Training Objectives

This 3-day course will equip you with a toolbox of indispensable techniques and methods for diving into the world of hacking apps on mobile devices. After getting started with static reverse engineering and dynamic testing iOS apps using Ghidra and Frida, we’ll pivot to Android to adapt these methods to the quirks of the Java world. We’ll be using Frida to trace control flow, find interesting code paths, manipulate data, and finally collect code coverage – everything you’ll need to get started writing custom fuzzers for vulnerability discovery.

The training will include hands-on exercises on virtual iOS and Android devices. Students will be guided through using free and open-source reverse-engineering software and frameworks (such as Ghidra and Frida) to understand the internals and perform security testing of closed-source apps.

Training level: Intermediate; Basic

Training Outline

Learning objectives:
Understand the structure of an iOS application after dumping it unencrypted from a phone. Get to know methods for static and dynamic application analysis and combine both methods, apply these tools to find interesting code paths, and automate sending input to the app.

• Download and decrypt apps from Apple’s App Store.
• The internal structure of an iOS application, including metadata for security analysis.
• iOS specifics: Objective-C/Swift, frameworks, DYLD shared cache, plists, entitlements,
• Discover interesting functions and where they’re called from with dynamic analysis.
• Combine the results of dynamic analysis with static analysis to figure out function inputs.
• Write a basic fuzzer.

Learning objectives:
Understand common patterns used in iOS apps such as asynchronous programming with Grand Central Dispatch and cross-process communication with XPC. Trainees will learn how to follow control and data flow across threads and processes by applying their understanding of these concepts to the methods learned on Day 1. As an outlook, the techniques learned are put into the context of how one would write a custom fuzzer.

• Threading on iOS: thread creation, Grand Central Dispatch (GCD), backtracing, and coverage across threads.
• Data exchange between apps and daemons: observe Cross-Process Communication (XPC) during runtime.
• Overview of further low-level communication, such as Mach messages and sockets.
• Collect coverage with the Frida Stalker.
• Introduction to advanced fuzzing techniques.

Learning objectives:
Trainees will understand fundamental differences between Android and iOS Apps from a reverse engineering perspective, adapting the methods learned on iOS to the Java ecosystem used on Android.

• The internal structure of an Android app.
• Static analysis of applications written in Java/Kotlin.
• Android specifics: Java virtualization, native libraries, JNI, …
• Dynamic instrumentation of applications that mix Java and native code.
• Android security boundaries: Intents, content providers, Binder.
• Using existing tools to bypass TLS certificate pinning, root/jailbreak detection, and modifying SQLite databases.