Vault7: CIA Hacking Tools Revealed

Navigation: » Latest version

iOS Triage Process

This describes the process need to been done when a new iOS version is updated.

List of tools new needed

Xcode Developer Disk Image (DMG)
1. Install Xcode
2. find DMG in xcode directory
3. put with other DMG ( redux/res/dmg )

Saline

get saline_manifest
compile saline
get testdylib_manifest
compile test testdylib
run saline
1. ../Dist/Release-MacOSX/saline ../test_dylib/Build/Release-iPhoneOS/testdylib/testmain

Adderall

Get adderall_manifest
in nightversion/python/nv_kern_read_command.py
1. update kern start
2. in get_ios_type, verify correct version number is in there
update early.mk add new prefix to new to list
1. early-bokken
2. early-close
3. early-persist
4. early-remote
update saline and rana
1. update match function in rana/ranas/<proper>_rana.py\
adderall.py
Hopefully have execution

Symdra / Elsym

python symdra/ -h
python symdra/ full -k /tmp/> -a <results folder> -g <ghidra_dir> -b <min_build_version>
1. /tmp should have IPSW from adderall
2. a copy should be up on the share
3. ghidra must be at least 6
4. build version is your target
When done symbol.db in the analysis directory
This will be feed into Elsym
sqlite3 <output folder>/<IPSW>/symbol.db
1. select * from [ Master_symbol ];
2. .exit
cd ../elsym
1. git status
2. git branch feature/ios-<version>
3. git checkout feature/ios-<version>
4. el.py
  1. make sure build number is in the list
  2. might need to change "EL_CONFIG_LWVM_PARITION_FLAG_OFFSET"
5. run and see what happens
6. ZOO_IPSW_PATH=<results folder> make copyonedist ZOO_TARGET=<target>
  1. _kernel_memory_allocate is only used for the development
7. ls ../elsym-dist/<IPSW>.plist
8. python verify ../elsym-dist/
  1. no back files found ( doesn't mean that all files are good, just didn't find it)
9. print_config.py ../elsym-dist/<IPSW>.plist

Nightvision

can be done under the adderral or the ios manifest
cd adderral
cd nightvision
make
../Dist/Release-iPhoneOs/nv -c ../early/elsym-dist/ get -o <outdir>/
find /private/var/root in file list to verify privilege escalation worked

El_util

cd early_manifest
make ZOO_IPSW="<target>"
el_runo.sh don't use even if it is in the directoru
cd ../rana
make
python ../Build/Release-MacOS/rana.pyz -a execute Build/Relase-iPhoneOS/elutil/<IPSW>/el_priv
1. should be "uid = 0, euid = 0"

El_unit

cd elunit
ZOO_ISPW_PATH=~/tmp/ make
1. need a device on the developer profile
should only have 1 failed test

El_ssh

Remote

Persistence

You may also want to use visual panels to communicate related information, tips or things users need to be aware of.

Related articles appear here based on the labels you select. Click to edit the macro and add or change labels.

('contentbylabel' missing)

('details' missing)

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks