2 years ago

#16296

test-img

T-StoneLeif

Tracing file creation via dynamic analysis of iOS application (using Frida)

Using FRIDA (http://frida.re), I'm debugging/reverse engineering an iOS app. The aim is to trace every file or folder created on the device by the app during runtime. So far I've tried running this javascript-snippet I found online via Frida:

var fileExistsAtPath = ObjC.classes.NSFileManager["- fileExistsAtPath:"];

Interceptor.attach(fileExistsAtPath.implementation, {
    onEnter: function(args) {
      var path = ObjC.Object(args[2]);
      send("[NSFileManager fileExistsAtPath:] " + path.toString());

    },
  }
});

The javascript code works, however the function that is traced is only checking whether a file exists or not (as stated in the docs: https://developer.apple.com/documentation/foundation/nsfilemanager/1415645-fileexistsatpath). I'm not an experienced iOS developer, so if anyone have suggestions for iOS libraries and functions that are used to create (or write data to) files/folders by apps, I would be very grateful. I have found the "createFileAtPath" method in the Apple Developer documentation, but I'm unable to find any instance of this method in the running app.

ios

reverse-engineering

analysis

nsfilemanager

frida

0 Answers

Your Answer

Accepted video resources