search

sensepost / objection

📱 objection - runtime mobile exploration
GNU General Public License v3.0
7.46k stars 854 forks source link

Add gadget config and script to IPA patcher #349

Closed interference-security closed 4 years ago

interference-security commented 4 years ago

This adds two options to the IPA patcher:

  1. Allow specifying a file to be used as gadget config
  2. Allow adding a script to be pushed into Payload/AppName.app/Frameworks/ScriptName.js

These can be used together to allow configuring the gadget to load an included script instead of listening for connections, which could be useful for patching applications permanently.

PR changes test output below and ran DVIA iOS app with successful inclusion of FridaGadget.config and script.js files inside Frameworks directory

(virtual-objection-dev) tester@testers-Mac dev % objection patchipa -C FridaGadget.config -l script.js -s DamnVulnerableiOSApp.ipa --codesign-signature XXXXXXXXXX
Using latest Github gadget version: 12.8.19
Patcher will be using Gadget version: 12.8.19
No provision file specified, searching for one...
Found provision file /Users/tester/Library/Developer/Xcode/DerivedData/testerapp20200328-ftktaifvfjfcurafabocdwtpmiic/Build/Products/Debug-iphoneos/testerapp20200328.app/embedded.mobileprovision expiring in 5 days, 5:24:22.161002
Found a valid provisioning profile
Working with app: DamnVulnerableIOSApp.app
Bundle identifier is: com.highaltitudehacks.dvia
Creating Frameworks directory for FridaGadget...
Copying Gadget Config to Frameworks path...
Codesigning 1 .dylib's with signature XXXXXXXXXX
Code signing: FridaGadget.dylib
Copying over a custom script to use with the gadget config.
Creating new archive with patched contents...
Codesigning patched IPA...
Cannot find entitlements in binary. Using defaults

Copying final ipa from /var/folders/f4/4rycq9cs7pdf542yh_659m1m0000gn/T/DamnVulnerableiOSApp-frida-codesigned.ipa to current directory...
Cleaning up temp files...

Thanks to @gergesh for the APK Patcher PR from which this PR has been generated for IPA Patcher. Thanks to @securitytest3r repository (https://github.com/securitytest3r/frida-ios-app-patching) for testing the PR changes.