Skip to content

MASTG-TECH-0070: Extracting Information from the Application Binary

You can use radare to get information about the binary, such as the architecture, the list of shared libraries, the list of classes and methods, strings and more.

Let's use the Damn Vulnerable iOS App DVIA v1 as an example. Open its main binary with radare2:

r2 DamnVulnerableIOSApp

Binary Information

To get information about the binary, you can use the i command. This command will list information about the binary, such as the architecture, the list of shared libraries, the list of classes and methods, strings and more.

[0x1000180c8]> i
...
size     0x43d5f0
humansz  4.2M
mode     r-x
format   mach064
iorw     false
block    0x100
packet   xtr.fatmach0
...
lang     objc with blocks
linenum  false
lsyms    false
nx       false
os       ios
pic      true
relocs   true
sanitize false
static   false
stripped true

Classes and Methods

And then we can proceed to extract information about the methods in the application's source code. To do this, we need to load the application binary into radare and then list the classes and methods in the binary.

[0x1000180c8]> icc

...

@interface SFAntiPiracy : NSObject
{
}
+ (int) isPirated
+ (int) isJailbroken
+ (void) killApplication
+ (bool) isTheDeviceJailbroken
+ (bool) isTheApplicationCracked
+ (bool) isTheApplicationTamperedWith
+ (int) urlCheck
...
@end

Note the plus sign, which means that this is a class method that returns a BOOL type. A minus sign would mean that this is an instance method. Refer to later sections to understand the practical difference between these.

Linked Libraries

The following command is listing shared libraries:

[0x1000180c8]> il
[Linked libraries]
/System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration
/System/Library/Frameworks/StoreKit.framework/StoreKit
/System/Library/Frameworks/Security.framework/Security
/System/Library/Frameworks/QuartzCore.framework/QuartzCore
/System/Library/Frameworks/MobileCoreServices.framework/MobileCoreServices
/usr/lib/libz.1.dylib
/System/Library/Frameworks/CoreLocation.framework/CoreLocation
/System/Library/Frameworks/CoreGraphics.framework/CoreGraphics
/System/Library/Frameworks/CFNetwork.framework/CFNetwork
/System/Library/Frameworks/AudioToolbox.framework/AudioToolbox
/System/Library/Frameworks/CoreData.framework/CoreData
/System/Library/Frameworks/UIKit.framework/UIKit
/System/Library/Frameworks/Foundation.framework/Foundation
/usr/lib/libobjc.A.dylib
/usr/lib/libSystem.B.dylib
/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation

16 libraries

Strings

Obtaining strings is very useful when reverse engineering an app because it can give you a lot of information about the app's functionality. For example, you can find URLs, API endpoints, encryption keys, and more. You can also find strings that will point you to interesting functions, such as the login function or a function that checks whether the device is jailbroken.

[0x1000180c8]> izz~cstring | less


29903 0x001d0b4c 0x1001d0b4c 5   6    5.__TEXT.__cstring        ascii   Admin
29904 0x001d0b52 0x1001d0b52 13  14   5.__TEXT.__cstring        ascii   This!sA5Ecret
29905 0x001d0b60 0x1001d0b60 15  16   5.__TEXT.__cstring        ascii   pushSuccessPage
29906 0x001d0b70 0x1001d0b70 4   5    5.__TEXT.__cstring        ascii   Oops
29907 0x001d0b75 0x1001d0b75 30  31   5.__TEXT.__cstring        ascii   Incorrect Username or Password
29908 0x001d0b94 0x1001d0b94 17  18   5.__TEXT.__cstring        ascii   usernameTextField
29909 0x001d0ba6 0x1001d0ba6 39  40   5.__TEXT.__cstring        ascii   T@"UITextField",&,N,V_usernameTextField
29910 0x001d0bce 0x1001d0bce 17  18   5.__TEXT.__cstring        ascii   passwordTextField
...
29915 0x001d0ca8 0x1001d0ca8 18  19   5.__TEXT.__cstring        ascii   http://google.com/
29926 0x001d0d73 0x1001d0d73 37  38   5.__TEXT.__cstring        ascii   Request Sent using pinning, lookout !
29927 0x001d0d99 0x1001d0d99 77  78   5.__TEXT.__cstring        ascii   Certificate validation failed. 
                                                                        You will have to do better than this, my boy!!