ios-application-hooking-frida

iOS Application Hooking (Frida)

When to Use

• When static analysis strings/binaries (via Hopper/Ghidra) are heavily obfuscated and you must observe exactly what the application is doing in memory dynamically.
• To bypass robust Jailbreak Detection mechanisms that force the target app to crash upon launch.
• To circumvent complex SSL Certificate Pinning, enabling you to intercept HTTPS traffic in Burp Suite without spending hours reverse-engineering native cryptographic functions.

Prerequisites

• Authorized scope and rules of engagement for the target environment
• Appropriate tools installed on the attack/analysis platform
• Understanding of the target technology stack and architecture
• Documentation template ready for findings and evidence capture

Workflow

Phase 1: Environment Setup (Jailbroken iOS)

# Concept: Frida operates via a client-server architecture. The Frida "Server" must be running 
# as root on the target device, listening for commands from the attacker's "Client" (your PC).

# 1. On the Jailbroken iOS Device:
# Open Cydia/Sileo -> Add Source: `https://build.frida.re` -> Install "Frida!"

# 2. On the Attacker PC:
pip3 install frida-tools objection

# 3. Verify Connectivity via USB:
frida-ps -U
# Output: Lists all processes currently executing on the iPhone. Look for the target application (e.g., `TargetBankApp`).

Phase 2: Injecting Custom JavaScript Hooks (The Core Mechanics)

// Concept: We write JavaScript on our PC. Frida injects the Google V8 Engine into the 
// iPhone's target application process, allowing our JS to seamlessly interact directly 
// with the underlying Objective-C / Swift architecture.

// Scenario: The app calls `-(BOOL)isJailbroken;` which returns TRUE, crashing the app.
// We intercept that call right before it finishes and permanently overwrite the return value back to FALSE.

if (ObjC.available) {
    // 1. Find the Class in the application memory
    var JailbreakDetectionClass = ObjC.classes.JailbreakDetector;
    
    // 2. Attach an Interceptor (Hook) to the specific method
    Interceptor.attach(JailbreakDetectionClass['- isJailbroken'].implementation, {
        
        onEnter: function(args) {
            console.log("[+] Intercepted isJailbroken execution!");
        },
        
        onLeave: function(retval) {
            console.log("[-] Original Return Value: " + retval);
            // 3. The Override: Change the boolean `TRUE` (1) to `FALSE` (0)
            var newRetval = ptr("0x0"); 
            retval.replace(newRetval);
            console.log("[+] Spofed Return Value: " + newRetval);
        }
    });
}