search

nowsecure / fsmon

monitor filesystem on iOS / OS X / Android / FirefoxOS / Linux
https://www.nowsecure.com
MIT License
881 stars 151 forks source link

IPC and fsmon on iOS #55

Open miticollo opened 2 years ago

miticollo commented 2 years ago

Hi!

First of all I think that fsmon is a great tool.

I compiled it on iPad Mini 2 with iOS 12.5.5 and jailbroken with odysseyra1n. I tested fsmon with Telegram sudo fsmon -P Telegram /. However, if I add a new contact from Telegram I can't capture writing on Contacts app because fsmon monitors only Telegram, but not ABDatabaseDoctor process. To workaround this problem I can use sudo fsmon /. However, with this command I capture noise from other process.

I know that apps on iOS can communicate with IPC. So can I use fsmon or other tool/project (e.g. Frida) to monitor an app (e.g. Telegram) and its IPC?

Thanks in advance. Kind regards, Lorenzo.

trufae commented 2 years ago

I think the best way to snitch into the IPC communications on iOS, is using Frida and hooking XPC apis. there are public tools around to do that already, so maybe that will work for you https://github.com/hot3eed/xpcspy

hot3eed commented 2 years ago

Besides pancake's point, why not just hook the contacts-writing APIs as called by Telegram?

miticollo commented 2 years ago

@hot3eed Yes, I can, but I must find a general approach. For my project I must capture all artifacts produced by an app on iOS after an action. So not only those produced by the app under inspection, but also those produced by another process invoked by this app. I will try to understand your agent to find useful XPC APIs.

miticollo commented 2 years ago

Hi @trufae!

I made some progress (maybe). Using DaemonDisabler I disabled /System/Library/LaunchDaemons/com.apple.ABDatabaseDoctor.plist and /System/Library/LaunchDaemons/com.apple.contactsd.plist. But without latter I can't write or read contacts from Telegram. So after I re-enabled it, I ran sudo fsmon /private/var/mobile/Library/AddressBook and I created a new contact from Telegram. Even if a new contact is present in Contacts app fsmon didn't show any output. Using ls -alFh /private/var/mobile/Library/AddressBook/AddressBook.sqlitedb-wal I discovered that this file is changed.

So is it possible that fsmon didn't notice it?

Kind regards, Lorenzo.

miticollo commented 2 years ago

Sorry to insist, but can anyone help me?