jitcor/frida-ios-cipher

Intercept all cryptography-related functions on iOS with Frida Api.

Frida-iOS-Cipher

Introduction

Intercept all cryptography-related functions on iOS with Frida Api.

Support Algorithm

• AES
• DES,3DES
• CAST(What it's?)
• RC2,RC4
• Blowfish
• SHA1,SHA224,SHA256,SHA384,SHA512
• MD2,MD4,MD5
• HMAC
• PBKDF

Preview

Instructions for use

• You can customize the functions you want to intercept printing by turning them on (they are all turned on by default).
• Print data limit (default maximum 240 bytes for a single piece of data, where there is no limit for key, hash and digest results)
• and stack information (off by default)
• Doesn't differentiate between OC or Swift, the api calls for encryption are the same for both languages

Simple to use

• Spawn mode

frida -U --codeshare Humenger/frida-ios-cipher -f "xxx.xxx.xxx" --no-pause

• Attach mode

frida -U --codeshare Humenger/frida-ios-cipher -n "app name"

Config

Configuration at the beginning of the script.

//config
const CIPHER_CONFIG={
    "enable":true,//global enable
    "highlighting": true,//syntax highlighting
    "crypto":{
        "enable":true,//crypto enable
        "maxDataLength":240,//Maximum length of single data printout
        "printStack":false,
        "aes":true,
        "des":true,
        "3des":true,
        "cast":true,
        "rc4":true,
        "rc2":true,
        "blowfish":true,
        "filter": []
    },
    "hash":{
        "enable":true,//hash enable
        "maxInputDataLength":240,
        "printStack":false,
        "md2":true,
        "md4":true,
        "md5":true,
        "sha1":true,
        "sha224":true,
        "sha256":true,
        "sha384":true,
        "sha512": true,
        "filter": []
    },
    "hmac":{
        "enable":true,//hmac enable
        "maxInputDataLength":240,
        "printStack":false,
        "sha1":true,
        "md5":true,
        "sha224":true,
        "sha256":true,
        "sha384":true,
        "sha512":true,
        "filter": []
    },
    "pbkdf":{
        "enable":true,
        "printStack":false,
        "filter": []
    }
}

Because printing the stack may lead to program execution exceptions, printStack is off by default, and you can turn it on by yourself if you need to.

Build

npm install 
npm run build

Replenishment

Of course there are a couple of functions that don't do interceptions, as shown below:

CCCryptorStatus
     CCCryptorCreateFromData(CCOperation op, CCAlgorithm alg,
         CCOptions options, const void *key, size_t keyLength, const void *iv,
         const void *data, size_t dataLength, CCCryptorRef *cryptorRef,
         size_t *dataUsed);

• This function also calls CCCryptorCreate internally, so it doesn't do interceptions
• Similarly CCCryptorCreateFromDataWithMode
• There are also a couple of CCDigest functions that are too cold to be added later if encountered
• There are also a couple of random functions as well as UUIDs, which seem to be strictly within the scope of cryptography, to which I'll add later on
• As for asymmetric encryption, I can't seem to find an official implementation at the moment

Consultation

• https://opensource.apple.com/source/CommonCrypto/CommonCrypto-36064/CommonCrypto/CommonCryptor.h
• https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/CC_MD5.3cc.html#//apple_ref/doc/man/3cc/CC_MD5
• https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/CC_SHA.3cc.html#//apple_ref/doc/man/3cc/CC_SHA
• https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/CCCryptor.3cc.html#//apple_ref/doc/man/3cc/CCCryptor
• https://opensource.apple.com/source/CommonCrypto/CommonCrypto-55010/CommonCrypto/CommonKeyDerivation.h.auto.html
• https://www.cnblogs.com/cocoajin/p/6150203.html
• https://frida.re/docs/javascript-api/
• https://codeshare.frida.re/@xperylab/cccrypt-dump/
• https://github.com/federicodotta/Brida
• https://github.com/sensepost/objection/blob/master/agent/src/ios/crypto.ts
• https://opensource.apple.com/source/CommonCrypto/CommonCrypto-60118.200.6/lib/CommonCryptor.c.auto.html
• https://opensource.apple.com/source/CommonCrypto/CommonCrypto-60026/CommonCrypto/CommonCryptor.h.auto.html
• https://www.jianshu.com/p/8896ed432dff
• https://opensource.apple.com/source/CommonCrypto/CommonCrypto-60118.200.6/lib/
• https://blog.csdn.net/q187543/article/details/103920969

Technical Support

Knowledge Planet

frida-ios-cipher's Issues

swift App error

Terminal operation ：frida -U --codeshare Humenger/frida-ios-cipher -n ""
Tips
CCCrypt func is null
CC_SHA1 func is null
CC_SHA224 func is null
CC_SHA256 func is null
CC_SHA384 func is null
CC_SHA512 func is null
CC_MD2 func is null
CC_MD4 func is null
CC_MD5 func is null
CCHmac func is null
CCKeyDerivationPBKDF func is null

The APP calls CCCrypt and CCHmac

Apps freezes with crypto enabled

I start any application

frida -l iosciper.js -f com.apple.Maps -U

with a script and if the “crypto” section of the config is enabled, the application hangs (apparently one of the encryption functions is triggered at that moment). There are no errors, the application closes after some time.

frida 16.3.3, iOS 15.3.1, iPhone SE2

print_arg error: TypeError: cannot read property 'toString' of undefined

Hello sir,

First I want to say thank you for frida-ios-cipher.

error message:
print_arg error: TypeError: cannot read property 'toString' of undefined
at t (frida/runtime/hexdump.js:20)
at M (agent/index.ts:240)
at onEnter (agent/index.ts:381)

Do you have discord or line? your gmail does not work.