[HN Gopher] Debugging an Undebuggable App
___________________________________________________________________
Debugging an Undebuggable App
Author : xmprt
Score : 153 points
Date : 2025-02-17 18:10 UTC (4 hours ago)
(HTM) web link (bryce.co)
(TXT) w3m dump (bryce.co)
| amjoshuamichael wrote:
| Bryce Bostwick does super cool & inspiring work on debugging and
| reverse-engineering apps. I found him on YouTube; His video on
| modding TikTok to only show cat videos
| (https://youtu.be/YW3jL2gI9IE) inspired me to mod Instagram to
| remove everything except the message feature, which is the only
| part I use. I've been meaning to get more into modding & reverse
| engineering-specifically modding Windows in the style of Windhawk
| (https://windhawk.net/). Bryce gives a great intro to doing that
| sort of thing on iOS with live, step-by-step videos.
| jer0me wrote:
| The video at the top is one of the best programming videos I've
| ever watched. It's fast-paced, assumes just the right amount of
| knowledge, and has excellent demos that don't kill the flow of
| the video.
| cynicalsecurity wrote:
| I wonder how Apple allowed an app that was purposely crashing the
| phone under specific conditions.
| jer0me wrote:
| It probably didn't crash the phone during review. App Store
| review is a human tapping through your app's common flows,
| looking for specific things. You don't provide them with the
| source code, and they don't really look at the binary, so it's
| not difficult to use private APIs or hide things from
| reviewers.
|
| For example, after being kicked off the App Store by sanctions,
| Russian banks have used "trojan apps" that show different apps
| inside Russia: https://appleinsider.com/articles/24/02/12/how-
| russian-banks...
| Hamuko wrote:
| The specific condition being the phone OS being modified with
| third-party code by exploiting iOS vulnerabilities. Yeah, I
| think Apple missed that one.
| duxup wrote:
| I don't think Apple tests those conditions, they're not common.
| cyberax wrote:
| App reviews take on average less than a minute. The reviewer
| just signs in, taps randomly, and that's it.
| bluelightning2k wrote:
| Great write up. I'm very curious whether this was a legitimate
| app which was unreasonably paranoid, or if it turns out he was
| debugging it in the first place because it was accused of being
| malware.
|
| Seems like a lot of effort to go to otherwise
| bluelightning2k wrote:
| Or maybe trying to prove copyright theft, if the app itself was
| recompiled with different logos etc
| brycebostwick wrote:
| As best as I can tell, it's just unreasonably paranoid -- they
| do some very cool things with widgets that it seems like they
| were trying to protect (though those strategies are starting to
| leak out anyways)
|
| There were some interesting things in the binary still. At one
| point I was trying to figure out why I was looking at code that
| looked like it was downloading a Windows .iso; turns out it
| was, and it was used for a network speed test widget!
| schmidtleonard wrote:
| BillGates.iso: What is my purpose?
|
| CoolWidgets.app: Your heft tests the network speed.
|
| BillGates.iso: Oh my god.
| beefnugs wrote:
| If I ran the App Store : this would be enough evidence that I
| would heavily investigate all of their other apps for signs
| of illegal and immoral activity, also adding in static
| infinite loop detection on all app submissions
| zlagen wrote:
| Does anyone know about people doing similar reverse engineering
| but for javascript code in websites?
| zemnmez wrote:
| a few of my writeups discuss ways of doing this:
|
| appleid https://zemnmez.medium.com/how-to-hack-apple-
| id-f3cc9b483a41 steam https://hackerone.com/reports/409850
| masto wrote:
| The same author just put this out: https://youtu.be/F5m2JxplnXk
| zlagen wrote:
| amazing!
| GrumpyCat42 wrote:
| Been really enjoying the author's YouTube content lately, even
| though I'm not too experienced in reverse engineering.
| brycebostwick wrote:
| Hey all! Author here, happy to answer any questions. Thanks xmprt
| for sharing!
| brycebostwick wrote:
| (also, these comments are way too kind. thanks all!)
| StefanBatory wrote:
| I watched your video on Youtube - it was interesting!
|
| But also thanks for providing a written version too, it's very
| nice ;)
| cwillu wrote:
| Autoplaying gif mixed into text, closed the page.
| brycebostwick wrote:
| I certainly like them by default, but I get that others don't
| - one thing I could do is have them paused by default if
| `prefers-reduced-motion` is on. Though I'm curious if you (or
| any other folks here) have this enabled.
|
| (would have added this ages ago if I knew this existed; not a
| CSS expert, just seeing it now by checking if web has an
| equivalent of iOS' `UIAccessibility.isReduceMotionEnabled`.
| neat!)
| cwillu wrote:
| Setting doesn't exist on my os, and I certainly would not
| approve of a setting that gives people license to do (imo)
| shitty things to the user experience just because there's
| an obscure setting somewhere.
|
| It's your site, you can do what you want; it's my browser,
| I will close tabs that annoy me with extreme prejudice.
| smw wrote:
| Do you use a very old phone for jailbreaking, or are there more
| recent jailbreaks?
| brycebostwick wrote:
| I mostly use an old phone on 16.6. iOS 17/18 is harder; you
| can jailbreak that if you have an iPad 7th Gen (technically
| iPadOS, but whatever). I have a couple but prefer the iPhone
| since it's less clunky to lug around!
|
| I've seen some rumors of that device not supporting iPadOS
| 19, so I'm not really sure what the plan is if that's true.
| Maybe everyone starts forking money over to Corellium.
| barco wrote:
| Does iOS have something like PTRACE_SYSCALL to hook up on
| syscalls entry and maybe change the return value? (Or detect
| where the SVC is being made)
| bobmcnamara wrote:
| Apple seems to have come so far from the iPhone4's misaligned
| Thumb 2 page crossing core fault.
| userbinator wrote:
| Anti-debugging (and even anti-anti-anti-debugging) tricks have
| been commonplace on the DOS/Windows side of things for a long
| time. Any old cracking/unpacking information will discuss those
| in varying amounts of detail.
|
| How easy it is for the user to have control over what apps do is
| inversely related to how user-hostile the platform is.
| PT_DENY_ATTACH seems like a feature specifically invented for the
| purpose of serving the latter. Of course on the Windows side,
| which I believe doesn't have such a feature, the trick is to make
| the app attach to itself instead:
|
| https://www.x86matthew.com/view_post?id=selfdebug
|
| https://anti-debug.checkpoint.com/techniques/interactive.htm...
___________________________________________________________________
(page generated 2025-02-17 23:00 UTC)