932d9de9786bdc8bae0feb3/Clutch/ARM64Dumper.m#L119

  2. Clutch gets a pid for the spawned process, Sandbox hook gets called and kill it with SIGKILL (you can see that with dmesg):

Sandbox: hook..execve() killing <unsigned>[pid=1587, uid=0]: only launchd is allowed to spawn untrusted binarie

  1. When Clutch calls task_for_pid, the pid refers to a process that's already dead, therefore triggering the error message https://github.com/KJCracks/Clutch/blob/b3979b693f471a519932d9de9786bdc8bae0feb3/Clutch/ASLRDisabler.m#L25-L26

Adding platform-application to Clutch entitlements means you can run Clutch without being bothered by launchd, but that does not mean that Clutch can launch "untrusted binaries".

The restriction limiting untrusted binaries to launchd can be bypassed in one of several ways, described by Jonathan Levin in his QiLink toolkit write-up. See http://newosxbook.com/QiLin/qilin.pdf (last page).

I'll look deeper into if I get some time :)

palmerc commented 6 years ago

I've seemed to identify the issue I was having. Not all jailbreaks are created equally, even on older devices. I was using extra_recipe, but I had to switch to Yalu102. I also switched to Frida for the dump, but I'm pretty sure the problem with Clutch would go away.

Tatsh commented 6 years ago

Please try the latest commit with the -d argument. Post the log.

barton0426 commented 6 years ago

could anyone release the compiled version plz

hirakujira commented 6 years ago

Tried latest commit, still fails

root# Clutch -d 65
2018-04-30 17:16:35.408 Clutch[1572:50069] command: Dump specified bundleID into .ipa file
Zipping Spotify.app
Can't execute task_for_pid! Do you have the right permissions/entitlements?
Failed to find address of header!
Failed to dump <MessagesExtension> with arch arm64
2018-04-30 17:17:02.545 Clutch[1572:50187] failed operation :(
2018-04-30 17:17:02.546 Clutch[1572:50187] application <NSOperationQueue: 0x1042b6180>{name = 'NSOperationQueue 0x1042b6180'}
Failed to dump <MessagesExtension>
2018-04-30 17:17:02.546 Clutch[1572:50187] failed operation :(
2018-04-30 17:17:02.547 Clutch[1572:50187] application <NSOperationQueue: 0x1042b6180>{name = 'NSOperationQueue 0x1042b6180'}
Can't execute task_for_pid! Do you have the right permissions/entitlements?
Failed to find address of header!
Failed to dump <Spotify> with arch arm64
2018-04-30 17:17:02.652 Clutch[1572:50186] failed operation :(
2018-04-30 17:17:02.652 Clutch[1572:50186] application <NSOperationQueue: 0x1045359a0>{name = 'NSOperationQueue 0x1045359a0'}
Failed to dump <Spotify>
2018-04-30 17:17:02.653 Clutch[1572:50186] failed operation :(
2018-04-30 17:17:02.653 Clutch[1572:50186] application <NSOperationQueue: 0x1045359a0>{name = 'NSOperationQueue 0x1045359a0'}
Zipping MessagesExtension.appex
FAILED: <Spotify bundleID: com.spotify.client>
Finished dumping com.spotify.client in 10.3 seconds
Tatsh commented 6 years ago

@hirakujira Can you try with the --debug flag and post the log?

palmerc commented 6 years ago

You’re going to have issues depending on the jailbreak. Back in the good old days a jailbreak would reasonably wipe out enough security to allow app dumping. Today, that isn’t necessarily the case.

On 30 Apr 2018, at 11:17, Hiraku notifications@github.com wrote:

Tried latest commit, still fails

root# Clutch -d 65 2018-04-30 17:16:35.408 Clutch[1572:50069] command: Dump specified bundleID into .ipa file Zipping Spotify.app Can't execute task_for_pid! Do you have the right permissions/entitlements? Failed to find address of header! Failed to dump with arch arm64 2018-04-30 17:17:02.545 Clutch[1572:50187] failed operation :( 2018-04-30 17:17:02.546 Clutch[1572:50187] application <NSOperationQueue: 0x1042b6180>{name = 'NSOperationQueue 0x1042b6180'} Failed to dump 2018-04-30 17:17:02.546 Clutch[1572:50187] failed operation :( 2018-04-30 17:17:02.547 Clutch[1572:50187] application <NSOperationQueue: 0x1042b6180>{name = 'NSOperationQueue 0x1042b6180'} Can't execute task_for_pid! Do you have the right permissions/entitlements? Failed to find address of header! Failed to dump with arch arm64 2018-04-30 17:17:02.652 Clutch[1572:50186] failed operation :( 2018-04-30 17:17:02.652 Clutch[1572:50186] application <NSOperationQueue: 0x1045359a0>{name = 'NSOperationQueue 0x1045359a0'} Failed to dump 2018-04-30 17:17:02.653 Clutch[1572:50186] failed operation :( 2018-04-30 17:17:02.653 Clutch[1572:50186] application <NSOperationQueue: 0x1045359a0>{name = 'NSOperationQueue 0x1045359a0'} Zipping MessagesExtension.appex FAILED: Finished dumping com.spotify.client in 10.3 seconds — You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/KJCracks/Clutch/issues/198#issuecomment-385348053, or mute the thread https://github.com/notifications/unsubscribe-auth/AAgifnKRd_ahiBgxKLAI6Bsbh_66imJpks5tttaxgaJpZM4RPvQR.

sohsatoh commented 6 years ago

@Tatsh With --debug option,

root# Clutch -d 69 --debug
2018-05-13 14:44:53.888 Clutch[39697:532758] command: Enable debug logging. Only available with a debug build.
2018-05-13 14:44:53.889 Clutch[39697:532758] command: Dump specified bundleID into .ipa file
Now dumping com.spotify.client
Preparing to dump <Spotify>
Path: /var/containers/Bundle/Application/96142ECA-2B1A-44E2-AF3A-74406B169D19/Spotify.app/Spotify
Preparing to dump <GoogleCast>
Path: /var/containers/Bundle/Application/96142ECA-2B1A-44E2-AF3A-74406B169D19/Spotify.app/Frameworks/GoogleCast.framework/GoogleCast
Preparing to dump <MessagesExtension>
Path: /var/containers/Bundle/Application/96142ECA-2B1A-44E2-AF3A-74406B169D19/Spotify.app/PlugIns/MessagesExtension.appex/MessagesExtension
Zipping Spotify.app
Could not obtain mach port, either the process is dead (codesign error?) or entitlements were not properly signed!
Failed to dump <MessagesExtension> with arch arm64
2018-05-13 14:44:57.899 Clutch[39697:532833] failed operation :(
2018-05-13 14:44:57.899 Clutch[39697:532833] application <NSOperationQueue: 0x102f9e7b0>{name = 'NSOperationQueue 0x102f9e7b0'}
Failed to dump <MessagesExtension>
2018-05-13 14:44:57.900 Clutch[39697:532833] failed operation :(
2018-05-13 14:44:57.900 Clutch[39697:532833] application <NSOperationQueue: 0x102f9e7b0>{name = 'NSOperationQueue 0x102f9e7b0'}
posix_spawn: Operation not permitted (Error 1)
Failed to dump <GoogleCast> with arch arm64
2018-05-13 14:44:57.905 Clutch[39697:532832] failed operation :(
2018-05-13 14:44:57.906 Clutch[39697:532832] application <NSOperationQueue: 0x102f50c10>{name = 'NSOperationQueue 0x102f50c10'}
Failed to dump <GoogleCast>
2018-05-13 14:44:57.906 Clutch[39697:532832] failed operation :(
2018-05-13 14:44:57.906 Clutch[39697:532832] application <NSOperationQueue: 0x102f50c10>{name = 'NSOperationQueue 0x102f50c10'}
Can't execute task_for_pid! Do you have the right permissions/entitlements?
Failed to find address of header!
Failed to dump <Spotify> with arch arm64
2018-05-13 14:44:57.915 Clutch[39697:532829] failed operation :(
2018-05-13 14:44:57.915 Clutch[39697:532829] application <NSOperationQueue: 0x102f51d30>{name = 'NSOperationQueue 0x102f51d30'}
Failed to dump <Spotify>
2018-05-13 14:44:57.915 Clutch[39697:532829] failed operation :(
2018-05-13 14:44:57.915 Clutch[39697:532829] application <NSOperationQueue: 0x102f51d30>{name = 'NSOperationQueue 0x102f51d30'}
Zipping GoogleCast.framework
Zipping MessagesExtension.appex
FAILED: <Spotify bundleID: com.spotify.client>
Finished dumping com.spotify.client in 2.1 seconds
InvalidPlayer3 commented 6 years ago

https://www.google.com/amp/s/ivrodriguez.com/reverse-engineer-ios-apps-ios-11-edition-part1/amp/

This helps while clutch gets fixed try this I read it and it is a great option

jyounus commented 6 years ago

I tried it with the Twitter app. I built Clutch using the latest commit in this repo, but it fails at the end.

iPhone 6, iOS 11.1.2, Electra 1.0.4.

iPhone-6:~ root# Clutch -d com.atebits.Tweetie2 --debug 
2018-05-29 15:29:19.751 Clutch[2603:41869] command: Enable debug logging. Only available with a debug build.
2018-05-29 15:29:19.757 Clutch[2603:41869] command: Dump specified bundleID into .ipa file
Now dumping com.atebits.Tweetie2
Preparing to dump <Twitter>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Twitter
Preparing to dump <AVRKit>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/AVRKit.framework/AVRKit
Preparing to dump <AgileBits>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/AgileBits.framework/AgileBits
Preparing to dump <ApacheThrift>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/ApacheThrift.framework/ApacheThrift
Preparing to dump <FastImageCache>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/FastImageCache.framework/FastImageCache
Preparing to dump <JBChartView>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/JBChartView.framework/JBChartView
Preparing to dump <MagicNeuralNet>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/MagicNeuralNet.framework/MagicNeuralNet
Preparing to dump <PeriscopeViewer>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/PeriscopeViewer.framework/PeriscopeViewer
Preparing to dump <SocketRocket>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/SocketRocket.framework/SocketRocket
Preparing to dump <T1Twitter>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/T1Twitter.framework/T1Twitter
Preparing to dump <TFNUI>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFNUI.framework/TFNUI
Preparing to dump <TFSAPI>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSAPI.framework/TFSAPI
Preparing to dump <TFSAssert>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSAssert.framework/TFSAssert
Preparing to dump <TFSAuth>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSAuth.framework/TFSAuth
Preparing to dump <TFSFeatureSwitches>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSFeatureSwitches.framework/TFSFeatureSwitches
Preparing to dump <TFSLocalizedResources>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSLocalizedResources.framework/TFSLocalizedResources
Preparing to dump <TFSModel>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSModel.framework/TFSModel
Preparing to dump <TFSScribe>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSScribe.framework/TFSScribe
Preparing to dump <TFSScribeThrift>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSScribeThrift.framework/TFSScribeThrift
Preparing to dump <TFSScribeThriftTNUSupport>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSScribeThriftTNUSupport.framework/TFSScribeThriftTNUSupport
Preparing to dump <TFSTwitterAPI>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSTwitterAPI.framework/TFSTwitterAPI
Preparing to dump <TFSTwitterAPICommand>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSTwitterAPICommand.framework/TFSTwitterAPICommand
Preparing to dump <TFSTwitterCore>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSTwitterCore.framework/TFSTwitterCore
Preparing to dump <TFSUtilities>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TFSUtilities.framework/TFSUtilities
Preparing to dump <TVDIAnalyticsScribe>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TVDIAnalyticsScribe.framework/TVDIAnalyticsScribe
Preparing to dump <Tweaks>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/Tweaks.framework/Tweaks
Preparing to dump <TwitterAVCore>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TwitterAVCore.framework/TwitterAVCore
Preparing to dump <TwitterAVCoreAVRKit>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TwitterAVCoreAVRKit.framework/TwitterAVCoreAVRKit
Preparing to dump <TwitterExtensionKit>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TwitterExtensionKit.framework/TwitterExtensionKit
Preparing to dump <TwitterImagePipeline>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TwitterImagePipeline.framework/TwitterImagePipeline
Preparing to dump <TwitterLivePipeline>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TwitterLivePipeline.framework/TwitterLivePipeline
Preparing to dump <TwitterLoggingService>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TwitterLoggingService.framework/TwitterLoggingService
Preparing to dump <TwitterMotionGraphics>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TwitterMotionGraphics.framework/TwitterMotionGraphics
Preparing to dump <TwitterNetworkLayer>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TwitterNetworkLayer.framework/TwitterNetworkLayer
Preparing to dump <TwitterNetworkUtilities>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TwitterNetworkUtilities.framework/TwitterNetworkUtilities
Preparing to dump <TwitterShareExtensionUI>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TwitterShareExtensionUI.framework/TwitterShareExtensionUI
Preparing to dump <TwitterText>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/TwitterText.framework/TwitterText
Preparing to dump <YOLayout>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/YOLayout.framework/YOLayout
Preparing to dump <ZipUtilities>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/ZipUtilities.framework/ZipUtilities
Preparing to dump <pop>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/Frameworks/pop.framework/pop
Preparing to dump <ShareExtension>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/PlugIns/ShareExtension.appex/ShareExtension
Preparing to dump <TwitterNotificationContentExtension>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/PlugIns/TwitterNotificationContentExtension.appex/TwitterNotificationContentExtension
Preparing to dump <TwitterNotificationServiceExtension>
Path: /var/containers/Bundle/Application/ED1297D9-B53F-4239-92A2-6343E492E60C/Twitter.app/PlugIns/TwitterNotificationServiceExtension.appex/TwitterNotificationServiceExtension
Zipping Twitter.app
Failed to find address of header!
Failed to dump <Twitter> with arch arm64
2018-05-29 15:29:23.677 Clutch[2603:41891] failed operation :(
2018-05-29 15:29:23.699 Clutch[2603:41891] application <NSOperationQueue: 0x10230fa20>{name = 'NSOperationQueue 0x10230fa20'}
Failed to dump <Twitter>
2018-05-29 15:29:23.699 Clutch[2603:41891] failed operation :(
2018-05-29 15:29:23.700 Clutch[2603:41891] application <NSOperationQueue: 0x10230fa20>{name = 'NSOperationQueue 0x10230fa20'}
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
Failed to dump <JBChartView> with arch arm64
2018-05-29 15:29:23.727 Clutch[2603:41897] failed operation :(
2018-05-29 15:29:23.727 Clutch[2603:41897] application <NSOperationQueue: 0x102288cc0>{name = 'NSOperationQueue 0x102288cc0'}
Failed to dump <JBChartView>
2018-05-29 15:29:23.728 Clutch[2603:41897] failed operation :(
2018-05-29 15:29:23.728 Clutch[2603:41897] application <NSOperationQueue: 0x102288cc0>{name = 'NSOperationQueue 0x102288cc0'}
posix_spawn: Operation not permitted (Error 1)
Failed to dump <MagicNeuralNet> with arch arm64
2018-05-29 15:29:23.739 Clutch[2603:41898] failed operation :(
2018-05-29 15:29:23.739 Clutch[2603:41898] application <NSOperationQueue: 0x10228a8a0>{name = 'NSOperationQueue 0x10228a8a0'}
Failed to dump <MagicNeuralNet>
2018-05-29 15:29:23.740 Clutch[2603:41898] failed operation :(
2018-05-29 15:29:23.740 Clutch[2603:41898] application <NSOperationQueue: 0x10228a8a0>{name = 'NSOperationQueue 0x10228a8a0'}
posix_spawn: Operation not permitted (Error 1)
Failed to dump <ApacheThrift> with arch arm64
2018-05-29 15:29:23.750 Clutch[2603:41895] failed operation :(
2018-05-29 15:29:23.750 Clutch[2603:41895] application <NSOperationQueue: 0x102285760>{name = 'NSOperationQueue 0x102285760'}
Failed to dump <ApacheThrift>
2018-05-29 15:29:23.755 Clutch[2603:41895] failed operation :(
2018-05-29 15:29:23.755 Clutch[2603:41895] application <NSOperationQueue: 0x102285760>{name = 'NSOperationQueue 0x102285760'}
Failed to dump <AgileBits> with arch arm64
2018-05-29 15:29:23.797 Clutch[2603:41894] failed operation :(
2018-05-29 15:29:23.797 Clutch[2603:41894] application <NSOperationQueue: 0x10226c1d0>{name = 'NSOperationQueue 0x10226c1d0'}
Failed to dump <AgileBits>
2018-05-29 15:29:23.798 Clutch[2603:41894] failed operation :(
2018-05-29 15:29:23.798 Clutch[2603:41894] application <NSOperationQueue: 0x10226c1d0>{name = 'NSOperationQueue 0x10226c1d0'}
posix_spawn: Operation not permitted (Error 1)
Failed to dump <AVRKit> with arch arm64
2018-05-29 15:29:24.101 Clutch[2603:41893] failed operation :(
2018-05-29 15:29:24.101 Clutch[2603:41893] application <NSOperationQueue: 0x10230bc20>{name = 'NSOperationQueue 0x10230bc20'}
Failed to dump <AVRKit>
2018-05-29 15:29:24.102 Clutch[2603:41893] failed operation :(
2018-05-29 15:29:24.102 Clutch[2603:41893] application <NSOperationQueue: 0x10230bc20>{name = 'NSOperationQueue 0x10230bc20'}
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
Failed to dump <TFSScribeThrift> with arch arm64
2018-05-29 15:29:24.123 Clutch[2603:41913] failed operation :(
Failed to dump <SocketRocket> with arch arm64
2018-05-29 15:29:24.125 Clutch[2603:41900] failed operation :(
posix_spawn: Operation not permitted (Error 1)
Failed to dump <TFSAPI> with arch arm64
2018-05-29 15:29:24.132 Clutch[2603:41906] failed operation :(
2018-05-29 15:29:24.136 Clutch[2603:41900] application <NSOperationQueue: 0x1022a6e80>{name = 'NSOperationQueue 0x1022a6e80'}
Failed to dump <TFSTwitterAPI> with arch arm64
2018-05-29 15:29:24.145 Clutch[2603:41915] failed operation :(
2018-05-29 15:29:24.145 Clutch[2603:41913] application <NSOperationQueue: 0x1022b5820>{name = 'NSOperationQueue 0x1022b5820'}
Failed to dump <SocketRocket>
2018-05-29 15:29:24.147 Clutch[2603:41900] failed operation :(
2018-05-29 15:29:24.147 Clutch[2603:41900] application <NSOperationQueue: 0x1022a6e80>{name = 'NSOperationQueue 0x1022a6e80'}
Failed to dump <TFSScribeThrift>
2018-05-29 15:29:24.147 Clutch[2603:41913] failed operation :(
2018-05-29 15:29:24.147 Clutch[2603:41913] application <NSOperationQueue: 0x1022b5820>{name = 'NSOperationQueue 0x1022b5820'}
Failed to dump <TFSAuth> with arch arm64
2018-05-29 15:29:24.152 Clutch[2603:41908] failed operation :(
Failed to dump <FastImageCache> with arch arm64
2018-05-29 15:29:24.156 Clutch[2603:41915] application <NSOperationQueue: 0x1022b6880>{name = 'NSOperationQueue 0x1022b6880'}
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
2018-05-29 15:29:24.157 Clutch[2603:41906] application <NSOperationQueue: 0x10232a260>{name = 'NSOperationQueue 0x10232a260'}
posix_spawn: Operation not permitted (Error 1)
2018-05-29 15:29:24.285 Clutch[2603:41901] failed operation :(
posix_spawn: Operation not permitted (Error 1)
2018-05-29 15:29:24.285 Clutch[2603:41908] application <NSOperationQueue: 0x102336a50>{name = 'NSOperationQueue 0x102336a50'}
posix_spawn: Operation not permitted (Error 1)
2018-05-29 15:29:24.290 Clutch[2603:41901] application <NSOperationQueue: 0x10226ce50>{name = 'NSOperationQueue 0x10226ce50'}
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
Failed to dump <TFSScribe> with arch arm64
2018-05-29 15:29:24.295 Clutch[2603:41912] failed operation :(
2018-05-29 15:29:24.295 Clutch[2603:41912] application <NSOperationQueue: 0x1022b5ad0>{name = 'NSOperationQueue 0x1022b5ad0'}
posix_spawn: Operation not permitted (Error 1)
Failed to dump <TwitterNetworkLayer> with arch arm64
2018-05-29 15:29:24.296 Clutch[2603:41928] failed operation :(
Failed to dump <TwitterMotionGraphics> with arch arm64
2018-05-29 15:29:24.297 Clutch[2603:41928] application <NSOperationQueue: 0x102328be0>{name = 'NSOperationQueue 0x102328be0'}
Failed to dump <TFSTwitterAPI>
2018-05-29 15:29:24.300 Clutch[2603:41927] failed operation :(
Failed to dump <TFSAuth>
2018-05-29 15:29:24.300 Clutch[2603:41915] failed operation :(
Failed to dump <TFSAPI>
2018-05-29 15:29:24.300 Clutch[2603:41927] application <NSOperationQueue: 0x10234b2a0>{name = 'NSOperationQueue 0x10234b2a0'}
Failed to dump <FastImageCache>
2018-05-29 15:29:24.301 Clutch[2603:41908] failed operation :(
Failed to dump <YOLayout> with arch arm64
2018-05-29 15:29:24.301 Clutch[2603:41915] application <NSOperationQueue: 0x1022b6880>{name = 'NSOperationQueue 0x1022b6880'}
Failed to dump <TwitterAVCoreAVRKit> with arch arm64
2018-05-29 15:29:24.301 Clutch[2603:41906] failed operation :(
Failed to dump <TwitterExtensionKit> with arch arm64
2018-05-29 15:29:24.301 Clutch[2603:41901] failed operation :(
Failed to dump <TVDIAnalyticsScribe> with arch arm64
2018-05-29 15:29:24.301 Clutch[2603:41908] application <NSOperationQueue: 0x102336a50>{name = 'NSOperationQueue 0x102336a50'}
Failed to dump <TFSScribe>
2018-05-29 15:29:24.301 Clutch[2603:41932] failed operation :(
Failed to dump <TFSTwitterAPICommand> with arch arm64
2018-05-29 15:29:24.301 Clutch[2603:41922] failed operation :(
Failed to dump <TFSScribeThriftTNUSupport> with arch arm64
2018-05-29 15:29:24.301 Clutch[2603:41906] application <NSOperationQueue: 0x10232a260>{name = 'NSOperationQueue 0x10232a260'}
Failed to dump <TwitterNetworkLayer>
2018-05-29 15:29:24.301 Clutch[2603:41923] failed operation :(
Failed to dump <TwitterMotionGraphics>
2018-05-29 15:29:24.301 Clutch[2603:41901] application <NSOperationQueue: 0x10226ce50>{name = 'NSOperationQueue 0x10226ce50'}
2018-05-29 15:29:24.301 Clutch[2603:41919] failed operation :(
2018-05-29 15:29:24.302 Clutch[2603:41912] failed operation :(
2018-05-29 15:29:24.302 Clutch[2603:41914] failed operation :(
2018-05-29 15:29:24.302 Clutch[2603:41916] failed operation :(
2018-05-29 15:29:24.303 Clutch[2603:41922] application <NSOperationQueue: 0x102346fa0>{name = 'NSOperationQueue 0x102346fa0'}
2018-05-29 15:29:24.303 Clutch[2603:41928] failed operation :(
Failed to dump <TwitterAVCoreAVRKit>
2018-05-29 15:29:24.303 Clutch[2603:41932] application <NSOperationQueue: 0x1022bbd90>{name = 'NSOperationQueue 0x1022bbd90'}
2018-05-29 15:29:24.303 Clutch[2603:41923] application <NSOperationQueue: 0x102348120>{name = 'NSOperationQueue 0x102348120'}
Failed to dump <TwitterExtensionKit>
Failed to dump <YOLayout>
2018-05-29 15:29:24.303 Clutch[2603:41927] failed operation :(
2018-05-29 15:29:24.303 Clutch[2603:41912] application <NSOperationQueue: 0x1022b5ad0>{name = 'NSOperationQueue 0x1022b5ad0'}
2018-05-29 15:29:24.303 Clutch[2603:41919] application <NSOperationQueue: 0x102307650>{name = 'NSOperationQueue 0x102307650'}
2018-05-29 15:29:24.304 Clutch[2603:41914] application <NSOperationQueue: 0x1022b78e0>{name = 'NSOperationQueue 0x1022b78e0'}
2018-05-29 15:29:24.304 Clutch[2603:41916] application <NSOperationQueue: 0x1022b6400>{name = 'NSOperationQueue 0x1022b6400'}
Failed to dump <TFSScribeThriftTNUSupport>
Failed to dump <TFSTwitterAPICommand>
Failed to dump <TVDIAnalyticsScribe>
2018-05-29 15:29:24.304 Clutch[2603:41928] application <NSOperationQueue: 0x102328be0>{name = 'NSOperationQueue 0x102328be0'}
2018-05-29 15:29:24.304 Clutch[2603:41922] failed operation :(
2018-05-29 15:29:24.304 Clutch[2603:41932] failed operation :(
2018-05-29 15:29:24.304 Clutch[2603:41923] failed operation :(
2018-05-29 15:29:24.305 Clutch[2603:41927] application <NSOperationQueue: 0x10234b2a0>{name = 'NSOperationQueue 0x10234b2a0'}
2018-05-29 15:29:24.305 Clutch[2603:41914] failed operation :(
2018-05-29 15:29:24.305 Clutch[2603:41916] failed operation :(
2018-05-29 15:29:24.305 Clutch[2603:41919] failed operation :(
2018-05-29 15:29:24.305 Clutch[2603:41922] application <NSOperationQueue: 0x102346fa0>{name = 'NSOperationQueue 0x102346fa0'}
2018-05-29 15:29:24.306 Clutch[2603:41932] application <NSOperationQueue: 0x1022bbd90>{name = 'NSOperationQueue 0x1022bbd90'}
2018-05-29 15:29:24.306 Clutch[2603:41923] application <NSOperationQueue: 0x102348120>{name = 'NSOperationQueue 0x102348120'}
2018-05-29 15:29:24.306 Clutch[2603:41914] application <NSOperationQueue: 0x1022b78e0>{name = 'NSOperationQueue 0x1022b78e0'}
2018-05-29 15:29:24.306 Clutch[2603:41916] application <NSOperationQueue: 0x1022b6400>{name = 'NSOperationQueue 0x1022b6400'}
2018-05-29 15:29:24.306 Clutch[2603:41919] application <NSOperationQueue: 0x102307650>{name = 'NSOperationQueue 0x102307650'}
posix_spawn: Operation not permitted (Error 1)
Failed to dump <TFSAssert> with arch arm64
2018-05-29 15:29:24.316 Clutch[2603:41907] failed operation :(
2018-05-29 15:29:24.316 Clutch[2603:41907] application <NSOperationQueue: 0x102333e50>{name = 'NSOperationQueue 0x102333e50'}
Failed to dump <TFSAssert>
2018-05-29 15:29:24.316 Clutch[2603:41907] failed operation :(
2018-05-29 15:29:24.316 Clutch[2603:41907] application <NSOperationQueue: 0x102333e50>{name = 'NSOperationQueue 0x102333e50'}
Could not obtain mach port, either the process is dead (codesign error?) or entitlements were not properly signed!
Failed to dump <TwitterNotificationContentExtension> with arch arm64
2018-05-29 15:29:24.349 Clutch[2603:41936] failed operation :(
posix_spawn: Operation not permitted (Error 1)
2018-05-29 15:29:24.354 Clutch[2603:41936] application <NSOperationQueue: 0x1022b0080>{name = 'NSOperationQueue 0x1022b0080'}
Failed to dump <TwitterNotificationContentExtension>
2018-05-29 15:29:24.354 Clutch[2603:41936] failed operation :(
2018-05-29 15:29:24.354 Clutch[2603:41936] application <NSOperationQueue: 0x1022b0080>{name = 'NSOperationQueue 0x1022b0080'}
Can't execute task_for_pid! Do you have the right permissions/entitlements?
Can't execute task_for_pid! Do you have the right permissions/entitlements?
Failed to find address of header!
Failed to find address of header!
Failed to dump <TwitterNotificationServiceExtension> with arch arm64
Failed to dump <ShareExtension> with arch arm64
2018-05-29 15:29:24.357 Clutch[2603:41935] failed operation :(
2018-05-29 15:29:24.357 Clutch[2603:41937] failed operation :(
2018-05-29 15:29:24.357 Clutch[2603:41935] application <NSOperationQueue: 0x10228b8e0>{name = 'NSOperationQueue 0x10228b8e0'}
2018-05-29 15:29:24.357 Clutch[2603:41937] application <NSOperationQueue: 0x10230c150>{name = 'NSOperationQueue 0x10230c150'}
Failed to dump <TwitterNotificationServiceExtension>
Failed to dump <ShareExtension>
2018-05-29 15:29:24.357 Clutch[2603:41937] failed operation :(
2018-05-29 15:29:24.357 Clutch[2603:41935] failed operation :(
2018-05-29 15:29:24.357 Clutch[2603:41937] application <NSOperationQueue: 0x10230c150>{name = 'NSOperationQueue 0x10230c150'}
2018-05-29 15:29:24.357 Clutch[2603:41935] application <NSOperationQueue: 0x10228b8e0>{name = 'NSOperationQueue 0x10228b8e0'}
Failed to dump <PeriscopeViewer> with arch arm64
2018-05-29 15:29:24.370 Clutch[2603:41899] failed operation :(
2018-05-29 15:29:24.370 Clutch[2603:41899] application <NSOperationQueue: 0x10229af80>{name = 'NSOperationQueue 0x10229af80'}
Failed to dump <PeriscopeViewer>
2018-05-29 15:29:24.371 Clutch[2603:41899] failed operation :(
2018-05-29 15:29:24.371 Clutch[2603:41899] application <NSOperationQueue: 0x10229af80>{name = 'NSOperationQueue 0x10229af80'}
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
Failed to dump <TwitterNetworkUtilities> with arch arm64
2018-05-29 15:29:24.415 Clutch[2603:41929] failed operation :(
2018-05-29 15:29:24.416 Clutch[2603:41929] application <NSOperationQueue: 0x10234d380>{name = 'NSOperationQueue 0x10234d380'}
Failed to dump <TwitterNetworkUtilities>
2018-05-29 15:29:24.416 Clutch[2603:41929] failed operation :(
2018-05-29 15:29:24.417 Clutch[2603:41929] application <NSOperationQueue: 0x10234d380>{name = 'NSOperationQueue 0x10234d380'}
Failed to dump <ZipUtilities> with arch arm64
2018-05-29 15:29:24.427 Clutch[2603:41933] failed operation :(
2018-05-29 15:29:24.428 Clutch[2603:41933] application <NSOperationQueue: 0x1022bd1d0>{name = 'NSOperationQueue 0x1022bd1d0'}
Failed to dump <ZipUtilities>
2018-05-29 15:29:24.428 Clutch[2603:41933] failed operation :(
2018-05-29 15:29:24.428 Clutch[2603:41933] application <NSOperationQueue: 0x1022bd1d0>{name = 'NSOperationQueue 0x1022bd1d0'}
Failed to dump <pop> with arch arm64
2018-05-29 15:29:24.451 Clutch[2603:41934] failed operation :(
2018-05-29 15:29:24.452 Clutch[2603:41934] application <NSOperationQueue: 0x1022c44d0>{name = 'NSOperationQueue 0x1022c44d0'}
Failed to dump <pop>
2018-05-29 15:29:24.453 Clutch[2603:41934] failed operation :(
2018-05-29 15:29:24.453 Clutch[2603:41934] application <NSOperationQueue: 0x1022c44d0>{name = 'NSOperationQueue 0x1022c44d0'}
Failed to dump <TwitterImagePipeline> with arch arm64
2018-05-29 15:29:24.488 Clutch[2603:41924] failed operation :(
2018-05-29 15:29:24.488 Clutch[2603:41924] application <NSOperationQueue: 0x102347bd0>{name = 'NSOperationQueue 0x102347bd0'}
Failed to dump <TwitterImagePipeline>
2018-05-29 15:29:24.489 Clutch[2603:41924] failed operation :(
2018-05-29 15:29:24.489 Clutch[2603:41924] application <NSOperationQueue: 0x102347bd0>{name = 'NSOperationQueue 0x102347bd0'}
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
Failed to dump <T1Twitter> with arch arm64
2018-05-29 15:29:24.559 Clutch[2603:41905] failed operation :(
2018-05-29 15:29:24.560 Clutch[2603:41905] application <NSOperationQueue: 0x1022a7b20>{name = 'NSOperationQueue 0x1022a7b20'}
Failed to dump <T1Twitter>
2018-05-29 15:29:24.560 Clutch[2603:41905] failed operation :(
2018-05-29 15:29:24.561 Clutch[2603:41905] application <NSOperationQueue: 0x1022a7b20>{name = 'NSOperationQueue 0x1022a7b20'}
Failed to dump <TFSModel> with arch arm64
2018-05-29 15:29:24.565 Clutch[2603:41911] failed operation :(
2018-05-29 15:29:24.565 Clutch[2603:41911] application <NSOperationQueue: 0x1022b4f00>{name = 'NSOperationQueue 0x1022b4f00'}
Failed to dump <TFSModel>
2018-05-29 15:29:24.566 Clutch[2603:41911] failed operation :(
2018-05-29 15:29:24.566 Clutch[2603:41911] application <NSOperationQueue: 0x1022b4f00>{name = 'NSOperationQueue 0x1022b4f00'}
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
Failed to dump <TwitterShareExtensionUI> with arch arm64
2018-05-29 15:29:24.642 Clutch[2603:41930] failed operation :(
2018-05-29 15:29:24.643 Clutch[2603:41930] application <NSOperationQueue: 0x1022bb930>{name = 'NSOperationQueue 0x1022bb930'}
Failed to dump <TwitterShareExtensionUI>
2018-05-29 15:29:24.643 Clutch[2603:41930] failed operation :(
2018-05-29 15:29:24.643 Clutch[2603:41930] application <NSOperationQueue: 0x1022bb930>{name = 'NSOperationQueue 0x1022bb930'}
posix_spawn: Operation not permitted (Error 1)
Failed to dump <TFSFeatureSwitches> with arch arm64
2018-05-29 15:29:24.655 Clutch[2603:41909] failed operation :(
2018-05-29 15:29:24.655 Clutch[2603:41909] application <NSOperationQueue: 0x102308e20>{name = 'NSOperationQueue 0x102308e20'}
Failed to dump <TFSFeatureSwitches>
2018-05-29 15:29:24.656 Clutch[2603:41909] failed operation :(
2018-05-29 15:29:24.656 Clutch[2603:41909] application <NSOperationQueue: 0x102308e20>{name = 'NSOperationQueue 0x102308e20'}
posix_spawn: Operation not permitted (Error 1)
Failed to dump <TwitterLoggingService> with arch arm64
2018-05-29 15:29:24.663 Clutch[2603:41926] failed operation :(
2018-05-29 15:29:24.663 Clutch[2603:41926] application <NSOperationQueue: 0x10234a9d0>{name = 'NSOperationQueue 0x10234a9d0'}
Failed to dump <TwitterLoggingService>
2018-05-29 15:29:24.663 Clutch[2603:41926] failed operation :(
2018-05-29 15:29:24.663 Clutch[2603:41926] application <NSOperationQueue: 0x10234a9d0>{name = 'NSOperationQueue 0x10234a9d0'}
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
posix_spawn: Operation not permitted (Error 1)
Failed to dump <TwitterText> with arch arm64
2018-05-29 15:29:24.673 Clutch[2603:41931] failed operation :(
2018-05-29 15:29:24.673 Clutch[2603:41931] application <NSOperationQueue: 0x1022bc430>{name = 'NSOperationQueue 0x1022bc430'}
Failed to dump <TwitterText>
2018-05-29 15:29:24.674 Clutch[2603:41931] failed operation :(
2018-05-29 15:29:24.674 Clutch[2603:41931] application <NSOperationQueue: 0x1022bc430>{name = 'NSOperationQueue 0x1022bc430'}
posix_spawn: Operation not permitted (Error 1)
Failed to dump <TwitterAVCore> with arch arm64
2018-05-29 15:29:24.677 Clutch[2603:41921] failed operation :(
2018-05-29 15:29:24.677 Clutch[2603:41921] application <NSOperationQueue: 0x10232e960>{name = 'NSOperationQueue 0x10232e960'}
Failed to dump <TwitterAVCore>
2018-05-29 15:29:24.677 Clutch[2603:41921] failed operation :(
2018-05-29 15:29:24.678 Clutch[2603:41921] application <NSOperationQueue: 0x10232e960>{name = 'NSOperationQueue 0x10232e960'}
Failed to dump <Tweaks> with arch arm64
2018-05-29 15:29:24.686 Clutch[2603:41920] failed operation :(
2018-05-29 15:29:24.686 Clutch[2603:41920] application <NSOperationQueue: 0x1023077c0>{name = 'NSOperationQueue 0x1023077c0'}
Failed to dump <Tweaks>
2018-05-29 15:29:24.687 Clutch[2603:41920] failed operation :(
2018-05-29 15:29:24.687 Clutch[2603:41920] application <NSOperationQueue: 0x1023077c0>{name = 'NSOperationQueue 0x1023077c0'}
Failed to dump <TwitterLivePipeline> with arch arm64
2018-05-29 15:29:24.704 Clutch[2603:41925] failed operation :(
2018-05-29 15:29:24.704 Clutch[2603:41925] application <NSOperationQueue: 0x102349640>{name = 'NSOperationQueue 0x102349640'}
Failed to dump <TwitterLivePipeline>
2018-05-29 15:29:24.704 Clutch[2603:41925] failed operation :(
2018-05-29 15:29:24.704 Clutch[2603:41925] application <NSOperationQueue: 0x102349640>{name = 'NSOperationQueue 0x102349640'}
Failed to dump <TFNUI> with arch arm64
2018-05-29 15:29:24.714 Clutch[2603:41938] failed operation :(
2018-05-29 15:29:24.714 Clutch[2603:41938] application <NSOperationQueue: 0x1023129b0>{name = 'NSOperationQueue 0x1023129b0'}
Failed to dump <TFNUI>
2018-05-29 15:29:24.714 Clutch[2603:41938] failed operation :(
2018-05-29 15:29:24.714 Clutch[2603:41938] application <NSOperationQueue: 0x1023129b0>{name = 'NSOperationQueue 0x1023129b0'}
Failed to dump <TFSUtilities> with arch arm64
2018-05-29 15:29:24.719 Clutch[2603:41918] failed operation :(
2018-05-29 15:29:24.719 Clutch[2603:41918] application <NSOperationQueue: 0x102308ed0>{name = 'NSOperationQueue 0x102308ed0'}
Failed to dump <TFSLocalizedResources> with arch arm64
2018-05-29 15:29:24.719 Clutch[2603:41910] failed operation :(
2018-05-29 15:29:24.719 Clutch[2603:41910] application <NSOperationQueue: 0x102337320>{name = 'NSOperationQueue 0x102337320'}
Failed to dump <TFSLocalizedResources>
2018-05-29 15:29:24.720 Clutch[2603:41910] failed operation :(
2018-05-29 15:29:24.720 Clutch[2603:41910] application <NSOperationQueue: 0x102337320>{name = 'NSOperationQueue 0x102337320'}
Failed to dump <TFSUtilities>
2018-05-29 15:29:24.721 Clutch[2603:41918] failed operation :(
2018-05-29 15:29:24.721 Clutch[2603:41918] application <NSOperationQueue: 0x102308ed0>{name = 'NSOperationQueue 0x102308ed0'}
Failed to dump <TFSTwitterCore> with arch arm64
2018-05-29 15:29:24.723 Clutch[2603:41917] failed operation :(
2018-05-29 15:29:24.723 Clutch[2603:41917] application <NSOperationQueue: 0x1022ba2c0>{name = 'NSOperationQueue 0x1022ba2c0'}
Failed to dump <TFSTwitterCore>
2018-05-29 15:29:24.723 Clutch[2603:41917] failed operation :(
2018-05-29 15:29:24.723 Clutch[2603:41917] application <NSOperationQueue: 0x1022ba2c0>{name = 'NSOperationQueue 0x1022ba2c0'}
Zipping AVRKit.framework
Zipping AgileBits.framework
Zipping ApacheThrift.framework
Zipping FastImageCache.framework
Zipping JBChartView.framework
Zipping MagicNeuralNet.framework
Zipping PeriscopeViewer.framework
Zipping SocketRocket.framework
Zipping T1Twitter.framework
Zipping TFNUI.framework
Zipping TFSAPI.framework
Zipping TFSAssert.framework
Zipping TFSAuth.framework
Zipping TFSFeatureSwitches.framework
Zipping TFSLocalizedResources.framework
Zipping TFSModel.framework
Zipping TFSScribe.framework
Zipping TFSScribeThrift.framework
Zipping TFSScribeThriftTNUSupport.framework
Zipping TFSTwitterAPI.framework
Zipping TFSTwitterAPICommand.framework
Zipping TFSTwitterCore.framework
Zipping TFSUtilities.framework
Zipping TVDIAnalyticsScribe.framework
Zipping Tweaks.framework
Zipping TwitterAVCore.framework
Zipping TwitterAVCoreAVRKit.framework
Zipping TwitterExtensionKit.framework
Zipping TwitterImagePipeline.framework
Zipping TwitterLivePipeline.framework
Zipping TwitterLoggingService.framework
Zipping TwitterMotionGraphics.framework
Zipping TwitterNetworkLayer.framework
Zipping TwitterNetworkUtilities.framework
Zipping TwitterShareExtensionUI.framework
Zipping TwitterText.framework
Zipping YOLayout.framework
Zipping ZipUtilities.framework
Zipping pop.framework
Zipping ShareExtension.appex
Zipping TwitterNotificationContentExtension.appex
Zipping TwitterNotificationServiceExtension.appex
FAILED: <Twitter bundleID: com.atebits.Tweetie2>
Finished dumping com.atebits.Tweetie2 in 11.3 seconds
phreak1990 commented 6 years ago

Is this issue is fixed? As I am also getting an error on IOS 11.2.2

RuinRui commented 5 years ago

Is this issue is fixed? As I am also getting an error on IOS 11.2.2

are you fixed this issus?I'm also getting it on iOS 11.2.3

ninoz commented 5 years ago

Also keen to see if anyone gets this fixed :)

Tatsh commented 5 years ago

Closing due to inactivity.