Skip to main content
image

Frida iOS hook

A script that helps you trace classes, functions, and modify the return values of methods on iOS platform.

For Android platform: https://github.com/noobpk/frida-android-hook

Env OS Support

OS Supported Noted
MacOS ✅ main
Linux ✅ sub
Windows ✅ sub

Compatible with

iOS Frida Supported
13.2.3 14.2.13 ✅
14.4.2 14.2.13 ✅

Feature

Running with python3.x

Support both spawn & attach script to process.

[+] Options:

	-p(--package)			Identifier of application ex: com.apple.AppStore
	-n(--name) 			Name of application ex: AppStore
	-s(--script) 			Using script format script.js
	-c(--check-version) 		Check for the newest version
	-u(--upadte) 			Update to the newest version

	[*] Dump decrypt IPA:

    	-d, --dump         Dump decrypt application.ipa
    	-o OUTPUT_IPA, --output=OUTPUT_IPA
                           Specify name of the decrypted IPA

	[*] Dump memory of Application:

	--dump-memory		Dump memory of application

	[*] Information:

	--list-devices    List All Devices
	--list-apps       List The Installed apps
	--list-appinfo    List Info of Apps on Itunes
	--list-scripts    List All Scripts

	[*] Quick method:

	-m(--method)			Support commonly used methods
				- app-static(-n)
				- bypass-jb(-p)
				- bypass-ssl(-p)
				- i-url-req(-p)
				- i-crypto(-n)

Update

Version: 3.4

	[+] Change:

		[-] Update example usage

		[-] Optimize core hook.py

		[-] Update README.md


	[+] New:

		[-] Add new new option dump memory of application

Install & Usage

	1. Git clone https://github.com/noobpk/frida-ios-hook
	2. cd frida-ios-hook/
	3. python3 hook.py --help(-h)
	4. rebellion :))

If you run the script but it doesn't work, you can try the following: frida -U -f package -l script.js

Frida-Script

Updated some frida scripts to help you with the pentest ios app. Filter script using spawn(S) or attach(A)

N Spawn/Attach Script Name Script Description
1 S bypass-jailbreak-1.js Basic bypass jailbreak detection
2 S dump-ios-url-scheme.js Dump iOS url scheme when "openURL" is called
3 S dump-ui.js Dump the current on-screen User Interface structure
4 S+A find-all-classes.js Dump all classes used by the app
5 S+A find-all-methods-all-classes.js Dump all methods inside all classes
6 S+A find-specific-method.js Find a specific method in all classes
7 S+A hook-all-methods-of-specific-class.js Hook all the methods of a particular class
8 S+A hook-specific-method-of-class.js Hook a particular method of a specific class
9 S+A ios-app-static-analysis.js iOS app static analysis
10 S+A ios-list-apps.js iOS list information application
11 S+A ios-url-scheme-fuzzing.js iOS url scheme fuzzing
12 S pasteboard-monitoring.js Monitor usage of pasteboard. Useful to show lack of secure attribute on sensitive fields allowing data copying.
13 A read-nsuserdefaults.js Show contents fo NSUserDefaults
14 S+A show-all-methods-of-specific-class.js Dump all methods of a particular class
15 S+A show-argument-type-count-and-return-value-type.js Show argument type & count and type of return value for a function in a class
16 S+A show-instance-variables-for-specific-class.js Show all instance variables of a particular class
17 S+A show-modify-function-arguments.js Show and modify arguments of a function inside a class
18 S+A show-modify-method-return-value.js Show and modify return value of a particular method inside a class
19 A show_binarycookies.js Show contents of Cookies.binarycookies file
20 S bypass-ssl-ios13.js iOS13 bypass ssl pinning
21 S flutter_trace_function.js iOS flutter trace function
22 S+A ios-intercept-crypto.js Intercepts Crypto Operations
23 S+A ios-intercept-crypto-2.js Intercepts Crypto Operations 2

Disclaimer

Because I am not a developer, so my coding skills might not be the best. Therefore, if this tool have any issue or not working for you, create an issue and i will try to fix it. Any suggestions for new feature and discussions are welcome!

Metadata

Release files for Frida-iOS-Hook 3.4

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for Frida-iOS-Hook 3.4
File Size Uploaded
Frida iOS Hook-3.4.tar.gz 7.5 kB Details

Built distribution (wheel)

Table of built distributions (wheels) for Frida-iOS-Hook 3.4
File Interpreter ABI Platform
Frida_iOS_Hook-3.4-py3-none-any.whl Python 3 none any Details

Total release size: 16.6 kB

Release files / Frida iOS Hook-3.4.tar.gz

Download URL Frida iOS Hook-3.4.tar.gz
Size 7.5 kB
Tags Source
SHA-256 checksum
How to use checksums
719d96cd6c2fb11886c0cca89cab522d66374c2f9f6bf0eb39c2036da51ab0d6
BLAKE2b-256 checksum
How to use checksums
1406bb81eab2651128f6d343e64708e2afc88f01e06b5bf45fb248377f2354c6
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/3.4.1 importlib_metadata/4.0.1 pkginfo/1.7.0 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.56.0 CPython/3.8.1

Release files / Frida_iOS_Hook-3.4-py3-none-any.whl

Download URL Frida_iOS_Hook-3.4-py3-none-any.whl
Size 9.1 kB
Tags Python 3
SHA-256 checksum
How to use checksums
257bac87796da08e3754bb5f7e89d0b4346a332546190f05eee46722124eafd7
BLAKE2b-256 checksum
How to use checksums
8aee7178d0eaa4351863534b860f68ac27a8422ac7dd8706231e512e55078724
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/3.4.1 importlib_metadata/4.0.1 pkginfo/1.7.0 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.56.0 CPython/3.8.1

Release history Release notifications | RSS feed

This release

3.4 This release

2 release files

3.3

2 release files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page