环境
- 硬件
- 越狱
- 工具
  - frida
  - cycript
  - chisel (lldb script)
  - MonkeyDev
  - passionfruit
  - objection
  - theos
  - HookZz
  - AppleTrace
  - dump
  - dump class
    - class-dump/class-dump-z/classdump-dyld
    - swift class dump
  - Hikari
  - Reveal
  - IDA
  - Hopper
  - Flex
  - 其他
书籍
资料
PWN
论坛

又是很久不逆向App了，近期有点需求需要看看其他App怎么实现的，想来复习一下。以及这两年也有若干常用工具发生了变化，产生了一些新的工具。这篇文章总结下基础的App逆向的方法、工具和一些书籍。以后有新的发现也会尽量更新到这篇文章。

环境

硬件

iOS系统的iPhone或iPad
macOS系统的MacBook等

越狱

手机是否可以越狱可通过这个网站来确定： https://canijailbreak.com/ 越狱用的软件也有链接可下载。

工具

frida

官网 https://www.frida.re/

Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts.

cycript

http://www.cycript.org/ 

Cycript allows developers to explore and modify running applications on either iOS or Mac OS X using a hybrid of Objective-C++ and JavaScript syntax through an interactive console that features syntax highlighting and tab completion.

chisel (lldb script)

https://github.com/facebook/chisel

Chisel is a collection of LLDB commands to assist debugging iOS apps.

最常用的就是pview和pvc两个命令了。所有支持的命令可以参考Wiki：https://github.com/facebook/chisel/wiki 。

MonkeyDev

https://github.com/AloneMonkey/MonkeyDev

原有iOSOpenDev的升级，非越狱插件开发集成神器！

可以使用Xcode开发CaptainHook Tweak、Logos Tweak 和 Command-line Tool，在越狱机器开发插件，这是原来iOSOpenDev功能的迁移和改进。

只需拖入一个砸壳应用，自动集成class-dump、restore-symbol、Reveal、Cycript和注入的动态库并重签名安装到非越狱机器。

支持调试自己编写的动态库和第三方App

支持通过CocoaPods第三方应用集成SDK以及非越狱插件，简单来说就是通过CocoaPods搭建了一个非越狱插件商店。

新生力量，诞生于2017年。已经是分析闭源应用的必备工具。

passionfruit

https://github.com/chaitin/passionfruit

基于frida开发，逆向必备，可以很容易看到第三方应用的各类信息。

Cross plarform web GUI!
Also supports non-jailbroken device (see Non-jailbroken device).
List all url schemes.
Check signature entitlements.
List human readable app meta info (Info.plist).
Capture screenshot.
Checksec: see if target app is encrypted, and has enabled PIE, ARC and stack canary.
App sandbox file browser. Directly preview images, SQLite databases and plist files on device. You can always download the file for further investigation.
等等

objection

https://github.com/sensepost/objection

基于frida的工具集。

objection is a runtime mobile exploration toolkit, powered by Frida. It was built with the aim of helping assess mobile applications and their security posture without the need for a jailbroken or rooted mobile device.