Slides for 0xcon 2017 talk about objection by @leonjza.

1. 0xcon 2017
📱objection
RUNTIME MOBILE EXPLORATION

2. 0xcon 2017
@leonjza
@sensepost

3. 0xcon 2017

4. 0xcon 2017

5. 0xcon 2017
meh.

6. 0xcon 2017
- Ole André Vadla Ravnås (@oleavr)
- dynamic instrumentation toolkit
- injects chrome v8 (or duktape) into process
- instrumentation done using JavaScript
- basically magic (no really.)
frida

7. 0xcon 2017
‘embedded mode’
(recently added fully autonomous mode)

8. 0xcon 2017
demo(native function hooking)

9. 0xcon 2017
objective-c
(and java)

10. 0xcon 2017
@implementation JailbreakDetection
+(BOOL) isJailbroken {
NSFileManager *fm = [NSFileManager defaultManager];
if ([fm fileExistsAtPath:@"/bin/bash"]) {
return YES;
}
return NO;
}
@end

11. 0xcon 2017
var JailbreakDetection = ObjC.classes.JailbreakDetection;
Interceptor.attach(
JailbreakDetection.isJailbroken.implementation, {
onEnter: function (args) {
//
},
onLeave: function (retval) {
retval.replace(0x0);
}
});

12. 0xcon 2017
demo(jailbreak detection simulation/bypass)

13. 0xcon 2017
lets… inject arbitrary code

14. 0xcon 2017
demo(nsuserdefaults extraction)

15. 0xcon 2017
📱objection
bundled it up, and called it…
(object)inject(ion)

16. 0xcon 2017
- python3, installable with pip3
- bundles ios and android hooks
- ’compiles’ hooks with Jinja2
- can import arbitrary Frida scripts
- do not need a jailbroken / rooted device
internals

17. 0xcon 2017
thanks! 🎉

18. 0xcon 2017
demo(exploring the filesystem)

19. 0xcon 2017
demo(ssl pinning bypass)

20. 0xcon 2017
demo(class method monitoring)

21. 0xcon 2017
- dump process/module memory
- interact with iOS keychain
- bypass touchid*
- monitor iOS pasteboard
- extract iOS binary cookies
and lots more!

22. 0xcon 2017
questions?
https://github.com/sensepost/objection
@leonjza / @sensepost