search

sensepost / objection

📱 objection - runtime mobile exploration
GNU General Public License v3.0
7.17k stars 825 forks source link

`objection explore --startup-command "ios sslpinning disable"` race condition #613

Open SmartArray opened 1 year ago

SmartArray commented 1 year ago

Is your feature request related to a problem? Please describe. Currently, as soon as objection connects to the Frida server, lldb/gdb will cause the app to continue with the execution. Apparently, there is no way to prevent this behavior.

Describe the solution you'd like The app should not run until the hooks are installed properly. Preferably objection could also have a flag --pause that doesn't tell Frida to run the app, to give it some time to initialize... it will continue its execution after entering the command run or proceed-launch. I feel like this might be impossible to fix as some requests are threaded, maybe. On the other hand, it could be possible because threads are launched after the initialization of the main thread.

Describe alternatives you've considered Using breakpoints in gdb/lldb but of course they will pause Frida.Framework's execution too.

Additional context Some apps do a web request very quickly, which will cause severe issues if SSL pinning is not disabled using hooks. In some cases the app will not continue with the launch. That race condition is nasty, as it sometimes takes 10-20 runs until the hooks are added before the HTTP request being executed.

I have good knowledge in Typescript and Python. Maybe someone can point me to the connect procedure or is at least ready to discuss this feature with me.

SmartArray commented 1 year ago

I don't know why objection does not pause the execution. Maybe it's an issue on my end. --no-pause is not useful if it already does that behavior by default.

However, a workaround for me was to patch an IPA with a custom FridaGadget.config and a custom Frida script. That script ran immediately without an issue and helped me to do an "early instrumentation"