Cong Cu Reverse Engineering & Setup

Cong cu la tay chan cua researcher. Setup dung tu dau giup tiet kiem hang tram gio.

Disassemblers & Decompilers

IDA Pro + Hex-Rays (Khuyen dung)

  • Vai tro: Disassembler va decompiler hang dau, standard trong industry
  • Tinh nang: ARM64 decompilation, type reconstruction, scripting (IDAPython), plugin ecosystem
  • Gia: Dat (license thuong mai), nhung co ban Education
  • Khi nao dung: Phan tich kernelcache, IOKit drivers, system daemons
  • Tips:
    • Load kernelcache voi dung base address
    • Dung DWARF symbols tu Apple KDK (Kernel Debug Kit) khi co
    • IDAPython scripts tu dong hoa pattern searching

Ghidra (Free, NSA)

  • Vai tro: Alternative mien phi cho IDA
  • Tinh nang: ARM64 support tot, decompiler tich hop, Java-based scripting
  • Khi nao dung: Khi khong co IDA license, hoac can second opinion
  • Han che: Decompiler output kem hon Hex-Rays cho ARM64 kernel code

Binary Ninja

  • Vai tro: Modern disassembler voi UI tot
  • Tinh nang: IL (Intermediate Language) layers, API-first design, Python scripting
  • Khi nao dung: Scripted analysis, khi can programmatic approach

Hopper

  • Vai tro: Lightweight disassembler cho macOS
  • Tinh nang: Nhanh, native macOS app, Objective-C analysis tot
  • Khi nao dung: Quick analysis cua userspace binaries

Command-Line Tools

otool / jtool2

# otool — Mach-O analysis (built-in macOS)
otool -lV binary          # Load commands (chi tiet)
otool -hV binary          # Mach-O header
otool -tV binary          # Disassemble __TEXT,__text

# jtool2 — Enhanced Mach-O analysis (Jonathan Levin)
jtool2 --pages binary     # Show segment/section layout
jtool2 -d binary          # Disassemble
jtool2 --ent binary       # Extract entitlements
jtool2 -S binary          # Show symbols

codesign / ldid

# codesign — macOS native code signing tool
codesign -d --entitlements :- binary    # Dump entitlements
codesign -dvvv binary                   # Detailed signing info

# ldid — Open-source signing tool (dung tren jailbroken devices)
ldid -e binary              # Extract entitlements
ldid -Sentitlements.xml binary  # Sign with entitlements

img4tool / img4lib

# Extract va decrypt kernelcache tu IPSW
img4tool -e -o kernelcache.raw kernelcache.img4
# Hoac dung pyimg4
python3 -m pyimg4 im4p extract -i kernelcache.im4p -o kernelcache.macho

lipo / file

lipo -info binary           # Architectures trong fat binary
lipo binary -thin arm64e -output binary.arm64e  # Extract single arch
file binary                 # File type identification

Debuggers

lldb

# Attach to process
lldb -n process_name
lldb -p PID

# Basic commands
(lldb) b function_name          # Set breakpoint
(lldb) br s -a 0x100001234     # Breakpoint at address
(lldb) r                        # Run
(lldb) c                        # Continue
(lldb) si                       # Step instruction
(lldb) ni                       # Next instruction (step over)
(lldb) register read            # All registers
(lldb) register read x0 x1 x2  # Specific registers
(lldb) memory read 0x100001234  # Read memory (hex dump)
(lldb) memory read -f x -c 8 -s 8 addr   # 8 uint64 values
(lldb) x/10gx addr             # GDB-style: 10 giant (8-byte) hex values
(lldb) disassemble -a 0x1234   # Disassemble at address
(lldb) image list               # Loaded images + ASLR slides
(lldb) expr -- (int)getpid()   # Evaluate expression

Kernel Debugging

  • Corellium: Virtual iOS devices — full kernel debugging support
  • KDP (Kernel Debug Protocol): Over network, can development kernel
  • Apple KDK (Kernel Debug Kit): Symbols cho production kernels (can Apple Developer account)

Dynamic Analysis

Frida

# Inject vao running process
frida -U -n SpringBoard        # USB-connected device
frida -H host:port -n target   # Remote

# Frida script basics
Interceptor.attach(ptr("0x1234"), {
    onEnter(args) {
        console.log("arg0:", args[0]);
    },
    onLeave(retval) {
        console.log("return:", retval);
    }
});

DTrace / Instruments (macOS)

# Trace syscalls
sudo dtruss -p PID
# Trace specific probe
sudo dtrace -n 'syscall::mach_msg_trap:entry { printf("%d", pid); }'

Lab Setup Recommendations

  • Virtual iOS devices trong cloud
  • Full kernel debugging, filesystem access
  • Kernel hooks, custom kernelcache loading
  • Gia: subscription model

Option 2: Physical Device + checkra1n/palera1n

  • iPhone X hoac cu hon (A11 va duoi cho checkm8)
  • checkra1n/palera1n jailbreak
  • SSH access, filesystem read/write
  • Frida cho dynamic analysis
  • Han che: khong co kernel debugging truc tiep

Option 3: macOS cho XNU research

  • Apple Silicon Mac chay macOS
  • Nhieu kernel subsystems giong iOS
  • Kernel debugging de hon (SIP disable + boot-args)
  • Tot cho hoc XNU internals truoc khi chuyen sang iOS

Workflow Co Ban

1. Extract kernelcache tu IPSW
   └─→ img4tool / pyimg4

2. Load vao IDA/Ghidra voi symbols (KDK)
   └─→ Phan tich static

3. Identify target (IOKit driver, syscall handler, ...)
   └─→ Tim entry points, trace code paths

4. Dynamic analysis tren device/Corellium
   └─→ Frida hooks, lldb debugging

5. Fuzzing (optional)
   └─→ IOKit fuzzer, syscall fuzzer

6. Exploit development
   └─→ PoC → primitive → chain → jailbreak