Skip to content

Latest commit

 

History

History
190 lines (118 loc) · 4.47 KB

iOS-OSX-Dynamic-Analysis.md

File metadata and controls

190 lines (118 loc) · 4.47 KB

iOS/OSX Dynamic Analysis

Interaction with Devices

libimobiledevice

A cross-platform protocol library to communicate with iOS devices

http://www.libimobiledevice.org/

MobileDevice

A python package, and command line tool, which wraps Apple's MobileDevice API - providing access to iOS devices.

https://github.com/mountainstorm/MobileDevice

libimobiledeive-osx

Build libimobiledeive on Mac OS X

https://github.com/Proteas/libimobiledeive-osx

SDMMobileDevice

MobileDevice Implementation

https://github.com/samdmarshall/SDMMobileDevice

pymobiledevice

pymobiledevice is a python implementation of the libimobiledevice cross-platform software library.

https://github.com/pedia/pymobiledevice

itunnel_mux

connect by usb http://code.google.com/p/iphonetunnel-usbmuxconnectbyport/

Installation, Execution and Decryption

pkg-Installer

Bypassing installation requirements check for Mac OS X .pkg files.

https://github.com/x43x61x69/pkg-Installer

Mach-O-Prettifier

A Mach-O Load Command deobfuscator.

https://github.com/x43x61x69/Mach-O-Prettifier

dumpdecrypted

Dumps decrypted mach-o files from encrypted iPhone applications from memory to disk. This tool is necessary for security researchers to be able to look under the hood of encryption.

https://github.com/stefanesser/dumpdecrypted

Clutch

Fast iOS executable dumper

https://github.com/KJCracks/Clutch

Debugging and Tracing

cycript

http://www.cycript.org/

Ponydebugger

https://github.com/square/PonyDebugger

lldb-capstone-arm

Capstone disassemble scripts for lldb

https://github.com/upbit/lldb-capstone-arm

DTrace-book-scripts

Scripts from "DTrace: Dynamic Tracing in Oracle Solaris, Mac OS X, and FreeBSD", by Brendan Gregg and Jim Mauro, Prentice Hall, 2011.

https://github.com/brendangregg/DTrace-book-scripts

CryptoShark

Self-optimizing cross-platform code tracer based on dynamic recompilation, powered by Frida and Capstone.

https://github.com/frida/cryptoshark

gdb-ng

Apple's gdb fork with some fixes and enhancements

https://github.com/gdbinit/gdb-ng

pydbg64

PyDBG64 - OS X PyDbg with 64 bits support

https://github.com/gdbinit/pydbg64

Injection, Hooking and Intrumentation

Frida

https://github.com/frida/frida

osxinj

osx dylib injection

https://github.com/scen/osxinj

osxinj_tut

OSX injection tutorial: Hello World

https://github.com/arbinger/osxinj_tut

insert_dylib

Command line utility for inserting a dylib load command into a Mach-O binary

https://github.com/Tyilo/insert_dylib

mach_override

runtime function overriding for Mac OS X

https://github.com/rentzsch/mach_override

mach_inject

interprocess code injection for Mac OS X

https://github.com/rentzsch/mach_inject

Mach-O-Hook

Mach-O import table patching for function redirection. This is a method for function hooking on Mac OS X. It patches the import table of Mach-O libraries in order to redirect particular functions in them to other implementations.

https://github.com/shoumikhin/Mach-O-Hook

Memory Analysis

HippocampHairSalon

A simple universal memory editor (game trainer) on OSX/iOS

https://github.com/iosre/HippocampHairSalon

UI Automation

AXElements

UI Automation for OS X

https://github.com/AXElements/AXElements

ATOMac

Python Automated Testing on Mac

https://github.com/pyatom/pyatom

cliclick

OS X tool for executing mouse- and keyboard-related actions from the shell

https://github.com/BlueM/cliclick

System Monitoring

macfsevents

Thread-based interface to file system observation primitives.

https://github.com/malthe/macfsevents

FSWalker

A File System Browser for iOS

https://github.com/nst/FSWalker

Network Analysis

Charles Proxy

http://www.charlesproxy.com/

Mallory

MiTM TCP and UDP Proxy

https://github.com/intrepidusgroup/mallory

ADVsock2pipe

capture network data with tcpdump on Linux or iPhone/iPad to see the capture in (almost) real-time in Wireshark on windows

https://github.com/ADVTOOLS/ADVsock2pipe

Sandbox

Introspy-iOS

Security profiling for blackbox iOS

https://github.com/iSECPartners/Introspy-iOS

DiOS

DiOS: Large-Scale Dynamic Privacy Analysis of iOS App Store Applications

https://github.com/DiOS-Analysis/DiOS

Others

theos

Unified cross-platform iPhone Makefile system

https://github.com/DHowett/theos

classdump-dyld

Class-dump any Mach-o file without extracting it from dyld_shared_cache

https://github.com/limneos/classdump-dyld