iOS-OSX-Dynamic-Analysis.md
July 13, 2015 ยท View on GitHub
iOS/OSX Dynamic Analysis
Interaction with Devices
libimobiledevice
A cross-platform protocol library to communicate with iOS devices
http://www.libimobiledevice.org/
MobileDevice
A python package, and command line tool, which wraps Apple's MobileDevice API - providing access to iOS devices.
https://github.com/mountainstorm/MobileDevice
libimobiledeive-osx
Build libimobiledeive on Mac OS X
https://github.com/Proteas/libimobiledeive-osx
SDMMobileDevice
MobileDevice Implementation
https://github.com/samdmarshall/SDMMobileDevice
pymobiledevice
pymobiledevice is a python implementation of the libimobiledevice cross-platform software library.
https://github.com/pedia/pymobiledevice
itunnel_mux
connect by usb http://code.google.com/p/iphonetunnel-usbmuxconnectbyport/
Installation, Execution and Decryption
pkg-Installer
Bypassing installation requirements check for Mac OS X .pkg files.
https://github.com/x43x61x69/pkg-Installer
Mach-O-Prettifier
A Mach-O Load Command deobfuscator.
https://github.com/x43x61x69/Mach-O-Prettifier
dumpdecrypted
Dumps decrypted mach-o files from encrypted iPhone applications from memory to disk. This tool is necessary for security researchers to be able to look under the hood of encryption.
https://github.com/stefanesser/dumpdecrypted
Clutch
Fast iOS executable dumper
https://github.com/KJCracks/Clutch
Debugging and Tracing
cycript
Ponydebugger
https://github.com/square/PonyDebugger
lldb-capstone-arm
Capstone disassemble scripts for lldb
https://github.com/upbit/lldb-capstone-arm
DTrace-book-scripts
Scripts from "DTrace: Dynamic Tracing in Oracle Solaris, Mac OS X, and FreeBSD", by Brendan Gregg and Jim Mauro, Prentice Hall, 2011.
https://github.com/brendangregg/DTrace-book-scripts
CryptoShark
Self-optimizing cross-platform code tracer based on dynamic recompilation, powered by Frida and Capstone.
https://github.com/frida/cryptoshark
gdb-ng
Apple's gdb fork with some fixes and enhancements
https://github.com/gdbinit/gdb-ng
pydbg64
PyDBG64 - OS X PyDbg with 64 bits support
https://github.com/gdbinit/pydbg64
Injection, Hooking and Intrumentation
Frida
https://github.com/frida/frida
osxinj
osx dylib injection
https://github.com/scen/osxinj
osxinj_tut
OSX injection tutorial: Hello World
https://github.com/arbinger/osxinj_tut
insert_dylib
Command line utility for inserting a dylib load command into a Mach-O binary
https://github.com/Tyilo/insert_dylib
mach_override
runtime function overriding for Mac OS X
https://github.com/rentzsch/mach_override
mach_inject
interprocess code injection for Mac OS X
https://github.com/rentzsch/mach_inject
Mach-O-Hook
Mach-O import table patching for function redirection. This is a method for function hooking on Mac OS X. It patches the import table of Mach-O libraries in order to redirect particular functions in them to other implementations.
https://github.com/shoumikhin/Mach-O-Hook
Memory Analysis
HippocampHairSalon
A simple universal memory editor (game trainer) on OSX/iOS
https://github.com/iosre/HippocampHairSalon
UI Automation
AXElements
UI Automation for OS X
https://github.com/AXElements/AXElements
ATOMac
Python Automated Testing on Mac
https://github.com/pyatom/pyatom
cliclick
OS X tool for executing mouse- and keyboard-related actions from the shell
https://github.com/BlueM/cliclick
System Monitoring
macfsevents
Thread-based interface to file system observation primitives.
https://github.com/malthe/macfsevents
FSWalker
A File System Browser for iOS
https://github.com/nst/FSWalker
Network Analysis
Charles Proxy
Mallory
MiTM TCP and UDP Proxy
https://github.com/intrepidusgroup/mallory
ADVsock2pipe
capture network data with tcpdump on Linux or iPhone/iPad to see the capture in (almost) real-time in Wireshark on windows
https://github.com/ADVTOOLS/ADVsock2pipe
Sandbox
Introspy-iOS
Security profiling for blackbox iOS
https://github.com/iSECPartners/Introspy-iOS
DiOS
DiOS: Large-Scale Dynamic Privacy Analysis of iOS App Store Applications
https://github.com/DiOS-Analysis/DiOS
Others
theos
Unified cross-platform iPhone Makefile system
https://github.com/DHowett/theos
classdump-dyld
Class-dump any Mach-o file without extracting it from dyld_shared_cache