Ios Pentesting Tricks

# iOS Runtime Tricks — Frida Recipes, Objection Reference & Hooking Patterns

> **AI LOAD INSTRUCTION**: Load this when you need Frida recipes for iOS-specific hooks, Objection command reference, or runtime hooking pattern templates. Assumes the main [SKILL.md](./SKILL.md) is already loaded for general iOS testing methodology.

---

## 1. FRIDA RECIPES FOR iOS

### 1.1 ObjC Class Enumeration

```javascript
// List all classes containing a keyword
Java.perform || true;  // NOP for iOS
ObjC.enumerateLoadedClasses({
    onMatch: function(name) {
        if (name.toLowerCase().indexOf('auth') !== -1 ||
            name.toLowerCase().indexOf('login') !== -1 ||
            name.toLowerCase().indexOf('token') !== -1) {
            console.log('[Class] ' + name);
        }
    },
    onComplete: function() { console.log('[+] Class enumeration done'); }
});
```

### 1.2 Method Enumeration for a Class

```javascript
// List all methods of a specific class
var className = 'AppDelegate';
var methods = ObjC.classes[className].$ownMethods;
console.log('[' + className + '] Methods (' + methods.length + '):');
methods.forEach(function(method) {
    console.log('  ' + method);
});
```

### 1.3 Jailbreak Detection Bypass

```javascript
// Comprehensive jailbreak detection bypass for iOS
var paths = [
    '/Applications/Cydia.app', '/usr/sbin/sshd', '/bin/bash',
    '/usr/bin/ssh', '/etc/apt', '/private/var/lib/apt/',
    '/usr/local/bin/cycript', '/usr/lib/libcycript.dylib',
    '/var/lib/cydia', '/var/cache/apt', '/var/lib/apt',
    '/Library/MobileSubstrate/MobileSubstrate.dylib',
    '/private/var/stash', '/.cydia_no_stash',
    '/Applications/Sileo.app', '/var/jb'
];

// Hook NSFileManager
var fm = ObjC.classes.NSFileManager;
Interceptor.attach(fm['- fileExistsAtPath:'].implementation, {
    onEnter: function(args) {
        this.path = ObjC.Object(args[2]).toString();
    },
    onLeave: function(retval) {
        for (var i = 0; i < paths.length; i++) {
            if (this.path === paths[i]) {
                retval.replace(ptr(0));
                console.log('[JB Bypass] fileExistsAtPath blocked: ' + this.path);
                return;
            }
        }
    }
});

// Hook canOpenURL (Cydia URL scheme check)
var app = ObjC.classes.UIApplication;
Interceptor.attach(app['- canOpenURL:'].implementation, {
    onEnter: function(args) {
        this.url = ObjC.Object(args[2]).toString();
    },
    onLeave: function(retval) {
        if (this.url.indexOf('cydia://') !== -1 ||
            this.url.indexOf('sileo://') !== -1) {
            retval.replace(ptr(0));
            console.log('[JB Bypass] canOpenURL blocked: ' + this.url);
        }
    }
});

// Hook fopen for /etc/fstab, /bin/sh checks
var fopen = Module.findExportByName(null, 'fopen');
Interceptor.attach(fopen, {
    onEnter: function(args) {
        this.path = args[0].readUtf8String();
    },
    onLeave: function(retval) {
        if (this.path === '/bin/sh' || this.path === '/etc/fstab' ||
            this.path === '/bin/bash') {
            retval.replace(ptr(0));
        }
    }
});

// Hook fork() — should return -1 on non-jailbroken
var fork = Module.findExportByName(null, 'fork');
Interceptor.attach(fork, {
    onLeave: function(retval) {
        retval.replace(ptr(-1));
        console.log('[JB Bypass] fork() → -1');
    }
});

console.log('[+] Jailbreak detection bypass installed');
```

### 1.4 SSL Pinning Bypass (iOS-Specific)

```javascript
// Hook SecTrustEvaluateWithError (iOS 12+)
var SecTrustEvaluateWithError = Module.findExportByName('Security', 'SecTrustEvaluateWithError');
if (SecTrustEvaluateWithError) {
    Interceptor.attach(SecTrustEvaluateWithError, {
        onLeave: function(retval) {
            retval.replace(ptr(1));  // Return true (trusted)
        }
    });
}

// Hook SecTrustEvaluate (legacy)
var SecTrustEvaluate = Module.findExportByName('Security', 'SecTrustEvaluate');
if (SecTrustEvaluate) {
    Interceptor.attach(SecTrustEvaluate, {