search

KJCracks / Clutch

Fast iOS executable dumper
3.71k stars 646 forks source link

Is there any way to run on macOS? #241

Closed TLHorse closed 4 years ago

TLHorse commented 4 years ago

I have a question. Since Clutch is a static decryption tool, Clutch does not need to use resources on the jailbroken phone, such as memory. So why must it run on a jailbroken phone? Is there any way to run on a macOS?

I saw the issue of #141. #141 says, exploit is found to get around SIP, but can I just shut down SIP by csrutil disable?

Tatsh commented 4 years ago

Because the decryption step doesn't exist on macOS for iOS ARM binaries.

TLHorse commented 4 years ago

Because the decryption step doesn't exist on macOS for iOS ARM binaries.

I‘ve got an idea. If we can have a Xcode iOS Simulator, which is jailbroken, is there anyway to run Clutch on a Xcode iOS Simulator?

Because iOS Simulator’s file system can be access by Finder on macOS, which is in the Developer Folder.

My plan is:

  1. Download an iOS 13.3 simulator, run it, open Safari, then use AppCake to sign & install unc0ver, use unc0ver to jailbreak it, then shutdown the iOS Simulator, access the iOS file system by Finder, put Clutch binary in it.

  2. Now we have a jaibroken iPhone simulator. Get an .ipa by iTunes, install the .ipa on the simulator by ReProvision.

  3. Run Clutch.

Does my plan work?

NinjaLikesCheez commented 4 years ago

Does my plan work?

No. The simulator is just that, a simulator. It runs a different instruction set than an iOS device (i.e. the simulator is running a different slice of the binary than the one we're interested in).

TLHorse commented 4 years ago

Does my plan work?

No. The simulator is just that, a simulator. It runs a different instruction set than an iOS device (i.e. the simulator is running a different slice of the binary than the one we're interested in).

Oh, thanks, I got that. Then is there a way/tool that can help me to decrypt macOS Applications?

NinjaLikesCheez commented 4 years ago

Not that I know of, but you could use similar methods as Clutch uses to dump MachO files on macOS probably.