[iOS] otool 사용법

otool 설치

Cydia에서 Darwin CC Tools 설치 시, 사용 가능

명령어 정리

- otool -tV Multi -p main : main함수 디스어셈블
- otool -L Multi : 바이너리의 동적 의존성
- nm -arch arm Multi : 심볼의 유형을 알 수 있음
- strings Multi | grep -i http : http 문자열 검색
- otool -l Multi | grep __objc : object-c 라이브러리 사용

chaem-20171201ui-iPhone:~ root# otool -l Multi | grep __objc
  sectname __objc_methname
  sectname __objc_classname
  sectname __objc_methtype
  sectname __objc_classlist
  sectname __objc_nlclslist
  sectname __objc_catlist
  sectname __objc_protolist
  sectname __objc_imageinfo
  sectname __objc_const
  sectname __objc_selrefs
  sectname __objc_protorefs
  sectname __objc_classrefs
  sectname __objc_superrefs
  sectname __objc_ivar
  sectname __objc_data
  sectname __objc_methname
  sectname __objc_classname
  sectname __objc_methtype
  sectname __objc_classlist
  sectname __objc_nlclslist
  sectname __objc_catlist
  sectname __objc_protolist
  sectname __objc_imageinfo
  sectname __objc_const
  sectname __objc_selrefs
  sectname __objc_protorefs
  sectname __objc_classrefs
  sectname __objc_superrefs
  sectname __objc_ivar
  sectname __objc_data

- PIE(ASLR)적용 확인 : otool -vh binary

flag에 PIE가 있으면 ASLR이 적용된 것이라고 한다.

iPhone:/private/var/containers/Bundle/Application/B8C75B08-F014-4EE8-AF8B-A228B50A3FA5/wallet.app root# otool -vh wallet 
wallet:
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
MH_MAGIC_64   ARM64        ALL  0x00     EXECUTE    57       6344   NOUNDEFS DYLDLINK TWOLEVEL PIE

- 암호화 여부 : 암호화 X (cryptid = 0 : 암호화 X , cryptid = 1 : 암호화 O)

chaem-20171201ui-iPhone:~ root# otool -l Multi | grep cryptid
      cryptid 0
      cryptid 0

- header 정보 확인

adminiPhonel5s:~ root# otool -arch all -h Multi
Multi (architecture armv7):
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
 0xfeedface      12          9  0x00           2    48       5332 0x00218085
Multi (architecture arm64):
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
 0xfeedfacf 16777228          0  0x00           2    48       6104 0x00200085

- 다음을 통해 2개의 아키택쳐를 사용하고 있음을 알 수 있다.

adminiPhonel5s:~ root# otool -f Multi
Fat headers
fat_magic 0xcafebabe
nfat_arch 2
architecture 0
    cputype 12
    cpusubtype 9
    capabilities 0x0
    offset 16384
    size 8218320
    align 2^14 (16384)
architecture 1
    cputype 16777228
    cpusubtype 0
    capabilities 0x0
    offset 8241152
    size 9618896
    align 2^14 (16384)

- otool로 _OBJC 세그먼트 내용 보기

otool -oV binary

- otool로 심볼 조사하기

otool -IV binary

- 텍스트 세그먼트 base address 찾기

otool -arch armv7s -l binary

Load command 1
      cmd LC_SEGMENT
  cmdsize 1348
  segname __TEXT        #text segment start
   vmaddr 0x00004000
   vmsize 0x00680000
  fileoff 0
 filesize 6815744
  maxprot 0x00000005
 initprot 0x00000005
   nsects 19
    flags 0x0

Load command 12
          cmd LC_ENCRYPTION_INFO
      cmdsize 20
     cryptoff 16384            #cryptooff hex : 4000
    cryptsize 6799360        #cryptosize hex : 67c000
      cryptid 0    # not crypted

text 세그먼트 : 0x00004000

1. 기본주소 + cryptoff = 0x00008000

2. 0x00008000 + cryptosize = 0x684000

    λ python  
    Python 3.7.4 (tags/v3.7.4:e09359112e, Jul 8 2019, 20:34:20) \[MSC v.1916 64 bit (AMD64)\] on win32  
    Type "help", "copyright", "credits" or "license" for more information.

    > hex(0x00008000 + 0x0067c000)  
    > '0x684000'

번외 > mac에서 LLDB를 사용하여 디버깅할 수 있음

(lldb) image list

(lldb) memory read —force —outfile /tmp/mem.bin —binary 0x00008000 0x0684000

 

[참고링크]

http://blog.dornea.nu/2014/10/29/howto-ios-apps-static-analysis/

https://resources.infosecinstitute.com/penetration-testing-for-iphone-applications-part-5/#gref

mac decompiling 용도 https://teamcrak.tistory.com/346