iOS applications launched by frida-server cannot be found

[aph3rson]

Describe the bug Frida-server supports launching iOS apps by passing the bundle identifier (CFBundleIdentifier from Info.plist). The app launches just fine, but Objection doesn't appear to be able to connect after the app is launched

To Reproduce Steps to reproduce the behavior:

1. Install/launch frida-server on an iOS device
2. Run the command objection --gadget "com.company.app" explore

Expected behavior App is launched, and objection is connected to the frida-server instance.

Evidence / Logs / Screenshots The following behavior is noted:

1. App launches, and hangs on launch (as if Frida was waiting for a connection). Objection crashes with the following trace:

   
   #> objection --network --host 10.20.30.40 --gadget "com.company.app" explore --startup-command "ios jailbreak disable"

A newer version of objection is available! You have v1.5.2 and v1.6.2 is ready for download.

Upgrade with: pip3 install objection --upgrade For more information, please see: https://github.com/sensepost/objection/wiki/Updating

Using networked device @10.20.30.40:27042 Traceback (most recent call last): File "C:\Python37\Scripts\objection-script.py", line 11, in load_entry_point('objection==1.5.2', 'console_scripts', 'objection')() File "c:\python37\lib\site-packages\click\core.py", line 764, in call return self.main(args, kwargs) File "c:\python37\lib\site-packages\click\core.py", line 717, in main rv = self.invoke(ctx) File "c:\python37\lib\site-packages\click\core.py", line 1137, in invoke return _process_result(sub_ctx.command.invoke(sub_ctx)) File "c:\python37\lib\site-packages\click\core.py", line 956, in invoke return ctx.invoke(self.callback, ctx.params) File "c:\python37\lib\site-packages\click\core.py", line 555, in invoke return callback(args, **kwargs) File "c:\python37\lib\site-packages\objection\console\cli.py", line 109, in explore agent.inject() File "c:\python37\lib\site-packages\objection\utils\agent.py", line 195, in inject session = self._get_session() File "c:\python37\lib\site-packages\objection\utils\agent.py", line 163, in _get_session return self.device.attach(state_connection.gadget_name) File "c:\python37\lib\site-packages\frida\core.py", line 110, in attach return Session(self._impl.attach(self._pid_of(target))) File "c:\python37\lib\site-packages\frida\core.py", line 128, in _pid_of return self.get_process(target).pid File "c:\python37\lib\site-packages\frida\core.py", line 75, in get_process raise _frida.ProcessNotFoundError("unable to find process with name '%s'" % process_name) frida.ProcessNotFoundError: unable to find process with name 'com.company.app'

2. While the application is still launched, attempt to connect by defining the PID of the application:
```text
objection --network --host 10.20.30.40 --gadget 1389 explore --startup-command "ios jailbreak disable"

A newer version of objection is available!
You have v1.5.2 and v1.6.2 is ready for download.

Upgrade with: pip3 install objection --upgrade
For more information, please see: https://github.com/sensepost/objection/wiki/Updating

Using networked device @`10.20.30.40:27042`
Agent injected and responds ok!
Running a startup command... ios jailbreak disable
(agent) Registering job 1zchcbnceri. Type: ios-jailbreak-disable
Traceback (most recent call last):
  File "C:\Python37\Scripts\objection-script.py", line 11, in <module>
    load_entry_point('objection==1.5.2', 'console_scripts', 'objection')()
  File "c:\python37\lib\site-packages\click\core.py", line 764, in __call__
    return self.main(*args, **kwargs)
  File "c:\python37\lib\site-packages\click\core.py", line 717, in main
    rv = self.invoke(ctx)
  File "c:\python37\lib\site-packages\click\core.py", line 1137, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "c:\python37\lib\site-packages\click\core.py", line 956, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "c:\python37\lib\site-packages\click\core.py", line 555, in invoke
    return callback(*args, **kwargs)
  File "c:\python37\lib\site-packages\objection\console\cli.py", line 137, in explore
    device_info = get_device_info()
  File "c:\python37\lib\site-packages\objection\commands\device.py", line 27, in get_device_info
    package_info = api.env_ios()
  File "c:\python37\lib\site-packages\frida\core.py", line 322, in method
    return script._rpc_request('call', js_name, args)
  File "c:\python37\lib\site-packages\frida\core.py", line 240, in _rpc_request
    self.post(message)
  File "c:\python37\lib\site-packages\frida\core.py", line 202, in post
    self._impl.post(raw_message, **kwargs)
frida.TransportError: the connection is closed
Asking jobs to stop...
Unloading objection agent...

Environment (please complete the following information):

• Device: iPad (2018)
• OS: iOS 11.4
• Frida Version: 12.4.0, frida-server of same version
  • Objection Version: 1.5.2

Additional context Running over a network connection. Host is a Windows device.

[leonjza]

I will need some help with this issue. Just to confirm, connecting to the process name (as shown with frida-ps) after spawning with the bundle identifier works ok?

[aph3rson]

I just tried this, and it was able to connect by using the process name - however, the application was killed shortly-thereafter (about a 30 second delay after launching).

I did some more debugging as well - doing frida -f "com.company.app" spawns it just the same, and %resume works as expected - the app is spawned, and the process continues. Interestingly enough, though, when connecting to the process spawned by Objection, doing %resume and %reload gives me a bad food error from Springboard (the process is taking too long to launch).

[aph3rson]

I was actually able to fix this myself - part of the issue is here: https://github.com/sensepost/objection/blob/ce36dd1541491bc6ec048b73a2ae91a406847e13/objection/utils/agent.py#L157-L162

We have the PID already, we should be using this to connect to the process. This fixes any issues where the gadget name might not be the same as the process name (e.g. with spawned processes on iOS).

I'll file a PR to fix this.

[aph3rson]

225 has been filed to fix this issue.