Update IPA Installation Techniques and Tools (by @NVISOSecurity) #3100

TheDauntless · 2024-12-26T13:02:01Z

A cleanup of all the iOS signing / installing / running in debug mode.

I tried to be pragmatic, focussing on different techniques that work (I tested all of them, it was not a fun day) and also focussing on modern solutions rather than keep holding on to outdated ones.

This fixes #3090

sushi2k

Great content @TheDauntless! Also the warnings/tips for AppSync and libimobiledevice are spot on! I've reviewed the tools, planning to do the rest today or tomorrow.

tools/ios/MASTG-TOOL-0055.md

tools/ios/MASTG-TOOL-0118.md

sushi2k · 2024-12-30T09:23:04Z

tools/ios/MASTG-TOOL-0118.md

@@ -8,3 +8,6 @@ source: https://sideloadly.io/
 ---

 [Sideloadly](https://sideloadly.io/ "Sideloadly") allows you to obtain a valid signature for a given IPA file and then install it to a connected iOS device. In addition to signing and installing an IPA file, Sideloadly also allows you to inject tweaks, change the App or Bundle name or make other limited modifications to the IPA metadata. Sideloadly is available on both macOS and Windows.
+
+!!! warning "Do not use your personal Apple account"
+    To sign an IPA file, you will need a valid iOS developer account, either free or paid. Both types come with certain restrictions, as explained on the Sideloadly website. We recommend creating a dedicated developer account for signing test applications, and **not** using your personal Apple account.


What would be the restrictions when using a paid developer account?

Not sure I understand this comment.

You are writing:

To sign an IPA file, you will need a valid iOS developer account, either free or paid. Both types come with certain restrictions, as explained on the Sideloadly website.

I don't understand what the restrictions would be for a paid developer account. I also couldn't find anything on the sideloadly website.
A free account has a of course restrictions (7 days valid etc.)

Oh, right. I've linked to the technique now which explains it. The paid account still has restrictions (365 days), so I think the text still makes sense.

Ok. But shall we remove this sentence?

"Both types come with certain restrictions, as explained on the Sideloadly website."

If this is explained on the sideloadly website, let's link to it. But I couldn't find it.

tools/ios/MASTG-TOOL-0055.md

tools/ios/MASTG-TOOL-0126.md

tools/ios/MASTG-TOOL-0127.md

Co-authored-by: Sven <[email protected]>

TheDauntless · 2024-12-30T11:02:57Z

Thanks for the review so far!

sushi2k

@TheDauntless reviewed more techniques, but not done yet. Thanks for the nice summary!

techniques/ios/MASTG-TECH-0055.md

tools/ios/MASTG-TOOL-0055.md

sushi2k · 2024-12-30T13:10:49Z

tools/ios/MASTG-TOOL-0118.md

@@ -8,3 +8,6 @@ source: https://sideloadly.io/
 ---

 [Sideloadly](https://sideloadly.io/ "Sideloadly") allows you to obtain a valid signature for a given IPA file and then install it to a connected iOS device. In addition to signing and installing an IPA file, Sideloadly also allows you to inject tweaks, change the App or Bundle name or make other limited modifications to the IPA metadata. Sideloadly is available on both macOS and Windows.
+
+!!! warning "Do not use your personal Apple account"
+    To sign an IPA file, you will need a valid iOS developer account, either free or paid. Both types come with certain restrictions, as explained on the Sideloadly website. We recommend creating a dedicated developer account for signing test applications, and **not** using your personal Apple account.


You are writing:

To sign an IPA file, you will need a valid iOS developer account, either free or paid. Both types come with certain restrictions, as explained on the Sideloadly website.

I don't understand what the restrictions would be for a paid developer account. I also couldn't find anything on the sideloadly website.
A free account has a of course restrictions (7 days valid etc.)

techniques/ios/MASTG-TECH-0055.md

sushi2k · 2025-01-04T06:55:41Z

techniques/ios/MASTG-TECH-0055.md

+com.google.Maps, "24.50.0", "Google Maps"
+
+# Run in debug mode
+$ idevicedebug -d run sg.vp.UnCrackable1.QH868V5764


Unfortunately this always failed for my iOS 15.8.3 device (jailbroken). I couldn't find a DeveloperDiskImage for 15.8.3, but one for 15.7 but couldn't mount it. Were you testing this on macOS? I am using macOS sequoia 15.1.1 and Xcode 16.2

07:42:10 lockdown.c:278 lockdownd_stop_session(): success 07:42:10 idevice.c:1193 idevice_connection_disable_bypass_ssl(): Skipping bidirectional SSL shutdown. SSL error code: 5 07:42:10 idevice.c:1208 idevice_connection_disable_bypass_ssl(): SSL mode disabled 07:42:10 service.c:98 service_client_factory_start_service(): Could not start service com.apple.debugserver! Could not start com.apple.debugserver! Please make sure to mount the developer disk image first: 1) Get the iOS version from `ideviceinfo -k ProductVersion`. 2) Find the matching iPhoneOS DeveloperDiskImage.dmg files. 3) Run `ideviceimagemounter` with the above path.

It works on my machine / device:

macOS 15.2 (24C101)

XCode 16.2 (16C5032a)

iOS 15.8.3 (non-jb)

idevicedebug 1.3.0-260-gc8cdf20

In installed via Sideloadly

idevicedebug -d run sg.vp.UnCrackable12 working_directory: /private/var/mobile/Containers/Data/Application/9C89C011-33D7-421B-9934-B92488F49486 Setting logging bitmask... Setting maximum packet size... Setting working directory... Setting argv... app_argv[0] = /private/var/containers/Bundle/Application/F7FDC3A7-2055-46B8-A88B-2764BF84ACD2/UnCrackable Level 1.app/UnCrackable Level 1 Checking if launch succeeded... Setting thread... Continue running process...

Co-authored-by: Sven <[email protected]>

sushi2k

Done!
Few small changes. But this is really a great update on how to do re-signing and run apps with Frida on iOS!

techniques/ios/MASTG-TECH-0056.md

sushi2k · 2025-01-05T15:19:50Z

techniques/ios/MASTG-TECH-0056.md

@@ -56,18 +43,35 @@ On macOS you can also use the @MASTG-TOOL-0054 tool to install iOS apps from the

 ```bash
 unzip Name.ipa
-ios-deploy --bundle 'Payload/Name.app' -W -d -v
+ios-deploy --bundle 'Payload/UnCrackable Level 1.app' -W -v


Suggested change

ios-deploy --bundle 'Payload/UnCrackable Level 1.app' -W -v

$ ios-deploy --bundle 'Payload/UnCrackable Level 1.app' -W -v

techniques/ios/MASTG-TECH-0056.md

techniques/ios/MASTG-TECH-0090.md

techniques/ios/MASTG-TECH-0092.md

sushi2k · 2025-01-11T13:18:07Z

tools/ios/MASTG-TOOL-0118.md

@@ -8,3 +8,6 @@ source: https://sideloadly.io/
 ---

 [Sideloadly](https://sideloadly.io/ "Sideloadly") allows you to obtain a valid signature for a given IPA file and then install it to a connected iOS device. In addition to signing and installing an IPA file, Sideloadly also allows you to inject tweaks, change the App or Bundle name or make other limited modifications to the IPA metadata. Sideloadly is available on both macOS and Windows.
+
+!!! warning "Do not use your personal Apple account"
+    To sign an IPA file, you will need a valid iOS developer account, either free or paid. Both types come with certain restrictions, as explained on the Sideloadly website. We recommend creating a dedicated developer account for signing test applications, and **not** using your personal Apple account.


Ok. But shall we remove this sentence?

"Both types come with certain restrictions, as explained on the Sideloadly website."

If this is explained on the sideloadly website, let's link to it. But I couldn't find it.

Co-authored-by: Sven <[email protected]>

tools/ios/MASTG-TOOL-0118.md

Co-authored-by: Sven <[email protected]>

TheDauntless · 2025-01-20T07:17:46Z

techniques/ios/MASTG-TECH-0090.md


 As an alternative to this automated approach, see @MASTG-TECH-0091.

-## @MASTG-TOOL-0118
+You can inject Frida into an application using @MASTG-TOOL-0039, @MASTG-TOOL-0118 or @MASTG-TOOL-0038


I've removed tool 39 and the link to the frida website. This technique is explaining how to do it on a non-jailbroken, so would be weird to link to the frida docs this way.

techniques/ios/MASTG-TECH-0090.md

Co-authored-by: Sven <[email protected]>

serek8 · 2025-01-20T13:40:05Z

techniques/ios/MASTG-TECH-0055.md

+> Note that the commands that are part of @MASTG-TOOL-0126 refer to the latest version available from Github. If you installed them via brew or other package managers, you may have an older version with different command line flags.
+
+## iOS17 and newer
+


@TheDauntless I see that iOS 17 requires you to attach a debugger first to use the Gadget properly, right? Maybe we could add a sentence or two at the beginning of this paragraph to give this background. Then maybe we could have a subsection about LLDB and then another one about attaching to a process with Frida gadget?

I see that iOS 17 requires you to attach a debugger first to use the Gadget properly, right?

Not entirely. If the app is running in debug mode, Frida can automatically inject into it and the app doesn't need to have the gadget included. However, if you did include the gadget yourself (e.g. Objection / Sideloadly), then the frida gadget library is loaded at startup, and then you do need to connect with lldb followed by Frida.

In this technique we include the gadget ourselves, so the LLDB will always be required, right? Would be nice to write a short context e.g.

Suggested change

On iOS 17, you need to launch an app with a debugger if you have repackaged it with a Frida gadget. The following steps show how to launch an app with a debugger

### Launching an app with LLDB debugger

I didn't test it myself but it looks like iOS17 and newer works for all iOS versions, no? In this case, maybe it's easier to skip the iOS16 and older? Or at least make it clear that iOS17 and newer is universal?

techniques/ios/MASTG-TECH-0090.md

cpholguera · 2025-01-20T16:21:07Z

tools/ios/MASTG-TOOL-0127.md

+
+!!! warning
+
+    You can normally install AppSync Unified from the `https://cydia.akemi.ai/` repository by adding it to the package manager on your iOS device. However, as this repository is not always available, we recommend building it from source and installing the created .deb file using `dpkg -i` on your device.


Why not use the .deb from the Releases page? e.g.

https://github.com/akemin-dayo/AppSync/releases/tag/116.0

And then Airdrop or scp it and use dpkg -i

cpholguera · 2025-01-21T13:31:11Z

techniques/ios/MASTG-TECH-0056.md


-Different methods exist for installing an IPA package onto an iOS device, which are described in detail below.
+On a jailbroken device, you can circumvent this requirement using @MASTG-TOOL-0127, allowing you to install IPA files without obtaining a valid signature.


Suggested change

On a jailbroken device, you can circumvent this requirement using @MASTG-TOOL-0127, allowing you to install IPA files without obtaining a valid signature.

**Disabling Signature Verification (optional)**: On a jailbroken device, you can bypass the signature verification requirement using @MASTG-TOOL-0127, which hooks the appropriate system daemon and disables signature verification for any installations you do with the tools below while it's enabled.

cpholguera · 2025-01-21T13:33:58Z

tools/ios/MASTG-TOOL-0127.md

+source: https://github.com/akemin-dayo/AppSync
+---
+
+AppSync Unified disables various IPA signature verifications on jailbroken iOS devices, allowing you to install IPA files with missing or incorrect signatures. AppSync Unified does not require any configuration after installation.


Please clarify that it does not offer any cli tool or way to install apps. It's enabled after installation and you need additional tools to install the IPAs.

cpholguera · 2025-01-21T13:40:00Z

techniques/ios/MASTG-TECH-0056.md


-> Please note that iTunes is no longer available in macOS Catalina. If you are using an older version of macOS, iTunes is still available but since iTunes 12.7 it is not possible to install apps.
+Different methods exist for installing an IPA package onto an iOS device, which are described in detail below.



Could you please add ## Filza and the tool page for it?

Jeroen Beckers added 7 commits December 26, 2024 06:50

Add libimobiledevice / update iproxy

f3da3a7

Streamline TECH-0079 provisioning profile

566208d

Update TECH-0092 for IPA signing

d39142b

Update TECH-0079 to add cert limitation

522c1af

Add Appsync unified tool

f6f8dca

Installing and injecting IPA files

679e62e

Fix ios debugging apps

e9ff817

github-actions bot added iOS fundamentals labels Dec 26, 2024

Jeroen Beckers added 3 commits December 26, 2024 13:04

Fix linting and small update

d95283f

Fix lint and reference

462784d

Spellcheck

6ec2102

sushi2k mentioned this pull request Dec 30, 2024

Add libimobiledevice / update iproxy (@NVISOSecurity) #3099

Closed

sushi2k requested changes Dec 30, 2024

View reviewed changes

TheDauntless and others added 4 commits December 30, 2024 11:59

Update tools/ios/MASTG-TOOL-0055.md

52dd898

Co-authored-by: Sven <[email protected]>

Update tools/ios/MASTG-TOOL-0055.md

e228714

Co-authored-by: Sven <[email protected]>

Update tools/ios/MASTG-TOOL-0126.md

ef4fabf

Co-authored-by: Sven <[email protected]>

Update tools/ios/MASTG-TOOL-0055.md

d28f7ae

Co-authored-by: Sven <[email protected]>

sushi2k reviewed Jan 4, 2025

View reviewed changes

TheDauntless and others added 9 commits January 4, 2025 22:10

Update techniques/ios/MASTG-TECH-0055.md

2ce8cbd

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0055.md

a2611b6

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0055.md

90f5347

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0055.md

1d36e50

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0055.md

5f77407

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0055.md

7f02dd7

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0055.md

cc66983

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0055.md

8f8cc97

Co-authored-by: Sven <[email protected]>

Apply suggestions from code review

317b37e

Co-authored-by: Sven <[email protected]>

sushi2k requested changes Jan 11, 2025

View reviewed changes

cpholguera requested review from serek8 and cpholguera January 14, 2025 14:43

Update techniques/ios/MASTG-TECH-0055.md

697bc76

Co-authored-by: Sven <[email protected]>

TheDauntless commented Jan 20, 2025

View reviewed changes

tools/ios/MASTG-TOOL-0118.md Outdated Show resolved Hide resolved

TheDauntless and others added 11 commits January 20, 2025 08:09

Update tools/ios/MASTG-TOOL-0118.md

6710970

Update techniques/ios/MASTG-TECH-0056.md

3d5bc8b

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0056.md

1441ca0

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0056.md

c9f9d73

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0090.md

ff73a79

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0090.md

4781846

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0092.md

bebc38e

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0056.md

58aab16

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0079.md

27b0adb

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0090.md

2929ad3

Co-authored-by: Sven <[email protected]>

Update techniques/ios/MASTG-TECH-0090.md

db19d8e

Co-authored-by: Sven <[email protected]>

TheDauntless commented Jan 20, 2025

View reviewed changes

TheDauntless and others added 2 commits January 20, 2025 08:19

Update techniques/ios/MASTG-TECH-0090.md

85d3825

Update techniques/ios/MASTG-TECH-0056.md

3953ec9

Co-authored-by: Sven <[email protected]>

serek8 suggested changes Jan 20, 2025

View reviewed changes

Jeroen Beckers added 3 commits January 20, 2025 15:22

Remove unnecessary app

182ab62

Fix technique ref

430b2c2

Fix lint issue

c062048

cpholguera reviewed Jan 20, 2025

View reviewed changes

cpholguera reviewed Jan 21, 2025

View reviewed changes

cpholguera changed the title ~~Ipa installation by @NVISOSecurity~~ Update IPA Installation Techniques and Tools (by @NVISOSecurity) Jan 21, 2025

cpholguera reviewed Jan 21, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update IPA Installation Techniques and Tools (by @NVISOSecurity) #3100

Update IPA Installation Techniques and Tools (by @NVISOSecurity) #3100

TheDauntless commented Dec 26, 2024 •

edited

Loading

sushi2k left a comment

sushi2k Dec 30, 2024

TheDauntless Dec 30, 2024

sushi2k Dec 30, 2024

TheDauntless Jan 4, 2025

sushi2k Jan 11, 2025

TheDauntless commented Dec 30, 2024

sushi2k left a comment

sushi2k Dec 30, 2024

sushi2k Jan 4, 2025

TheDauntless Jan 4, 2025

sushi2k left a comment

sushi2k Jan 5, 2025

sushi2k Jan 11, 2025

TheDauntless Jan 20, 2025

serek8 Jan 20, 2025

TheDauntless Jan 20, 2025

serek8 Jan 20, 2025

cpholguera Jan 20, 2025 •

edited

Loading

cpholguera Jan 21, 2025

cpholguera Jan 21, 2025

cpholguera Jan 21, 2025

	ios-deploy --bundle 'Payload/UnCrackable Level 1.app' -W -v
	$ ios-deploy --bundle 'Payload/UnCrackable Level 1.app' -W -v

		> Note that the commands that are part of @MASTG-TOOL-0126 refer to the latest version available from Github. If you installed them via brew or other package managers, you may have an older version with different command line flags.

		## iOS17 and newer


	On iOS 17, you need to launch an app with a debugger if you have repackaged it with a Frida gadget. The following steps show how to launch an app with a debugger

	### Launching an app with LLDB debugger


		!!! warning

		You can normally install AppSync Unified from the `https://cydia.akemi.ai/` repository by adding it to the package manager on your iOS device. However, as this repository is not always available, we recommend building it from source and installing the created .deb file using `dpkg -i` on your device.


		Different methods exist for installing an IPA package onto an iOS device, which are described in detail below.
		On a jailbroken device, you can circumvent this requirement using @MASTG-TOOL-0127, allowing you to install IPA files without obtaining a valid signature.

	On a jailbroken device, you can circumvent this requirement using @MASTG-TOOL-0127, allowing you to install IPA files without obtaining a valid signature.
	Disabling Signature Verification (optional): On a jailbroken device, you can bypass the signature verification requirement using @MASTG-TOOL-0127, which hooks the appropriate system daemon and disables signature verification for any installations you do with the tools below while it's enabled.


		> Please note that iTunes is no longer available in macOS Catalina. If you are using an older version of macOS, iTunes is still available but since iTunes 12.7 it is not possible to install apps.
		Different methods exist for installing an IPA package onto an iOS device, which are described in detail below.

Update IPA Installation Techniques and Tools (by @NVISOSecurity) #3100

Are you sure you want to change the base?

Update IPA Installation Techniques and Tools (by @NVISOSecurity) #3100

Conversation

TheDauntless commented Dec 26, 2024 • edited Loading

sushi2k left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TheDauntless commented Dec 30, 2024

sushi2k left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sushi2k left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cpholguera Jan 20, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TheDauntless commented Dec 26, 2024 •

edited

Loading

cpholguera Jan 20, 2025 •

edited

Loading