search

Soulghost / iblessing

iblessing is an iOS security exploiting toolkit, it mainly includes application information gathering, static analysis and dynamic analysis. It can be used for reverse engineering, binary analysis and vulnerability mining.
GNU General Public License v3.0
626 stars 90 forks source link

After reading the readme, I have two questions. #9

Open CodeLife2012 opened 2 years ago

CodeLife2012 commented 2 years ago

  1. Why not use the real machine to dynamically execute, it may be simpler and more accurate to implement.

  2. How to trigger the methods of all classes when running the simulation, if you construct the class yourself, how to ensure that the member variables of the class are legal, and the external global state is also legal？

Soulghost commented 2 years ago

Sorry for the late reply.

  1. iblessing 1.0 was designed to do simple intraprocedure programming analysis such as cross reference analysis to assist iOS userland exploiting, using static analysis instead of real machine dynamic execute can improve analysis speed and cross between platforms.
  2. Currently, iblessing can only perform type and const propagation inside functions, methods and blocks, there is no real objc runtime, heap memory and syscalls, so result of the results may be false positive, and we may miss some results.

iblessing 2.0 is now WIP, it will have a dyld_shared_cache loader, objc runtime, syscall handlers, etc. Currently it can load a iOS 14.8 dyld_shared_cache without PAC and load dylibs, it can emulate objc runtime, posix api calls, GCD and XPC. But it is just a PoC, far from a complete solution.

VonLYC commented 2 months ago

这么晚才回复很抱歉。

  1. iblessing 1.0旨在进行简单的过程内编程分析，例如交叉引用分析以协助iOS用户空间开发，使用静态分析代替真机动态执行可以提高分析速度和跨平台性。
  2. 目前，iblessing 只能在函数、方法和块内部执行类型和 const 传播，没有真正的 objc 运行时、堆内存和系统调用，因此结果可能是误报，我们可能会错过一些结果。

iblessing 2.0 目前正在开发中，它将具有 dyld_shared_cache 加载器、objc 运行时、系统调用处理程序等。目前它可以加载没有 PAC 的 iOS 14.8 dyld_shared_cache 并加载 dylib，它可以模拟 objc 运行时、posix api 调用、GCD 和 XPC。但这只是一个 PoC，远非完整的解决方案。

还会有2.0么，求

Soulghost commented 2 months ago

不好意思，后来个人原因断更了，最新代码应该在 v3-sharedcache-syscall-proxy 这个分支。

On Tue, Aug 6, 2024 at 7:15 PM VonLYC @.***> wrote:

这么晚才回复很抱歉。

  1. iblessing 1.0旨在进行简单的过程内编程分析，例如交叉引用分析以协助iOS用户空间开发，使用静态分析代替真机动态执行可以提高分析速度和跨平台性。
  2. 目前，iblessing 只能在函数、方法和块内部执行类型和 const 传播，没有真正的 objc 运行时、堆内存和系统调用，因此结果可能是误报，我们可能会错过一些结果。

iblessing 2.0 目前正在开发中，它将具有 dyld_shared_cache 加载器、objc 运行时、系统调用处理程序等。目前它可以加载没有 PAC 的 iOS 14.8 dyld_shared_cache 并加载 dylib，它可以模拟 objc 运行时、posix api 调用、GCD 和 XPC。但这只是一个 PoC，远非完整的解决方案。

还会有2.0么，求

— Reply to this email directly, view it on GitHub https://github.com/Soulghost/iblessing/issues/9#issuecomment-2271037830, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABQCEZ6PJJCZQLUPX2YAXH3ZQCV37AVCNFSM6AAAAABMCDLYGOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENZRGAZTOOBTGA . You are receiving this because you commented.Message ID: @.***>