Frida & Objection for Remote Jailbroken iOS devices

1. Port forward local port 27042 to remote port 27042

From PC/Mac terminal, run the following command to forward local port 27042 to remote port 27042.

ssh -L 27042:127.0.0.1:27042 root@<iDevice_ip>

Enter iDevice root password and leave the terminal as is.

 

 

List applications running on device

Make sure frida-tools is upto date on the pc/MAC.

List running applications : frida-ps -R

Sample Output

(virt-python3)  rizal@rizals-Mac$ frida-ps -R
 PID  Name
----  --------------------------------------------------------
2712  Camera
 980  InCallService
2001  Mail
1720  Messages
 790  MusicUIService
2715  Photos
1726  Settings
1253  User Authentication
3424  WhatsApp
...

 

Hook application on remote iDevice with Objection

objection --network --gadget "Application Name" explore

The --network flag tells objection to connect using a network connection instead of USB.

Sample Output

(virt-python3)  rizal@rizals-Mac$ objection --network --gadget "Reddit" explore

     _     _         _   _
 ___| |_  |_|___ ___| |_|_|___ ___
| . | . | | | -_|  _|  _| | . |   |
|___|___|_| |___|___|_| |_|___|_|_|
        |___|(object)inject(ion) v1.4.3

     Runtime Mobile Exploration
        by: @leonjza from @sensepost

[tab] for command suggestions
com.reddit.Reddit on (iPhone: 11.3.1) [net] #

 

 

Reference:

https://flippingbitz.com/post/2018-09-21-objection-remote-device-app-hook/#application-running-on-remote-ios-jailbroken-device