You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Port MASTG test 0087
* Update texts
* Update MASTG-TECH-0082: Enhance shared libraries identification and analysis
* Add MASTG-TECH-0118: Obtaining compiler provided security features in iOS
* Deprecate MASTG-TEST-0087
* Update MASTG-TEST-0x87 tests: Improve documentation on security features and testing steps for PIC, stack canaries, and ARC
* Fix title
* Fix typos and improve clarity on stack canaries and ARC
---------
Co-authored-by: Carlos Holguera <[email protected]>
Copy file name to clipboardexpand all lines: Document/0x06i-Testing-Code-Quality-and-Build-Settings.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -51,7 +51,7 @@ Detecting the presence of [binary protection mechanisms](0x04h-Testing-Code-Qual
51
51
Although Xcode enables all binary security features by default, it may be relevant to verify this for old applications or to check for compiler flag misconfigurations. The following features are applicable:
- PIE applies to executable binaries (Mach-O type `MH_EXECUTE`).
54
+
- PIE applies to executable binaries (Mach-O type `MH_EXECUTE`)[source](https://web.archive.org/web/20230328221404/https://opensource.apple.com/source/cctools/cctools-921/include/mach-o/loader.h.auto.html).
55
55
- However it's not applicable for libraries (Mach-O type `MH_DYLIB`).
Copy file name to clipboardexpand all lines: techniques/ios/MASTG-TECH-0082.md
+57-23
Original file line number
Diff line number
Diff line change
@@ -1,11 +1,63 @@
1
1
---
2
-
title: Get Loaded Native Libraries
2
+
title: Get Shared Libraries
3
3
platform: ios
4
4
---
5
5
6
-
## Using Objection
7
6
8
-
You can use the `list_frameworks` command in @MASTG-TOOL-0038 to list all the application's bundles that represent Frameworks.
7
+
To effectively identify and analyze shared libraries within an iOS application, it's important to distinguish between the app's bundled libraries and the system libraries provided by iOS. This distinction helps focus on the components that are unique to the app, thereby reducing noise during security assessments.
8
+
9
+
-**System Libraries**: Part of the iOS SDK, located in directories such as `/System/Library/Frameworks` or `/usr/lib`. These libraries are standard for all iOS applications and generally don't require detailed analysis unless there is a specific reason.
10
+
-**App-Bundled Libraries**: Included in the app bundle, often found in the `Frameworks` directory (`YourApp.app/Frameworks`). They include both first-party (custom) and third-party libraries that the developer intentionally incorporated into the app. They are the primary focus for security assessments. However, note that some **system libraries** may be also bundled with the app to ensure compatibility with specific versions of the iOS SDK so you'd need to filter them out.
11
+
12
+
Note that we're not considering static libraries, which, unlike dynamic libraries that are loaded at runtime, become part of the app's binary, resulting in a single executable file.
13
+
14
+
**Strategy**: Use one of the methods below, or a combination of them, to identify shared libraries, and then filter out system libraries to focus on those that are bundled with the app.
15
+
16
+
## Inspecting the Application Binary
17
+
18
+
Navigate to the `Frameworks` directory within the application bundle to find the shared libraries. The shared libraries are usually in the form of `.framework` or `.dylib` files.
19
+
20
+
```bash
21
+
ls -1 Frameworks
22
+
App.framework
23
+
Flutter.framework
24
+
libswiftCore.dylib
25
+
libswiftCoreAudio.dylib
26
+
...
27
+
```
28
+
29
+
## @MASTG-TOOL-0060
30
+
31
+
You can use the `otool -L` command to list the shared libraries.
32
+
33
+
```bash
34
+
otool -L MASTestApp
35
+
MASTestApp:
36
+
/System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 2503.1.0)
37
+
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
38
+
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
39
+
/System/Library/Frameworks/CryptoKit.framework/CryptoKit (compatibility version 1.0.0, current version 1.0.0)
40
+
...
41
+
```
42
+
43
+
## @MASTG-TOOL-0073
44
+
45
+
In radare2, you can list the linked libraries using the `il` command.
In Frida REPL process related information can be obtained using the `Process` command. Within the `Process` command the function `enumerateModules` lists the libraries loaded into the process memory.
74
+
The `Process.enumerateModules()` function in Frida's REPL allows enumeration of modules loaded into memory during runtime.
23
75
24
76
```bash
25
77
[iPhone::com.iOweApp]->Process.enumerateModules()
@@ -45,21 +97,3 @@ In Frida REPL process related information can be obtained using the `Process` co
45
97
46
98
...
47
99
```
48
-
49
-
Similarly, information related to various threads can be obtained.
50
-
51
-
```bash
52
-
Process.enumerateThreads()
53
-
[
54
-
{
55
-
"context": {
56
-
...
57
-
},
58
-
"id": 1287,
59
-
"state": "waiting"
60
-
},
61
-
62
-
...
63
-
```
64
-
65
-
The `Process`command exposes multiple functions which can be explored as per needs. Some useful functions are `findModuleByAddress`, `findModuleByName` and `enumerateRanges` besides others.
title: Obtaining Compiler-Provided Security Features
3
+
platform: ios
4
+
---
5
+
6
+
The iOS compiler provides several [security features that can be enabled during compilation](../../../Document/0x06i-Testing-Code-Quality-and-Build-Settings.md/#binary-protection-mechanisms). These features help protect the application from common vulnerabilities like buffer overflows and memory leaks. This technique provides guidance on how to check if these features are enabled in the compiled binary.
7
+
8
+
## @MASTG-TOOL-0073
9
+
10
+
In radare2, the presence of these compiler-provided security features can be checked by using the `i` and `is` commands.
11
+
12
+
**Check for PIC and Canaries:** Using the `i` command, you can check if the binary has Position Independent Code (PIC) enabled (`pic`) and if it has stack canaries (`canary`).
13
+
14
+
```sh
15
+
r2 MASTestApp
16
+
[0x100007408]> i~canary,pic
17
+
canary true
18
+
pic true
19
+
```
20
+
21
+
The output shows that the binary has stack canaries and PIE enabled.
22
+
23
+
**Check for ARC:** Using the `is` command, you can list the symbols in the binary and check for symbols that indicate the usage of Automatic Reference Counting (ARC). Common ARC symbols include:
24
+
25
+
-`objc_autorelease`
26
+
-`objc_retainAutorelease`
27
+
-`objc_release`
28
+
-`objc_retain`
29
+
-`objc_retainAutoreleasedReturnValue`
30
+
-`swift_release`
31
+
-`swift_retain`
32
+
33
+
An iOS binary does not need to have all of these symbols to be considered ARC-enabled, but the presence of some of them indicates that ARC is used.
34
+
35
+
```sh
36
+
[0x100007408]> is~release,retain
37
+
80 0x0000790c 0x10000790c LOCAL FUNC 0 imp.objc_release_x20
38
+
81 0x00007918 0x100007918 LOCAL FUNC 0 imp.objc_release_x24
39
+
82 0x00007924 0x100007924 LOCAL FUNC 0 imp.objc_release_x25
40
+
83 0x00007930 0x100007930 LOCAL FUNC 0 imp.objc_release_x27
41
+
84 0x0000793c 0x10000793c LOCAL FUNC 0 imp.objc_release_x8
42
+
85 0x00007948 0x100007948 LOCAL FUNC 0 imp.objc_retainAutoreleasedReturnValue
43
+
86 0x00007954 0x100007954 LOCAL FUNC 0 imp.objc_retain_x23
44
+
101 0x00007a08 0x100007a08 LOCAL FUNC 0 imp.swift_release
45
+
102 0x00007a14 0x100007a14 LOCAL FUNC 0 imp.swift_retain
46
+
```
47
+
48
+
The output shows that the binary contains symbols indicating the usage of ARC.
49
+
50
+
## @MASTG-TOOL-0074
51
+
52
+
Objection has a command `ios info binary` which can be used to get information about the binary, including whether stack canaries and PIE are enabled.
53
+
54
+
```sh
55
+
com.yourcompany.PPClient on (iPhone: 13.2.3) [usb] # ios info binary
56
+
Name Type Encrypted PIE ARC Canary Stack Exec RootSafe
title: Position Independent Code (PIC) not Enabled
3
+
platform: ios
4
+
id: MASTG-TEST-0x87-1
5
+
type: [static]
6
+
weakness: MASWE-0116
7
+
---
8
+
9
+
## Overview
10
+
11
+
[PIE (Position Independent Executables)](../../../Document/0x04h-Testing-Code-Quality.md/#position-independent-code) are designed to enhance security by allowing executables to be loaded at random memory addresses, mitigating certain types of attacks.
12
+
13
+
In the context Mach-O file format of iOS applications:
14
+
15
+
- PIE is applicable to executables with the `MH_EXECUTE` file type, which essentially means the main app binary (e.g. `YourApp.app/YourApp`).
16
+
- Shared libraries with the `MH_DYLIB` file type (dylibs and frameworks) are inherently position-independent and do not utilize the `MH_PIE` flag.
17
+
18
+
This test case checks if the main executable is compiled with PIE.
19
+
20
+
## Steps
21
+
22
+
1. Extract the application and identify the main binary (@MASTG-TECH-0054).
23
+
2. Identify all shared libraries (@MASTG-TECH-0082).
24
+
3. Run @MASTG-TECH-0118 on the main binary and grep for "pic" or the corresponding keyword used by the selected tool.
25
+
26
+
## Observation
27
+
28
+
The output should list if PIC is enabled or disabled.
This test case checks if the main binary or any libraries of the app are compiled without stack canaries and therefore lack [stack smashing protection](../../../Document/0x06i-Testing-Code-Quality-and-Build-Settings.md/#binary-protection-mechanisms), a common mitigation technique against buffer overflow attacks.
12
+
13
+
This test applies to all binaries and libraries:
14
+
15
+
- It is especially important for non-memory safe languages like Objective-C or C/C++.
16
+
- For pure Swift apps, checking for stack canaries can be usually skipped, as Swift is considered a memory safe by design and conventional parsing techniques cannot detect stack canaries in Swift binaries (see the "canary – exceptions" section of this [blog post](https://sensepost.com/blog/2021/on-ios-binary-protections/)).
17
+
18
+
To differentiate between Objective-C and Swift binaries, you can inspect the imports and linked libraries. Detecting Objective-C binaries is straightforward, but detecting pure Swift binaries is more challenging because depending on the Swift version and compiler settings, the binary may still contain Objective-C symbols or libraries. See the "identifying objc vs swift" section of this [blog post](https://sensepost.com/blog/2021/on-ios-binary-protections/) for more details.
19
+
20
+
## Steps
21
+
22
+
1. Extract the application and identify the main binary (@MASTG-TECH-0054).
23
+
2. Identify all shared libraries (@MASTG-TECH-0082).
24
+
3. Run @MASTG-TECH-0118 on the main binary and each shared library.
25
+
4. If the output contains the symbol `__stack_chk_fail` it indicates stack canaries are enabled.
26
+
27
+
## Observation
28
+
29
+
The output should contain a list of symbols of the main binary and each shared library.
30
+
31
+
## Evaluation
32
+
33
+
The test case fails any binary or library is not purely Swift but does not contain methods indicating stack canaries like `objc_autorelease` or `objc_retainAutorelease`.
34
+
35
+
**Note:** Checking for the `__stack_chk_fail` symbol only indicates that stack smashing protection is enabled somewhere in the app. While stack canaries are typically enabled or disabled for the entire binary, there may be corner cases where only parts of the application are protected. For example, if the app developer statically links a library with stack smashing protection enabled, but disables it for the entire application.
36
+
37
+
If you want to be sure that specific security-critical methods are sufficiently protected, you need to reverse-engineer each of them and manually check for stack smashing protection.
title: Automatic Reference Counting (ARC) not enabled
3
+
platform: ios
4
+
id: MASTG-TEST-0x87-3
5
+
type: [static]
6
+
weakness: MASWE-0116
7
+
---
8
+
9
+
## Overview
10
+
11
+
This test case checks if [ARC (Automatic Reference Counting)](../../../Document/0x04h-Testing-Code-Quality.md/#automatic-reference-counting) is enabled in iOS apps. ARC is a compiler feature in Objective-C and Swift that automates memory management, reducing the likelihood of memory leaks and other related issues. Enabling ARC is crucial for maintaining the security and stability of iOS applications.
12
+
13
+
-**Objective-C Code:** ARC can be enabled by compiling with the `-fobjc-arc` flag in Clang.
14
+
-**Swift Code:** ARC is enabled by default.
15
+
-**C/C++ Code:** ARC is not applicable, as it pertains specifically to Objective-C and Swift.
16
+
17
+
When ARC is enabled, binaries will include symbols such as `objc_autorelease` or `objc_retainAutorelease`.
18
+
19
+
## Steps
20
+
21
+
1. Extract the application and identify the main binary (@MASTG-TECH-0054).
22
+
2. Identify all shared libraries (@MASTG-TECH-0082).
23
+
3. Run @MASTG-TECH-0118 on the main binary and each shared library looking for ARC symbols like `objc_autorelease` or `objc_retainAutorelease`.
24
+
25
+
## Observation
26
+
27
+
The output should contain a list of symbols of the main binary and each shared library.
28
+
29
+
## Evaluation
30
+
31
+
The test fails if any binary or library containing Objective-C or Swift code is missing ARC-related symbols. The presence of symbols such as `_objc_msgSend` (Objective-C) or `_swift_allocObject` (Swift) without corresponding ARC symbols indicates that ARC may not be enabled.
32
+
33
+
**Note:** Checking for these symbols only indicates that ARC is enabled somewhere in the app. While ARC is typically enabled or disabled for the entire binary, there can be corner cases where only parts of the application or libraries are protected. For example, if the app developer statically links a library that has ARC enabled, but disables it for the entire application.
34
+
35
+
If you want to be sure that specific security-critical methods are adequately protected, you need to reverse-engineer each of them and manually check for ARC, or request the source code from the developer.
0 commit comments