MASTG-TOOL-0073: radare2 (iOS)

radare2 is a complete framework for reverse-engineering and analyzing binaries. The installation instructions can be found in the GitHub repository. To learn more on radare2 you may want to read the official radare2 book.

Learn more:

• r2wiki
• Loading iOS binaries to radare2
• GitHub radare2 Docs - iOS

Techniques

MASTG-TECH-0070: Extracting Information from the Application Binary MASTG-TECH-0118: Obtaining Compiler-Provided Security Features MASTG-TECH-0113: Obtaining Debugging Symbols MASTG-TECH-0082: Get Shared Libraries

Tests

MASTG-TEST-0209: Insufficient Key Sizes MASTG-TEST-0213: Use of Hardcoded Cryptographic Keys in Code MASTG-TEST-0214: Hardcoded Cryptographic Keys in Files MASTG-TEST-0210: Broken Symmetric Encryption Algorithms MASTG-TEST-0311: Insecure Random API Usage MASTG-TEST-0211: Broken Hashing Algorithms MASTG-TEST-0215: Sensitive Data Not Marked For Backup Exclusion MASTG-TEST-0303: References to APIs for Storing Unencrypted Data in Shared Storage MASTG-TEST-0300: References to APIs for Storing Unencrypted Data in Private Storage MASTG-TEST-0297: Insertion of Sensitive Data into Logs MASTG-TEST-0070: Testing Universal Links MASTG-TEST-0276: Use of the iOS General Pasteboard MASTG-TEST-0278: Pasteboard Contents Not Cleared After Use MASTG-TEST-0279: Pasteboard Contents Not Expiring MASTG-TEST-0280: Pasteboard Contents Not Restricted to Local Device MASTG-TEST-0248: References to APIs for Detecting Secure Screen Lock MASTG-TEST-0240: Jailbreak Detection in Code MASTG-TEST-0281: Undeclared Known Tracking Domains MASTG-TEST-0270: References to APIs Detecting Biometric Enrollment Changes MASTG-TEST-0266: References to APIs for Event-Bound Biometric Authentication MASTG-TEST-0268: References to APIs Allowing Fallback to Non-Biometric Authentication

Demos

MASTG-DEMO-0014: Use of Hardcoded ECDSA Private Key in CryptoKit with r2 MASTG-DEMO-0011: Uses of Insufficient Key Size in SecKeyCreateRandomKey with r2 MASTG-DEMO-0018: Uses of Broken Encryption Algorithms in CommonCrypto with r2 MASTG-DEMO-0016: Uses of Broken Hashing Algorithms in CryptoKit with r2 MASTG-DEMO-0080: Uses of Broken Encryption Modes in CommonCrypto with r2 MASTG-DEMO-0073: Uses of Insecure Random Number Generation with r2 MASTG-DEMO-0013: Use of Hardcoded RSA Private Key in SecKeyCreateWithData with r2 MASTG-DEMO-0015: Uses of Broken Hashing Algorithms in CommonCrypto with r2 MASTG-DEMO-0021: Uses of Jailbreak Detection Techniques with r2 MASTG-DEMO-0084: Hardcoded HTTP URLs in iOS Binary MASTG-DEMO-0086: Uses of BSD Sockets Bypassing ATS MASTG-DEMO-0085: Uses of Network Framework Bypassing ATS