iOS SSL Pinning Error: `TypeError: cannot read property 'forEach' of undefined`

[nVisium-Kevin-Cody]

In the recently released v1.5 version of Objection, I've encounted the following error when attempting to utilize the TLS Pinning Bypass:

com.pewpew.app on (iPhone: 11.1) [usb] # ios sslpinning disable --quiet                            
(agent) Quiet mode enabled. Not reporting invocations.
(agent) Hooking common framework methods
A Frida agent exception has occured.
TypeError: cannot read property 'forEach' of undefined
    at [anon] (duk_hobject_props.c:2384)
    at /script1.js:6218
    at frida/runtime/message-dispatcher.js:45
    at o (frida/runtime/message-dispatcher.js:27)

Python stack trace: Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/objection/console/repl.py", line 371, in start_repl
    self.run_command(document)
  File "/usr/local/lib/python3.7/site-packages/objection/console/repl.py", line 185, in run_command
    exec_method(arguments)
  File "/usr/local/lib/python3.7/site-packages/objection/commands/ios/pinning.py", line 26, in ios_disable
    api.ios_pinning_disable(_should_be_quiet(args))
  File "/usr/local/lib/python3.7/site-packages/frida/core.py", line 322, in method
    return script._rpc_request('call', js_name, args)
  File "/usr/local/lib/python3.7/site-packages/frida/core.py", line 250, in _rpc_request
    raise result[2]
frida.core.RPCException: TypeError: cannot read property 'forEach' of undefined
    at [anon] (duk_hobject_props.c:2384)
    at /script1.js:6218
    at frida/runtime/message-dispatcher.js:45
    at o (frida/runtime/message-dispatcher.js:27)

[nVisium-Kevin-Cody]

Just to confirm, I just recreated with another iOS 11.2.6 Jailbroken device.

That said, I did also confirm that this looks to be isolated to iOS, as Android is working (in my limited testing):

objection --gadget "com.pewpew.app" explore
Using USB device `Google Pixel XL`
Agent injected and responds ok!

     _     _         _   _
 ___| |_  |_|___ ___| |_|_|___ ___
| . | . | | | -_|  _|  _| | . |   |
|___|___|_| |___|___|_| |_|___|_|_|
        |___|(object)inject(ion) v1.5.0

     Runtime Mobile Exploration
        by: @leonjza from @sensepost

[tab] for command suggestions
com.pewpew.app on (google: 9) [usb] # android sslpinning disable                                            
(agent) Custom TrustManager ready, overriding SSLContext.init()
(agent) Found okhttp3.CertificatePinner, overriding CertificatePinner.check()
(agent) Found com.android.org.conscrypt.TrustManagerImpl, overriding TrustManagerImpl.verifyChain()
(agent) Found com.android.org.conscrypt.TrustManagerImpl, overriding TrustManagerImpl.checkTrustedRecursive()
(agent) Registering job y1zj3xu5lmj. Type: android-sslpinning-disable
com.pewpew.app on (google: 9) [usb] #  

[leonjza]

Could you launch with the --debug flag (objection --debug explore) which will not strip the sourcemap in the agent and as a result provide a more useful exception to track the cannot read property 'forEach' of undefined location?

Thanks!

[nVisium-Kevin-Cody]

Does this help?

objection --debug --gadget "PewPew" explore
[debug] Agent path is: /usr/local/lib/python3.7/site-packages/objection/agent.js
[debug] Injecting agent...
Using USB device `iPhone`
[debug] Attempting to attach to process: `PewPew`
[debug] Process attached!
Agent injected and responds ok!

     _     _         _   _
 ___| |_  |_|___ ___| |_|_|___ ___
| . | . | | | -_|  _|  _| | . |   |
|___|___|_| |___|___|_| |_|___|_|_|
        |___|(object)inject(ion) v1.5.0

     Runtime Mobile Exploration
        by: @leonjza from @sensepost

[tab] for command suggestions
com.pewpew.app on (iPhone: 11.1) [usb] # ios sslpinning disable            
- [incoming message] ------------------
{
  "payload": "\u001b[90mHooking common framework methods\u001b[39m",
  "type": "send"
}
- [./incoming message] ----------------
(agent) Hooking common framework methods
A Frida agent exception has occured.
TypeError: cannot read property 'forEach' of undefined
    at [anon] (duk_hobject_props.c:2384)
    at src/ios/pinning.ts:436
    at frida/runtime/message-dispatcher.js:45
    at o (frida/runtime/message-dispatcher.js:27)

Python stack trace: Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/objection/console/repl.py", line 371, in start_repl
    self.run_command(document)
  File "/usr/local/lib/python3.7/site-packages/objection/console/repl.py", line 185, in run_command
    exec_method(arguments)
  File "/usr/local/lib/python3.7/site-packages/objection/commands/ios/pinning.py", line 26, in ios_disable
    api.ios_pinning_disable(_should_be_quiet(args))
  File "/usr/local/lib/python3.7/site-packages/frida/core.py", line 322, in method
    return script._rpc_request('call', js_name, args)
  File "/usr/local/lib/python3.7/site-packages/frida/core.py", line 250, in _rpc_request
    raise result[2]
frida.core.RPCException: TypeError: cannot read property 'forEach' of undefined
    at [anon] (duk_hobject_props.c:2384)
    at src/ios/pinning.ts:436
    at frida/runtime/message-dispatcher.js:45
    at o (frida/runtime/message-dispatcher.js:27)

[arekorlab]

I got same this issue. Please fix this issue in moment.

[leonjza]

@nVisium-Kevin-Cody Absolutely thank you! Notice how the agent stack trace now has the relevant TypeScript source file included. at /script1.js:6218 vs at src/ios/pinning.ts:436, which implies this line.

I'll investigate and debug soon!

[leonjza]

Should be fixed in v1.5.1.

[nVisium-Kevin-Cody]

Thanks @leonjza! I even looked for the pinning.ts line, and must have messed up my query. 🤦

I <3 your project and sincerely appreciate your hard work. Cheers!

[nVisium-Kevin-Cody]

$ objection --gadget "PewPew" explore
Using USB device `iPhone`
Agent injected and responds ok!

     _     _         _   _
 ___| |_  |_|___ ___| |_|_|___ ___
| . | . | | | -_|  _|  _| | . |   |
|___|___|_| |___|___|_| |_|___|_|_|
        |___|(object)inject(ion) v1.5.1

     Runtime Mobile Exploration
        by: @leonjza from @sensepost

[tab] for command suggestions
com.pewpew on (iPhone: 11.1) [usb] # ios sslpinning disable                                                                
(agent) Hooking common framework methods
(agent) [6hnw9vb5gsh] Found NSURLSession based classes. Hooking known pinning methods.
(agent) [6hnw9vb5gsh] Found TrustKit. Hooking known pinning methods.
(agent) Hooking lower level SSL methods
(agent) Hooking lower level TLS methods
(agent) Registering job 6hnw9vb5gsh. Type: ios-sslpinning-disable
com.pewpew on (iPhone: 11.1) [usb] #