[!] KeyError: 'IPAINSTALLER' error while running 'binary/reversing/strings'

Issue

'''[!] KeyError: 'IPAINSTALLER' ''' error while running '''binary/reversing/strings'''

Expected behaviour

Error should not be shown, the module should execute and provide results.

Actual behaviour

The module fails and exits abruptly while trying to retrieve the IPA.

Steps to reproduce

1. 2. 3.

needle error logs

Ensure verbose and debug mode are enabled:

[needle] > set VERBOSE True
VERBOSE => True
[needle] > set DEBUG True
DEBUG => True

[needle] > use binary/reversing/strings
[needle][strings] > run
[D] Setup local output folder: /Users/brajbong/.needle/output
[?] Attention! The folder chosen to store local output is not empty: /Users/brajbong/.needle/output
[?] Do you want to back it up first?
[?] Y: the content will be archived in a different location, then the folder will be emptied
[?] N: no action will be taken (destination files might be overwritten in case of filename clash)
[y/n]: n
[*] Checking connection with device...
[V] Connection not present, creating a new instance
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: /Users/brajbong/needle_repo/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (127.0.0.1:4444)...
[+] [AGENT] Successfully connected to agent (127.0.0.1:4444)...
[V] [SSH] Connecting (127.0.0.1:2222)...
[+] [SSH] Connected (127.0.0.1:2222)
[D] Creating temp folder: /var/root/needle/
[D] [REMOTE CMD] Remote Command: if [ -d /var/root/needle/ ]; then echo "yes"; else echo "no" ; fi
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result
[*] Configuring device...
[D] [REMOTE CMD] Remote Command: which apt-get
[D] [REMOTE CMD] Remote Command: which dpkg
[D] [REMOTE CMD] Remote Command: apt-get update
[V] [INSTALL] Installing COREUTILS via apt-get.
[D] [REMOTE CMD] Remote Command: apt-get install -y --force-yes coreutils
[V] [INSTALL] Installing COREUTILS via apt-get.
[D] [REMOTE CMD] Remote Command: apt-get install -y --force-yes coreutils-bin
[D] [REMOTE CMD] Remote Command: dpkg --get-selections | grep -v "deinstall" | cut -f1
[D] [REMOTE CMD] Remote Command: apt-get update
[D] [REMOTE CMD] Remote Command: cat /etc/apt/sources.list.d/cydia.list
[D] [REMOTE CMD] Remote Command: which FileDP
[D] [INSTALL] Tool already available: FILEDP
[D] [INSTALL] Already installed: ONDEVICECONSOLE.
[D] [REMOTE CMD] Remote Command: which keychain_dump
[D] [INSTALL] Tool already available: KEYCHAIN_DUMP
[D] Installation method not provided for UIOPEN. Skipping
[D] [INSTALL] Already installed: GAWK.
[D] [INSTALL] Already installed: COREUTILS.
[D] [INSTALL] Already installed: COREUTILS.
[D] [INSTALL] Already installed: FRIDA.
[D] [INSTALL] Already installed: CURL.
[D] [INSTALL] Already installed: OPEN.
[D] Installation method not provided for FIND. Skipping
[D] Installation method not provided for OTOOL. Skipping
[D] Installation method not provided for UNZIP. Skipping
[D] [REMOTE CMD] Remote Command: which fsmon
[D] [INSTALL] Tool already available: FSMON
[D] [INSTALL] Already installed: DARWINTOOLS.
[D] [INSTALL] Already installed: CYCRIPT.
[V] [INSTALL] Installing PERL via apt-get.
[D] Adding repo to cydia.list: http://coolstar.org/publicrepo/
[D] [REMOTE CMD] Remote Command: echo "deb http://coolstar.org/publicrepo/ ./" >> /etc/apt/sources.list.d/cydia.list
[D] [REMOTE CMD] Remote Command: apt-get update
[D] [REMOTE CMD] Remote Command: apt-get install -y --force-yes org.coolstar.perl
[?] Error occurred during installation of tools: dpkg: error processing archive /var/cache/apt/archives/org.coolstar.perl_5.22.0_iphoneos-arm.deb (--unpack):
 cannot copy extracted data for './usr/local/lib/perl5/5.22.0/armv7-apple-darwin/auto/Encode/TW/TW.a' to '/usr/local/lib/perl5/5.22.0/armv7-apple-darwin/auto/Encode/TW/TW.a.dpkg-new': failed to write (No space left on device)
dpkg-deb: error: subprocess paste was killed by signal (Broken pipe: 13)
Errors were encountered while processing:
 /var/cache/apt/archives/org.coolstar.perl_5.22.0_iphoneos-arm.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)
[?] Trying to continue anyway...
[D] Installation method not provided for THEOS_NIC. Skipping
[V] [INSTALL] Installing SCP via apt-get.
[D] Adding repo to cydia.list: https://coolstar.org/publicrepo/
[D] [REMOTE CMD] Remote Command: echo "deb https://coolstar.org/publicrepo/ ./" >> /etc/apt/sources.list.d/cydia.list
[D] [REMOTE CMD] Remote Command: apt-get update
[D] [REMOTE CMD] Remote Command: apt-get install -y --force-yes org.coolstar.scp-ftp-dropbear
[?] Error occurred during installation of tools: E: Couldn't find package org.coolstar.scp-ftp-dropbear
[?] Trying to continue anyway...
[D] Installation method not provided for LIPO. Skipping
[D] [INSTALL] Already installed: PLUTIL.
[D] Installation method not provided for WHICH. Skipping
[D] Installation method not provided for APT-GET. Skipping
[V] [INSTALL] Manually installing: THEOS
[D] [REMOTE CMD] Remote Command: ln -s /usr/local/bin/perl /usr/bin/perl
[?] Error occurred during installation of tools: ln: failed to create symbolic link `/usr/bin/perl': File exists
[?] Trying to continue anyway...
[D] [REMOTE CMD] Remote Command: which pbwatcher
[D] [INSTALL] Tool already available: PBWATCHER
[D] Installation method not provided for STRINGS. Skipping
[D] Installation method not provided for DPKG. Skipping
[D] [INSTALL] Already installed: CLASS-DUMP.
[D] [INSTALL] Already installed: CLASS-DUMP.
[D] [INSTALL] Already installed: CLASS-DUMP.
[D] [INSTALL] Already installed: GDB.
[D] [INSTALL] Already installed: CLUTCH.
[*] Target app not selected. Launching wizard...
[D] [AGENT] Executing command: list_apps
[D] [AGENT] Parsing result
[+] Apps found:
        0 - com.cydia.Extender
        1 - io.pangu.nvwastone
        2 - com.org1.iphone
[>][QUESTION] Please select a number: 2
[+] Target app: com.org1.iphone
[*] Retrieving app's metadata...
/private/var/containers/Bundle/Application/5A34A100-5D21-405E-AD56-850939C54700/orgApp.app/Info.plist
[D] Copying the plist to temp: /private/var/containers/Bundle/Application/5A34A100-5D21-405E-AD56-850939C54700/orgApp.app/Info.plist -> /Users/brajbong/.needle/tmp/plist
[*] Pulling: /private/var/containers/Bundle/Application/5A34A100-5D21-405E-AD56-850939C54700/orgApp.app/Info.plist -> /Users/brajbong/.needle/tmp/plist
[D] Downloading: "/private/var/containers/Bundle/Application/5A34A100-5D21-405E-AD56-850939C54700/orgApp.app/Info.plist" -> /Users/brajbong/.needle/tmp/plist
[D] [LOCAL CMD] Local Command: sshpass -p "alpine" scp -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -P 2222 root@127.0.0.1:"/private/var/containers/Bundle/Application/5A34A100-5D21-405E-AD56-850939C54700/orgApp.app/Info.plist" /Users/brajbong/.needle/tmp/plist
[D] [REMOTE CMD] Remote Command: lipo -info /private/var/containers/Bundle/Application/5A34A100-5D21-405E-AD56-850939C54700/orgApp.app/orgApp
[D] [REMOTE CMD] Remote Command: if [ -d /private/var/containers/Bundle/Application/5A34A100-5D21-405E-AD56-850939C54700/orgApp.app/PlugIns ]; then echo "yes"; else echo "no" ; fi
[D] No Plugins found
[*] Decrypting the binary...
[D] [REMOTE CMD] Remote Command: Clutch2 -d com.org1.iphone 2>&1
[?] The app might be already decrypted. Trying to retrieve the IPA...
------------------------------------------------------------
Traceback (most recent call last):
  File "/Users/brajbong/needle_repo/needle/core/framework/module.py", line 117, in do_run
    self.module_run()
  File "/Users/brajbong/needle_repo/needle/modules/binary/reversing/strings.py", line 45, in module_run
    self.fname_binary = self.device.app.decrypt(self.APP_METADATA)
  File "/Users/brajbong/needle_repo/needle/core/device/app.py", line 218, in decrypt
    cmd = '{bin} -b {bundle} -o {out}'.format(bin=self._device.DEVICE_TOOLS['IPAINSTALLER'],
KeyError: 'IPAINSTALLER'
------------------------------------------------------------
[!] KeyError: 'IPAINSTALLER'.

Environment

Workstation Operating System

OSX Sierra

Python Version

Python 2.7.13

WithSecureLabs / needle

[!] KeyError: 'IPAINSTALLER' error while running 'binary/reversing/strings' #157

Issue

Expected behaviour

Actual behaviour

Steps to reproduce

needle error logs

Environment

Workstation Operating System

Python Version

Python Packages (`pip freeze`)

Device iOS Version

WithSecureLabs / needle

[!] KeyError: 'IPAINSTALLER' error while running 'binary/reversing/strings' #157

Issue

Expected behaviour

Actual behaviour

Steps to reproduce

needle error logs

Environment

Workstation Operating System

Python Version

Python Packages (pip freeze)

Device iOS Version

Python Packages (`pip freeze`)