iOS Application Hooking (Frida)

When to Use

• When static analysis strings/binaries (via Hopper/Ghidra) are heavily obfuscated and you must observe exactly what the application is doing in memory dynamically.
• To bypass robust Jailbreak Detection mechanisms that force the target app to crash upon launch.
• To circumvent complex SSL Certificate Pinning, enabling you to intercept HTTPS traffic in Burp Suite without spending hours reverse-engineering native cryptographic functions.

Prerequisites

• Authorized scope and rules of engagement for the target environment
• Appropriate tools installed on the attack/analysis platform
• Understanding of the target technology stack and architecture
• Documentation template ready for findings and evidence capture

Workflow

Phase 1: Environment Setup (Jailbroken iOS)

# Concept: Frida operates via a client-server architecture. The Frida "Server" must be running 
# as root on the target device, listening for commands from the attacker's "Client" (your PC).

# 1. On the Jailbroken iOS Device:
# Open Cydia/Sileo -> Add Source: `https://build.frida.re` -> Install "Frida!"

# 2. On the Attacker PC:
pip3 install frida-tools objection

# 3. Verify Connectivity via USB:
frida-ps -U
# Output: Lists all processes currently executing on the iPhone. Look for the target application (e.g., `TargetBankApp`).

Phase 2: Injecting Custom JavaScript Hooks (The Core Mechanics)

// Concept: We write JavaScript on our PC. Frida injects the Google V8 Engine into the 
// iPhone's target application process, allowing our JS to seamlessly interact directly 
// with the underlying Objective-C / Swift architecture.

// Scenario: The app calls `-(BOOL)isJailbroken;` which returns TRUE, crashing the app.
// We intercept that call right before it finishes and permanently overwrite the return value back to FALSE.

if (ObjC.available) {
    // 1. Find the Class in the application memory
    var JailbreakDetectionClass = ObjC.classes.JailbreakDetector;
    
    // 2. Attach an Interceptor (Hook) to the specific method
    Interceptor.attach(JailbreakDetectionClass['- isJailbroken'].implementation, {
        
        onEnter: function(args) {
            console.log("[+] Intercepted isJailbroken execution!");
        },
        
        onLeave: function(retval) {
            console.log("[-] Original Return Value: " + retval);
            // 3. The Override: Change the boolean `TRUE` (1) to `FALSE` (0)
            var newRetval = ptr("0x0"); 
            retval.replace(newRetval);
            console.log("[+] Spofed Return Value: " + newRetval);
        }
    });
}

Phase 3: Launching the Frida Script

# Concept: You generally want to spawn the app via Frida so your hooks are loaded BEFORE 
# the jailbreak detection code executes upon startup.

# 1. Spawn the application (`-f`) on USB (`-U`), avoiding automatic resume (`--no-pause`), 
# and load your javascript payload (`-l`).
frida -U -f com.bank.targetapp -l jailbreak_bypass.js

# Output logs:
# [+] Intercepted isJailbroken execution!
# [-] Original Return Value: 0x1
# [+] Spoofed Return Value: 0x0

# The app launches successfully despite being on a fully jailbroken device!

Phase 4: Automated Evasion via Objection

# Concept: Writing custom JavaScript for every app takes hours. We highly utilize Objection, 
# a runtime mobile exploration toolkit powered natively by Frida, containing hundreds of 
# pre-built, massive hooking scripts.

# 1. Launch the target app attached to Objection
objection -g com.bank.targetapp explore

# 2. Execute automated universal SSL Pinning Bypass
# Instantly hooks and overrides all standard iOS networking libraries (NSURLSession, AFNetworking, TrustKit).
[usb] # ios sslpinning disable

# 3. Execute automated universal Jailbreak Detection Bypass
# Instantly hooks thousands of common JB detection files (e.g., checking for `/Applications/Cydia.app`, `fork()`).
[usb] # ios jailbreak disable

# 4. Extract Keychains and Secrets securely stored in memory
[usb] # ios keychain dump

Decision Point 🔀

flowchart TD
    A[Install App on Jailbroken iPhone] --> B[Launch App]
    B --> C{Does app crash immediately?}
    C -->|Yes (JB Detection)| D[Launch via `objection` & execute `ios jailbreak disable`]
    C -->|No| E[Configure iOS Proxy to Burp Suite]
    D --> E
    E --> F{Is traffic visible in Burp?}
    F -->|No (SSL Pinning)| G[Execute Objection `ios sslpinning disable` or custom Frida Script]
    F -->|Yes| H[Perform standard API penetration testing]
    G -->|Still Blocked?| I[Use `frida-trace` to identify custom native encryption functions in `libNet.dylib` and write bespoke JS to extract plaintext before encryption]

🔵 Blue Team Detection & Defense

• Frida/Ptrace Detection: Applications should actively scan their isolated memory segments for artifacts indicative of dynamic instrumentation, such as the frida-server daemon, the frida-agent.dylib injected library, or the presence of D-Bus communications. Upon detection, zeroize sensitive keys and abruptly terminate execution.
• Name Mangling and Obfuscation: Do not label security functions isJailbroken or validateSSL. Use non-descriptive, heavily mangled nomenclature (e.g., check_sys_integ_v2()). Stripping the application binary completely removes symbol tables, forcing the attacker to guess memory offsets statically rather than simply hooking named Objective-C methods via Frida's ObjC.classes.
• Inline C Hooking Countermeasures: Instead of simply returning a boolean from a Jailbreak validation method (which is trivially intercepted via onLeave), integrate the output cryptographically into the authentication token payload (e.g., XORing the session key). If an attacker forces the validation to return an anomalous value, a cascading cryptographic failure corrupts the token, preventing API access.

Key Concepts

Concept	Description
Dynamic Instrumentation	The process of modifying or monitoring the execution of a compiled software application at runtime without requiring the original source code
Frida	The industry-standard dynamic instrumentation toolkit allowing researchers to inject snippets of JavaScript directly into native applications (Windows, Linux, iOS, Android)
Hooking	The interception of function calls, messages, or events between software components. In iOS, replacing the implementation pointer (IMP) of an Objective-C method
Objection	A mobile exploration toolkit encapsulating complex Frida scripts into a simple, rapid-deployment interactive terminal (REPL)

Output Format

Mobile Pentest Exploit Capability: Custom SSL Pinning Bypass (Frida)
===================================================================
Target: `com.healthcare.portal` (Version 4.0.1)
Platform: iOS 16.5 
Tool: Frida v16.1

Description:
The target application implemented a heavily customized SSL Pinning architecture utilizing native C libraries, impervious to universal bypass tools like Objection or SSLKillSwitch2.

To restore API traffic visibility for vulnerability scanning, dynamic instrumentation was deployed via Frida. By utilizing `frida-trace` scanning the application's binary imports, the proprietary certificate validation function `SecTrustEvaluateWithError` was identified.

A bespoke JavaScript hook was authored to intercept this core iOS cryptography function specifically when invoked by the target application's thread. The script overrides the native validation mechanism, forcibly returning a `kSecTrustResultProceed` (Success) flag regardless of the presenting SSL certificate's validity.

```javascript
Interceptor.attach(Module.findExportByName('Security', 'SecTrustEvaluateWithError'), {
    onLeave: function(retval) {
        // Override the return value to indicate the Trust is valid (0x1)
        retval.replace(0x1); 
        console.log("[-] Successfully bypassed custom Trust Evaluation");
    }
});

Impact: The application fundamentally accepted the Burp Suite PortSwigger localized Certificate Authority. All application telemetry, including sensitive Personal Health Information (PHI) and authentication tokens, was successfully captured in plaintext over the encrypted SSL tunnel.

## 📚 Shared Resources
> For cross-cutting methodology applicable to all vulnerability classes, see:
> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class

## References
- Frida: [Official JavaScript API Reference](https://frida.re/docs/javascript-api/)
- SensePost: [Objection - Mobile exploration toolkit](https://github.com/sensepost/objection)
- Hacking Articles: [Comprehensive Guide on Frida and Objection](https://www.hackingarticles.in/)