Introduction to Hacking iOS Apps (Part 5)
This is part 5 of a multi-part series:
What is Frida?
Frida is a dynamic code instrumentation and injection toolkit. We can use it to monitor what’s going on while an app is running, intercept function calls and perform arbitrary operations.
There’s a complete set of installation instructions on the Frida website, but here’s the tl;dr:
- open Cydia on the jailbroken device
- select the Sources tab
- Edit, then Add a new source:
- Now you should be able to search for
Fridaand install it
Finally, on your Mac, install the Frida client:
pip install --user frida
Testing the installation
Connect the device to your Mac over USB, then as Frida for a list of running applications on the device:
1 2 3 4 5
Instrumenting function calls in a 3rd-party app
- start the Amazon app on the device
- it looks like the “Sign In” feature happens in a modal ViewController - so we’ll try looking for
frida-trace -U -f com.amazon.AmazonUK -m "-[* viewWillAppear*]"
… which gives this output when we tap the Sign In button:
1 2 3 4 5
AIWebViewController. Are they using an embedded
UIWebView? Let’s check:
frida-trace -U -f com.amazon.AmazonUK -m "-[UIWebView *]"
Whoa, loads of output there too. But a
UIWebView which performs a login is useless without a delegate to pass information back to. We should find it.
frida-trace -U -f com.amazon.AmazonUK -m "-[UIWebView setDelegate:]"
… which shows this when we tap Sign In:
1 2 3 4 5
So we have a delegate being set, but no idea what kind of object that is. It probably doesn’t matter, because we can easily hook into the callback functions in the
UIWebViewDelegate protocol. We’ll try hooking into
frida-trace -U -f com.amazon.AmazonUK -m "-[* *shouldStartLoadWith*]"
And sure enough, this is logged every time the Sign In webpage loads content:
The second parameter to that call is an
__handlers__/__AIWebViewController_webView_sh_-4df00585.js. (Yours may be named slightly differently)
If we edit this file, we can see how that previous piece of logging was performed: there are two hooks, for when the function starts (
onEnter) and finishes (