GitHub - chaitin/passionfruit: [WIP] Crappy iOS app analyzer
source link: https://github.com/chaitin/passionfruit
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
This project has been discontinued. Please use the new Grapefruit
[email protected] compatibility issues
[email protected] introduces lots of breaking changes. After struggling a bit, I was unable to solve them. If you still need passionfruit, please keep the frida on your device to stay at 12.x.
npm install -g passionfruit passionfruit
- Cross plarform web GUI!
- Also supports non-jailbroken device (see Non-jailbroken device).
- List all url schemes.
- Check signature entitlements.
- List human readable app meta info (Info.plist).
- Capture screenshot.
- Checksec: see if target app is encrypted, and has enabled PIE, ARC and stack canary.
- App sandbox file browser. Directly preview images, SQLite databases and plist files on device. You can always download the file for further investigation.
- Check the loaded frameworks. Hook exported native functions from these dylib to print the arguments and stack trace.
- Log SQLite operations.
- Log and try to bypass jailbreak detection.
- List Objective-C classes from app, hook the methods and inspect the arguments and stack trace.
- Dump KeyChain, BinaryCookies and UserDefaults.
Please check out Wiki for more information.
Passionfruit is now avaliable on npm, so just type following command to install:
npm install -g passionfruit
Then launch it:
Note that if the port 31337 is in use, set environment variable
PORT to use an alternative port. Also, setting
HOST can force to listen on an alternative interface, but be careful because it has no authentication yet:
HOST=192.168.1.100 PORT=12345 passionfruit
Passionfruit does not support authentication now, so any one that have access to the web page may control your connected devices!
Cydiaand add Frida’s repository by going to
https://build.frida.re. You should now be able to find and install the
Official documentation of frida.re (linked above) also introduces how to inject FridaGadget.dylib to the ipa, requires repack and resign.
Here are some articles about how to do so:
Clone this project and install requirements:
git clone https://github.com/chaitin/passionfruit.git npm install
For those who wants to contribute, you may probably need to restart the api server and reload webpage each time you make a change. The following steps enable livereload.
npm run dev
Browser will be open (http://localhost:8080)
Aggregate valuable and interesting links.
Joyk means Joy of geeK