diff --git a/README b/README.md similarity index 75% rename from README rename to README.md index 8000eb3..0392f5a 100644 --- a/README +++ b/README.md @@ -8,14 +8,27 @@ First adjust the Makefile if you have a different iOS SDK installed. And then just: make - Usage: +Before running the decryption dumper, the dumpdecrypted.dylib should be signed. + +``` +$ security find-identity -p codesigning -v + 1) 998971859D4D2E74F "iPhone Developer: ..." + 2) CF57726A2BA2D8B57 "Mac Developer: ..." + 2 valid identities found +$ codesign -f -s 998971859D4D2E74F... dumpdecrypted.dylib +dumpdecrypted.dylib: replacing existing signature + +``` + +``` iPod:~ root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Applications/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/Scan.app/Scan -mach-o decryption dumper + DISCLAIMER: This tool is only meant for security research purposes, not for application crackers. +[+] Mach-O Decryption Dumper by Stefanesser [+] Found encrypted data at address 00002000 of length 1826816 bytes - type 1. [+] Opening /private/var/mobile/Applications/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/Scan.app/Scan for reading. [+] Reading header @@ -30,3 +43,4 @@ DISCLAIMER: This tool is only meant for security research purposes, not for appl [+] Copying the not encrypted remainder of the file [+] Closing original file [+] Closing dump file +``` diff --git a/dumpdecrypted.c b/dumpdecrypted.c index 3313be2..92fbaf2 100644 --- a/dumpdecrypted.c +++ b/dumpdecrypted.c @@ -4,10 +4,11 @@ Dumps decrypted iPhone Applications to a file - better solution than those GDB s (C) Copyright 2011-2014 Stefan Esser iPod:~ root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Applications/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/Scan.app/Scan -mach-o decryption dumper + DISCLAIMER: This tool is only meant for security research purposes, not for application crackers. +[+] Mach-O Decryption Dumper by Stefanesser [+] Found encrypted data at address 00002000 of length 1826816 bytes - type 1. [+] Opening /private/var/mobile/Applications/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/Scan.app/Scan for reading. [+] Reading header @@ -55,10 +56,9 @@ void dumptofile(int argc, const char **argv, const char **envp, const char **app unsigned int fileoffs = 0, off_cryptid = 0, restsize; int i,fd,outfd,r,n,toread; char *tmp; - - printf("mach-o decryption dumper\n\n"); printf("DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.\n\n"); + printf("[+] Mach-O Decryption Dumper by Stefanesser \n"); /* detect if this is a arm64 binary */ if (pvars->mh->magic == MH_MAGIC_64) {