2 years ago
#16296
T-StoneLeif
Tracing file creation via dynamic analysis of iOS application (using Frida)
Using FRIDA (http://frida.re), I'm debugging/reverse engineering an iOS app. The aim is to trace every file or folder created on the device by the app during runtime. So far I've tried running this javascript-snippet I found online via Frida:
var fileExistsAtPath = ObjC.classes.NSFileManager["- fileExistsAtPath:"];
Interceptor.attach(fileExistsAtPath.implementation, {
onEnter: function(args) {
var path = ObjC.Object(args[2]);
send("[NSFileManager fileExistsAtPath:] " + path.toString());
},
}
});
The javascript code works, however the function that is traced is only checking whether a file exists or not (as stated in the docs: https://developer.apple.com/documentation/foundation/nsfilemanager/1415645-fileexistsatpath). I'm not an experienced iOS developer, so if anyone have suggestions for iOS libraries and functions that are used to create (or write data to) files/folders by apps, I would be very grateful. I have found the "createFileAtPath" method in the Apple Developer documentation, but I'm unable to find any instance of this method in the running app.
ios
reverse-engineering
analysis
nsfilemanager
frida
0 Answers
Your Answer