ASLR: Address Space Layout Randomization
查看应用是否进行了 ASLR 保护的方法：otool -hv ${File-Path}
I recently encountered issues decrypting applications for security analysis using iOS 6.0.1. Previously this was trivial using the previous version (5.1.1), yet when performing the same procedure on 6.0.1 i was encountering decrypted binaries which were full of zeros.
After a while I discovered these issues were related to ASLR being used in applications compiled for later versions of iOS.
In this blog I will show the process of disabling ASLR on the free "Facebook" app available off the app store. This application has ASLR enabled which complicates decryption of the application using automated tools.
Tools required
otool
ldid for OS X
GDB for iOS
changemacho_flags.py
a jailbroken iphone and a copy of facebook off the app store
Details
Running the command
Desktop# otool -l Facebook |grep -A4 "LCENCRYPTIONINFO"
outputs:
cmd LCENCRYPTIONINFO
cmdsize 20
cryptoff 8192
cryptsize 10027008
cryptid 1
Indicating that the app is encrypted and when decrypted it is located in virtual memory from 0x3000(0x1000 + 0x2000) to 0x993000. However when we start the app, attach GDB and try to access the start address we find it throws an error:
(gdb) x/20x 0x3000
0x3000: Cannot access memory at address 0x3000
listing the memory that is mapped by the application:
(gdb) info mach-region 0x3000
Region from 0x94000 to 0xa26000 (r-x, max r-x; copy, private, not-reserved) (2 sub-regions)
This shows the executable is not located in memory where it should be indicating that ASLR is used.
ASLR is enabled for individual applications using the MHPIE flag located in the applications MACH-O header. By flipping this flag we turn off ASLR.
Copy the Facebook binary from the device to your desktop from the device directory
iPhone#/private/var/mobile/Application/[UUID]/Facebook.app
where [UUID] is the unique number of the directory for the app on the device.
Extract the entitlement xml file of the app:
Desktop# ldid -e Facebook > entitlements.xml
Disable the MHPIE bit using the changemachoflags.py
Desktop# python changemachoflags.py --no-pie Facebook
Re-sign the app
Desktop# ldid -Sentitlements.xml Facebook
backup the old copy on the device
iPhone# cp Facebook Facebook.bak
Copy the altered binary back to the device
now we reattach gdb and inspect the application memory again:
(gdb) x/20x 0x3000
0x3000: 0x00000000 0x00000000 0x00000000 0x00000000
0x3010: 0x00000000 0x00000000 0x00000000 0x00000000
0x3020: 0x00000000 0x00000000 0x00000000 0x00000000
0x3030: 0x00000000 0x00000000 0x00000000 0x00000000
0x3040: 0xe59d0000 0xe28d1004 0xe2804001 0xe0812104
(gdb) info mach-region 0x3000
Region from 0x3000 to 0x993000 (r-x, max r-x; copy, private, not-reserved)
Which confirms that ASLR is now disabled and we can now decrypt the application for further analysis.