How to save you app from hacking? We will discuss a protection mechanisms and ways to hack them. Основные тезисы: - Основы LLDB; - Способы защиты от нежелательного дебага вашего приложения; - Оценка эффективности этих способов; - Способы обхода приведенных методик; - Обфускация кода и другие полезные практики защиты; - Небольшое демо по взлому:)

1. {
Author: Maksym Sysenko
Company: Techery
}
You shall not pass : anti-debug
methodics
“Exhaustive prevention is an illusion. We
can't secure misconfiguration, shadow IT,
third parties, human error, former
employee... Focus on what matters more and
be ready to react.”
― Stephane Nappo

3. Two definitive articles about how to debug binary on iOS device

4. LLDB (Low Level Debugger)

5. long ptrace(
enum __ptrace_request request,
pid_t pid,
void *addr,
void *data
);

6. typedef int (* ptrace_ptr_t)(int _request, pid_t _pid, caddr_t _addr, int _data);
#if !defined(PT_DENY_ATTACH)
#define PT_DENY_ATTACH 31
#endif // !defined(PT_DENY_ATTACH)
void simple_guard() {
void * handle = dlopen(0, RTLD_GLOBAL | RTLD_NOW);
ptrace_ptr_t ptrace_ptr = dlsym(handle, "ptrace");
ptrace_ptr(PT_DENY_ATTACH, 0, 0, 0);
dlclose(handle);
}
int main(int argc, char **argv) {
printf("YOU SHALL NOT PASS!n");
simple_guard();
printf("Passed!n");
return 0;
}

7. Max:Release newowner$ lldb ./Heimdall
(lldb) target create "./Heimdall"
Current executable set to './Heimdall' (x86_64).
(lldb) process launch
Process 5139 launched: './Heimdall' (x86_64)
YOU SHALL NOT PASS!
Process 5139 exited with status = 45 (0x0000002d)

8. /System/Library/Frameworks/Kernel.framework/Versions/A/Headers/sys/errno.h
...
#define ENOTSUP 45 /* Operation not supported *
...

11. br set --name ptrace
Breakpoint 1: where = libsystem_kernel.dylib`__ptrace, address = ….

12. (lldb) register read
General Purpose Registers:
rax = 0x00007fff78df7e7c libsystem_kernel.dylib`__ptrace
rbx = 0xfffffffffffffffe
rcx = 0x0000000000000000
rdx = 0x0000000000000000
rdi = 0x000000000000001f
rsi = 0x0000000000000000
rbp = 0x00007ffeefbff5b0
rsp = 0x00007ffeefbff598
r8 = 0x00007fffb19a1da0 sGlobalMutex + 32
r9 = 0x0000000000000040
r10 = 0x00007fffb19a1d98 sGlobalMutex + 24
r11 = 0xffffffffffffffff
r12 = 0x0000000000000000
r13 = 0x0000000000000000
r14 = 0x0000000000000000
r15 = 0x0000000000000000
rip = 0x00007fff78df7e7c libsystem_kernel.dylib`__ptrace
rflags = 0x0000000000000246
cs = 0x000000000000002b
fs = 0x0000000000000000
gs = 0x0000000000000000

13. (lldb) register write rdi 1
(lldb) register read
General Purpose Registers:
rax = 0x00007fff78df7e7c libsystem_kernel.dylib`__ptrace
rbx = 0xfffffffffffffffe
rcx = 0x0000000000000000
rdx = 0x0000000000000000
rdi = 0x0000000000000001
rsi = 0x0000000000000000
rbp = 0x00007ffeefbff5b0
rsp = 0x00007ffeefbff598
r8 = 0x00007fffb19a1da0 sGlobalMutex + 32
r9 = 0x0000000000000040
r10 = 0x00007fffb19a1d98 sGlobalMutex + 24
r11 = 0xffffffffffffffff
r12 = 0x0000000000000000
r13 = 0x0000000000000000
r14 = 0x0000000000000000
r15 = 0x0000000000000000
rip = 0x00007fff78df7e7c libsystem_kernel.dylib`__ptrace
rflags = 0x0000000000000246
cs = 0x000000000000002b
fs = 0x0000000000000000
gs = 0x0000000000000000

14. Max:Release newowner$ lldb ./Heimdall
(lldb) target create "./Heimdall"
Current executable set to './Heimdall' (x86_64).
(lldb) br set --name ptrace
Breakpoint 1: where = libsystem_kernel.dylib`__ptrace, address = 0x000000000001be7c
(lldb) process launch
Process 5124 launched: './Heimdall' (x86_64)
YOU SHALL NOT PASS!
Process 5124 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
frame #0: 0x00007fff78df7e7c libsystem_kernel.dylib`__ptrace
libsystem_kernel.dylib`__ptrace:
-> 0x7fff78df7e7c <+0>: xorq %rax, %rax
0x7fff78df7e7f <+3>: leaq 0x38bc5482(%rip), %r11 ; errno
0x7fff78df7e86 <+10>: movl %eax, (%r11)
0x7fff78df7e89 <+13>: movl $0x200001a, %eax ; imm = 0x200001A
Target 0: (Heimdall) stopped.
(lldb) register write rdi 1
(lldb) continue
Process 5124 resuming
Passed!
Process 5124 exited with status = 0 (0x00000000)

15. static bool AmIBeingDebugged(void) {
int junk;
int mib[4];
struct kinfo_proc info;
size_t size;
info.kp_proc.p_flag = 0;
mib[0] = CTL_KERN;
mib[1] = KERN_PROC;
mib[2] = KERN_PROC_PID;
mib[3] = getpid();
size = sizeof(info);
junk = sysctl(mib, sizeof(mib) / sizeof(*mib), &info, &size, NULL, 0);
assert(junk == 0);
return ( (info.kp_proc.p_flag & P_TRACED) != 0 );
}

16. int main(int argc, const char * argv[]) {
printf("YOU SHALL NOT PASS!n");
if (AmIBeingDebugged()) {
return 13;
}
printf("Passed!n");
return 0;
}

17. Max:Release newowner$ lldb ./Heimdall
(lldb) target create "./Heimdall"
Current executable set to './Heimdall' (x86_64).
(lldb) process launch
Process 24625 launched: './Heimdall' (x86_64)
YOU SHALL NOT PASS!
Process 24625 exited with status = 13 (0x0000004c)

18. br set --name sysctl --condition 'typedef struct { int values[4]; } i4;
(*(i4 *)$rdi).values[1] == 14 &&
(*(i4 *)$rdi).values[2] == 1 &&
$rbx==0’
expr typedef struct { int values[4]; } i4; (*(i4 *)$rdi).values[3]=123456

19. Max:Release newowner$ lldb ./Heimdall
(lldb) target create "./Heimdall"
Current executable set to './Heimdall' (x86_64).
(lldb) br set --name sysctl --condition 'typedef struct {int values[4];}i4;
(*(i4 *)$rdi).values[1] == 14 && (*(i4 *)$rdi).values[2] == 1 && $rbx==0'
Breakpoint 1: where = libsystem_c.dylib`sysctl, address = 0x0000000002e2bc
(lldb) process launch
Process 24598 launched: './Heimdall' (x86_64)
YOU SHALL NOT PASS!
Process 24598 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
frame #0: 0x00007fff78d252bc libsystem_c.dylib`sysctl
libsystem_c.dylib`sysctl:
-> 0x7fff78d252bc <+0>: pushq %rbp
0x7fff78d252bd <+1>: movq %rsp, %rbp
0x7fff78d252c0 <+4>: movl (%rdi), %eax
0x7fff78d252c2 <+6>: cmpl $0x8, %eax
Target 0: (Heimdall) stopped.
(lldb) expr typedef struct { int values[4]; } i4; *(i4 *)$rdi
(i4) $0 = {
values = ([0] = 1, [1] = 14, [2] = 1, [3] = 24598)
}
(lldb) expr typedef struct {int values[4];}i4;
(*(i4 *)$rdi).values[3]=123456
(int) $1 = 123456
(lldb) continue
Process 24598 resuming
Passed!
Process 24598 exited with status = 0 (0x00000000)

20. bool ios_execp_info_check() {
struct ios_execp_info {
exception_mask_t masks[EXC_TYPES_COUNT];
mach_port_t ports[EXC_TYPES_COUNT];
exception_behavior_t behaviors[EXC_TYPES_COUNT];
thread_state_flavor_t flavors[EXC_TYPES_COUNT];
mach_msg_type_number_t count;
};
struct ios_execp_info *info = malloc(sizeof(struct ios_execp_info));
kern_return_t kr = task_get_exception_ports(
mach_task_self(), EXC_MASK_ALL,
info->masks, &info->count, info->ports,
info->behaviors, info->flavors
);
for (int i = 0; i < info->count; i++){
return (info->ports[i]!=0 || info->flavors[i]==THREAD_STATE_NONE);
}
return false;
}

21. #ifdef __arm64__
asm(
"mov x0, #26n"
"mov x1, #31n"
"mov x2, #0n"
"mov x3, #0n"
"mov x16, #0n"
"svc #128n"
);
#endif

22. Useful links:

24. Signups are welcome ;)

25. Presentation finished with exit code 0
Thanks ;)