前言
經(jīng)過(guò)之前的分享，相信大家已經(jīng)掌握了用戶級(jí)的插件開(kāi)發(fā)。勤奮好學(xué)的你是否對(duì)系統(tǒng)級(jí)的插件也有著濃厚的性趣，本篇文章將和大家一起學(xué)習(xí)如何分析并編寫(xiě)一款系統(tǒng)級(jí)的插件。
一、目標(biāo)
一步步分析并編寫(xiě)一個(gè)短信自動(dòng)轉(zhuǎn)發(fā)的deb插件
二、工具
- mac系統(tǒng)
- 已越獄iOS設(shè)備：脫殼及frida調(diào)試
- IDA Pro：靜態(tài)分析
- 測(cè)試設(shè)備：iphone6-ios12.5.5
三、步驟
1、守護(hù)進(jìn)程
? 守護(hù)進(jìn)程(daemon)是一類(lèi)在后臺(tái)運(yùn)行的特殊進(jìn)程，用于執(zhí)行特定的系統(tǒng)任務(wù)。例如：推送服務(wù)、人臉解鎖、iCloud、查找我的iPhone、iMessage等。
相應(yīng)的配置目錄：
-
/Library/LaunchAgents：管理員控制特定用戶的代理
-
/Library/LaunchDaemons：管理員提供的系統(tǒng)級(jí)守護(hù)進(jìn)程（cydia、filza、frida等就在這）
-
/System/Library/LaunchDaemons：iOS提供的默認(rèn)守護(hù)進(jìn)程
本文的目的主要短信，所以關(guān)注的重點(diǎn)在iOS提供的守護(hù)進(jìn)程，常見(jiàn)的進(jìn)程配置文件有：
| 名稱 | 描述 |
|---|---|
| com.apple.apsd | 推送服務(wù) |
| com.apple.biometrickitd.pearl | 人臉解鎖 |
| com.apple.cloudd | iCloud |
| com.apple.icloud.findmydeviced | 查找我的iPhone |
| com.apple.imagent | 即時(shí)消息代理 (iMessage) |
更多服務(wù)請(qǐng)參考https://www.theiphonewiki.com/wiki/Services
2、定位關(guān)鍵函數(shù)
在iPhone中使用文件管理工具查看/System/Library/LaunchDaemons/com.apple.imagent文件關(guān)鍵信息如下：
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EnvironmentVariables</key>
<dict>
<key>NSRunningFromLaunchd</key>
<string>1</string>
</dict>
<key>ProgramArguments</key>
<array>
<string>/System/Library/PrivateFrameworks/IMCore.framework/imagent.app/imagent</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
ProgramArguments所對(duì)應(yīng)的路徑，就是該進(jìn)程執(zhí)行的二進(jìn)制文件。執(zhí)行frida-trace -U -m "*[IM* *]" imagent -o a.log后，當(dāng)手機(jī)收到短信后的日志如下：
-[SMSServiceSession smsMessageReceived:0x10524abc0 msgID:0x80000006]
-[SMSServiceSession _processSMSorMMSMessageReceivedWithContext:0x10524abc0 messageID:0x80000006]
+[IMMetricsCollector sharedInstance]
-[IMMetricsCollector trackEvent:0x1d02ab1e8]
-[SMSServiceSession _convertCTMessageToDictionary:0x109a0e510 requiresUpload:0x16f832c2f]
-[IMMetricsCollector _trackEvent:0x1d02ab1e8]
-[SMSServiceSession _fixIncomingDate:0xd13d420d70d597e6]
-[SMSServiceSession shouldFixIncomingDate]
-[SMSServiceSession _myCTPhoneNumber]
+[IMCTSubscriptionUtilities sharedInstance]
-[IMCTSubscriptionUtilities deviceSupportsMultipleSubscriptions]
+[IMCTSubscriptionUtilities sharedInstance]
-[IMCTSubscriptionUtilities deviceSupportsMultipleSubscriptions]
+[IMCTSMSUtilities IMMMSEmailAddressToMatchForPhoneNumber:0x100830240 simID:0x0]
+[IMCTSubscriptionUtilities sharedInstance]
-[IMCTSubscriptionUtilities deviceSupportsMultipleSubscriptions]
-[SMSServiceSession _convertCTMessagePartToDictionary:0x109a28610]
-[SMSServiceSession _shouldUploadToMMCS:0x10524aca0]
-[SMSServiceSession _receivedSMSDictionary:0x10524aca0 requiresUpload:0x0 isBeingReplayed:0x0]
-[SMSServiceSession _processReceivedDictionary:0x10524aca0 storageContext:0x0]
+[IMMessageNotificationTimeManager sharedInstance]
-[IMMessageNotificationTimeManager acquireAssertionToUnsuspendProcess]
+[IMLockdownManager sharedInstance]
-[IMLockdownManager isInternalInstall]
-[IMLockdownManager _calculateInstallType]
-[IMMessageItem initWithSender:0x100890210 time:0x1008831d0 body:0x10083ba80 attributes:0x0 fileTransferGUIDs:0x1007081d0 flags:0x1 error:0x0 guid:0x10524acc0]
-[IMMessageItem initWithSender:0x100890210 time:0x1008831d0 body:0x10083ba80 attributes:0x0 fileTransferGUIDs:0x1007081d0 flags:0x1 error:0x0 guid:0x10524acc0 type:0x0]
-[IMMessageItem initWithSenderInfo:0x10085c330 time:0x1008831d0 timeRead:0x0 timeDelivered:0x0 timePlayed:0x0 subject:0x0 body:0x10083ba80 bodyData:0x0 attributes:0x0 fileTransferGUIDs:0x1007081d0 flags:0x1 guid:0x10524acc0 messageID:0x0 account:0x0 accountID:0x0 service:0x0 handle:0x0 roomName:0x0 unformattedID:0x0 countryCode:0x0 expireState:0x0 balloonBundleID:0x0 payloadData:0x0 expressiveSendStyleID:0x0 timeExpressiveSendPlayed:0x0 bizIntent:0x0 locale:0x0 errorType:0x0 type:0x0]
-[IMItem initWithSenderInfo:0x10085c330 time:0x1008831d0 guid:0x10524acc0 messageID:0x0 account:0x0 accountID:0x0 service:0x0 handle:0x0 roomName:0x0 unformattedID:0x0 countryCode:0x0 type:0x0]
-[IMItem setSenderInfo:0x10085c330]
根據(jù)日志可看出關(guān)鍵函數(shù)-[SMSServiceSession smsMessageReceived:0x10524abc0 msgID:0x80000006]， 使用命令frida-trace -U -m "-[SMSServiceSession smsMessageReceived:msgID:]" imagent跟蹤該函數(shù)，js代碼如下:
{
onEnter(log, args, state) {
log(`-[SMSServiceSession smsMessageReceived:${ObjC.Object(args[2])} msgID:${args[3]}]`);
},
onLeave(log, retval, state) {
}
}
當(dāng)手機(jī)收到短信時(shí)，對(duì)應(yīng)日志輸出如下:
-[SMSServiceSession smsMessageReceived:<CTXPCServiceSubscriptionContext 0x10bfd1240 slotID=CTSubscriptionSlotOne, uuid=00000000-0000-0000-0000-000000000001, labelID="90D990CE-3484-4310-9F39-49A66EB80541", label="USER_LABEL_PRIMARY", phoneNumber="+861812186xxxx", userDataPreferred=1, userDefaultVoice=1> msgID:0x80000010]
根據(jù)日志信息可看出，該方法里除了msgID，并沒(méi)有包含我們需要的短信及發(fā)件人相關(guān)信息。那我們繼續(xù)按日志的順序往下看，-[SMSServiceSession _convertCTMessageToDictionary:requiresUpload:] 這函數(shù)看著比較親切。trace該函數(shù)得到日志如下：
-[SMSServiceSession _convertCTMessageToDictionary:<[CTMessageAddress: 1898000xxxx/TYPE=PLMN]
[Recipients: (
)]
[Items: (
"<CTMessagePart: 0x10be7f340>"
)]
[Raw Headers: (null)]
[Date: 2023-07-30 14:43:23 +0000]
[message ID: -2147483630]
[message Type: 1]
[service center: (null)]
[Content-type: (null)]
[Content-type params: {
}]
[replace message: 0]
requiresUpload:0x16edaec2f]
-[SMSServiceSession _convertCTMessageToDictionary:requiresUpload:]={
co = "+861812186xxxx";
g = "00ECAC3B-0790-8674-CAD5-58DD07F4DEBA";
h = 1898000xxxx;
k = (
{
data = <e58fa6>;
type = "text/plain";
}
);
l = 0;
m = sms;
n = 460;
re = (
);
sV = 1;
w = "2023-07-30 14:43:25 +0000";
}}=
從日志可以看出。該方法就是我們要hook方法，收件人：co，發(fā)件人：h，短信內(nèi)容：k
3、編寫(xiě)deb插件
具體的創(chuàng)建流程請(qǐng)參考之前的文章，源碼如下:
#import <Foundation/Foundation.h>
#import "CaptainHook/CaptainHook.h"
@interface SMSServiceSession
@end
@interface IMDService
-(void)loadServiceBundle;
@property (nonatomic,retain,readonly) NSBundle * bundle;
@end
CHDeclareClass(SMSServiceSession); // declare class
CHOptimizedMethod2(self, id, SMSServiceSession, _convertCTMessageToDictionary, NSDictionary *, arg1, requiresUpload, BOOL*, arg2) {
id result = CHSuper2(SMSServiceSession, _convertCTMessageToDictionary, arg1, requiresUpload, arg2);
@try {
NSString *from = result[@"h"];
NSString *to = result[@"co"];
NSArray *msgList = result[@"k"];
if (msgList.count > 0) {
NSData *data = msgList[0][@"data"];
NSString *content = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
NSLog(@"witwit =from %@=to %@=content %@=",from, to, content);
} else {
NSLog(@"witwit =sms為空=");
}
} @catch (NSException *exception) {
NSLog(@"witwit =SMSServiceSession _convertCTMessageToDictionary=err=%@=", exception);
} @finally {
}
return result;
}
CHDeclareClass(IMDService)
CHOptimizedMethod0(self, void, IMDService, loadServiceBundle) {
CHSuper0(IMDService, loadServiceBundle);
NSString *bundleId = [[self bundle] bundleIdentifier];
NSLog(@"witwit =IMDService loadServiceBundle=%@=", bundleId);
if ([bundleId isEqualToString:@"com.apple.imservice.sms"]) {
CHLoadLateClass(SMSServiceSession);
CHHook2(SMSServiceSession, _convertCTMessageToDictionary, requiresUpload);
}
}
CHConstructor // code block that runs immediately upon load
{
@autoreleasepool
{
NSLog(@"witwit SMSForward load success");
CHLoadLateClass(IMDService);
CHHook0(IMDService, loadServiceBundle);
}
}
info.plist文件配置如下：
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Filter</key>
<dict>
<key>Bundles</key>
<array>
<string>com.apple.imagent</string>
</array>
</dict>
</dict>
</plist>
注：插件安裝完成后。請(qǐng)重啟imagent:
launchctl unload /System/Library/LaunchDaemons/com.apple.imagent.plist
launchctl load /System/Library/LaunchDaemons/com.apple.imagent.plist
總結(jié)
本篇文章主要對(duì)短信轉(zhuǎn)發(fā)器的核心方法進(jìn)行了分析及試驗(yàn)，拿到短信內(nèi)容后，具體的轉(zhuǎn)發(fā)邏輯請(qǐng)自行實(shí)現(xiàn)。
提示：閱讀此文檔的過(guò)程中遇到任何問(wèn)題，請(qǐng)關(guān)住工眾好【
移動(dòng)端Android和iOS開(kāi)發(fā)技術(shù)分享】或+99 君羊【812546729】文章來(lái)源：http://www.zghlxwxcb.cn/news/detail-692836.html
文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-692836.html
到了這里，關(guān)于【iOS逆向與安全】sms短信轉(zhuǎn)發(fā)插件開(kāi)發(fā)的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
