Image from http://dyci.github.io/

iOS Dynamic Library Injection

- Kenneth Poon

•Technical Lead iOS Engineer @ PropertyGuru •Agile, Xtreme Programming, Tests •XCUITest+Gherkin (July 2016)

Agenda

• Short story of me engaging in PokemonGo

• Game plan for creating iOS Mod Apps

• Demo of Code Injection

Trying to beat the game

6 Aug 2016

- 9 am Discovered PokemonGo is live

- 12 pm Started Location Spoofing

A Week Later

- Built my own location spoof Mac App

- Integration Go Radar Api

- Requires Direct XCode-Device Wired Connection

Trying to beat the game

How to install this PokemonGo Mod?

http://pokemongohacks.me/

How to install this PokemonGo Mod?

Mod Ipa

Cydia Impactor

• Cydia Impactor is a tool that resigns and install apps onto devices

• Works with non-jailbroken devices

• Downloadable at http://www.cydiaimpactor.com/

Apple Dev Account

Non-JB

How to install this PokemonGo Mod?

DEMO

Hmmm Whats That?

Concepts - Code Injection

Investigative To Introduce Behaviour Change

• Code Injection Attacks Examples- SQL Injection / XML Injection- HTML Script / Command Injection

Concepts - Dynamic Library / Binary

• XCode compiles Apps statically • Highlights Compilation Errors for codes in project that

cannot be statically linked • During Build Phase, Xcode links project with external

binaries and perform necessary checks. • However at packaging phase, Xcode does not

guarantee all dependencies will be available during run time

dyld: Library not loaded: @rpath/libswift_stdlib_core.dylib

Concepts - Dynamic Library / Binary

Concepts - Dynamic Library / Binary• Static Library - a unit of code linked at compile time.

[Cant use this]

• Dynamic library - a unit of code and/or assets linked at runtime that may change [We can use this]

• Load Dylib command needs to be executed on the .ipa package before the final package/signing of the app

Non-JB

Game plan for creating iOS Mod Apps

Cydia Impactor

Apple Dev Account

Original Ipa

Custom Dylib

Patched Ipa

Patched Ipa+ Patching

You may need to download cracked from 3rd Party content providers like www.iphonecake.com

Dynamic Library Injection

DEMO

https://github.com/depoon/iOSDylibInjectionDemo