A tracer based on frida for XPC messages in iOS and macOS.

Overview

XPC tracer

A tracer based on frida for XPC messages in iOS and macOS.

This project is a variant of xpcspy. In particular for my purpose I didn't develop a Python script with options to filter messages based on direction (incoming/outgoing). Anyway I created an agent to hook some xpc_connection_send_message functions and print their arguments in the best way possible. As you will notice I print arguments in-depth including parsed bplist00, bplist15, bplist16 and bplist17 using jlutil.

This is a PoC for AnForA.

Requirements

  • A jailbroken iDevice

Quick-start guide

I prefer using frida inside Python virtual environment (venv).

How to create venv, compile & load

$ git clone https://github.com/lorenzoferron98/xpc-tracer.git
$ cd xpc-tracer/
$ python -m venv .venv                                        # create virtual env
$ source .venv/bin/activate
$ npm install                                                 # nodejs required
$ pip install frida-tools
$ frida -U -f ph.telegra.Telegraph --no-pause -l _agent.js    # target app: Telegram

Patch IPA

To use agent, target application must be able to execute system call system(2). So you must patch IPA.

  1. Dump enitlements.plist using ldid -e ${APP_PATH}
  2. Append
    <key>com.apple.private.security.no-container</key>
    <true/>
    to enitlements.plist.
  3. Signing application with ldid -Senitlements.plist ${APP_PATH}

Example of Output

xpc_connection_send_message_with_reply_sync(
        connection = {
                com.apple.contactsd = {
                        service: OS_xpc_dictionary = {
                                EnableTransactions: OS_xpc_bool = true,
                                LimitLoadToSessionType: OS_xpc_string = System,
                                MachServices: OS_xpc_dictionary = {
                                        com.apple.contactsd.launch-services-proxy: OS_xpc_mach_send = <mach send right: 0x283cb51e0> { name = 0, right = send, urefs = 1 },
                                        com.apple.contactsd: OS_xpc_mach_send = <mach send right: 0x283cb40a0> { name = 0, right = send, urefs = 1 }
                                },
                                Label: OS_xpc_string = com.apple.contactsd,
                                TimeOut: OS_xpc_int64 = 30,
                                OnDemand: OS_xpc_bool = true,
                                LastExitStatus: OS_xpc_int64 = 0,
                                PID: OS_xpc_int64 = 279,
                                Program: OS_xpc_string = /System/Library/Frameworks/Contacts.framework/Support/contactsd,
                                ProgramArguments: OS_xpc_array = [
                                        : OS_xpc_string = /System/Library/Frameworks/Contacts.framework/Support/contactsd,
                                ]
                        }
                }
        },
        message: OS_xpc_dictionary = {
                f: OS_xpc_uint64 = 33,
                root: OS_xpc_data = {
                        format = bplist16,
                        body = {
   0: encodedContactsAndCursorForFetchRequest:withReply:
   1: v@:@@?
   2: 
      0: 
         $class: CNContactFetchRequest
         keysToFetch: 
            $class: NSArray
            NS.objects: 
               0: 
                  $class: CNAggregateKeyDescriptor
                  _keyDescriptors: 
                     $class: NSArray
                     NS.objects: 
                        0: namePrefix灴潲o牆整捨湡浥偲敦
                        1: givenName
                        2: middleName
                        3: familyName
                        4: nameSuffix
                        5: contactType
                        6: organizationName潲条湩穡瑩潮乡浥닦鶡ꧧꦡꧦ
                        7: nickname扰汩獴ㄶꂥȀ


                  _privateDescription: Formatter style: 0閦@

               1: phoneNumbers
               2: urlAddresses


         unifyResults: false
         sortOrder: 0
         onlyMainStore: true
         predicate: NULL
         mutableObjects: true
         rankSort: 
      1: NULL


                        }
                },
                proxynum: OS_xpc_uint64 = 1,
                replysig: OS_xpc_string = v32@?0@"NSData"8@"<CNEncodedFetchCursor><NSXPCProxyCreating>"16@"NSError"24,
                sequence: OS_xpc_uint64 = 3
        }
);

In this example Telegram call native function xpc_connection_send_message_with_reply_sync to create a new contact (John Doe +1 212-456-7890).

The function has two arguments connection and message. The information for the former is retrieved using launchctl list query. The latter is a dictionary with data in bplist16 format decoded using jlutil.

I don't know why jlutil print this "strange" chars. Moreover, it's not always possible to get information about connection. In these cases launchctl list prints error: OS_xpc_int64 = Could not find specified service.

You might also like...

🆙 Upscayl - Free and Open Source AI Image Upscaler for Linux, MacOS and Windows built with Linux-First philosophy.

🆙 Upscayl - Free and Open Source AI Image Upscaler for Linux, MacOS and Windows built with Linux-First philosophy.

v1.3 will come around 12 September Upscayl 🆙 Free and Open Source AI Image Upscaler simplescreenrecorder-2022-08-23_20.17.02.mp4 Upscayl is a cross-p

Jan 9, 2023

🆙 Upscayl - Free and Open Source AI Image Upscaler for Linux, MacOS and Windows built with Linux-First philosophy.

🆙 Upscayl - Free and Open Source AI Image Upscaler for Linux, MacOS and Windows built with Linux-First philosophy.

Upscayl 🆙 Free and Open Source AI Image Upscaler Upsacyl.Demo.mp4 Upscayl is a cross-platform application built with the Linux-first philosophy. This

Sep 21, 2022

Next-level academia! Repository for the Native Overleaf project, attempting to integrate Overleaf with native OS features for macOS, Linux and Windows.

Next-level academia! Repository for the Native Overleaf project, attempting to integrate Overleaf with native OS features for macOS, Linux and Windows.

Native Overleaf Overleaf is a fantastic webtool for writing and cooperating on LaTeX documents. However, would it not be even better if it were to beh

Dec 18, 2022

macOS Internal Webview App SourceCode

macOS Internal Webview App SourceCode Read First Inspecting Web Views in macOS System Preferences Family Sharing wget https://setup.icloud.com/resourc

Mar 7, 2022

Hacker Tools cross-platform desktop App, support windows/MacOS/LInux ....

Hacker Tools cross-platform desktop App, support windows/MacOS/LInux ....

Jan 8, 2023

A jest reporter that shows test running stats using the HUD macOS app.

jest-hud-reporter A jest reporter that shows test running stats using the HUD macOS app. hud-jest.mp4 Installation This package is available as a NPM

Feb 26, 2022

A guide that teach you build a custom version of chromium on macOS/Windows/Linux that supporting hardware/software HEVC decoding.

enable-chromium-hevc-hardware-decoding A guide that teach you build a custom version of chromium on macOS/Windows/Linux that supports hardware/softwar

Jan 1, 2023

MacOS launcher & command palette

MacOS launcher & command palette

About If you ever liked tools like Raycast and Alfred, but wanted to own them and tweak them yourself, then SOL is the tool for you. All the affordanc

Dec 30, 2022

Recreación del entorno de escritorio del sistema operativo macOS Monterey utilizando HTML, CSS y JavaScript

Recreación del entorno de escritorio del sistema operativo macOS Monterey utilizando HTML, CSS y JavaScript

macOS Réplica del sistema operativo macOS Monterey utilizando HTML, CSS y JavaScript. GitHub pages https://jonathan-yv.github.io/macOS/ Componentes Ve

Feb 4, 2022
Owner
Lorenzo
Lorenzo
Reddit Place Tracer is a browser based userscript for the 2022 Reddit /r/Place project

Reddit Place Tracer is a browser based userscript for the 2022 Reddit /r/Place project which adds a transparent image on top of the canvas to aid communities with drawing the same image. It shows how the canvas should look, where each pixel goes, and what color. The user must manually click on these spots. It is not an automated bot and does not break any rules.

null 3 Apr 3, 2022
Enrich your browsing experience, whether it be on mobile (iOS) or your desktop (macOS)

steven's userscripts safari specific AutoScroll.user.js (middle mouse scroll click drag wheel) mobile keyboard.user.js (mobile virtual keyboard shortc

Steven G. 6 Dec 15, 2022
Grupprojekt för kurserna 'Javascript med Ramverk' och 'Agil Utveckling'

JavaScript-med-Ramverk-Laboration-3 Grupprojektet för kurserna Javascript med Ramverk och Agil Utveckling. Utvecklingsguide För information om hur utv

Svante Jonsson IT-Högskolan 3 May 18, 2022
Tracer for module requires/imports to optimize coldstarts in serverless

treq treq is a library to automatically trace requires/imports in your serverless applications and gives you insights about the most expensive modules

Serkan ÖZAL 29 Aug 16, 2022
Hemsida för personer i Sverige som kan och vill erbjuda boende till människor på flykt

Getting Started with Create React App This project was bootstrapped with Create React App. Available Scripts In the project directory, you can run: np

null 4 May 3, 2022
Kurs-repo för kursen Webbserver och Databaser

Webbserver och databaser This repository is meant for CME students to access exercises and codealongs that happen throughout the course. I hope you wi

null 14 Jan 3, 2023
frida snippet generator firefox extension for developer.android.com

Frida Snippet Generator for developer.android.com Right click on function names (public methods section) or fields and it will automatically copy gene

Ahmet Bilal Can 22 Sep 4, 2022
A frida script that can be used to find the public RSA key used in the native libakamaibmp.so shared library, seen in version 3.3.0 of Akamai BMP

Akamai BMP - RSA/AES Frida Hook This Frida script can be used to find the public RSA key used in the encryption process in Akamai BMP 3.3.0. Since ver

yog 31 Jan 8, 2023
A chat logs online saver for discord bots to save messages history & cleared messages online

Chat Logs NPM package that saves messages online to view it later Useful for bots where users can save messages history & cleared messages online Supp

TARIQ 8 Dec 28, 2022
A modern ebook manager and reader with sync and backup capacities for Windows, macOS, Linux and Web

简体中文 | English Koodo Reader A cross-platform ebook reader Download | Preview | Roadmap | Document Preview Feature Format support: EPUB (.epub) Scanned

Troye Guo 8.6k Dec 29, 2022