bfinject icon indicating copy to clipboard operation
bfinject copied to clipboard

appex not decrypt ?

Open laoyur opened this issue 7 years ago • 1 comments

sh bfinject -p APP_PROCESS_NUM -L decrypt ipa created successfully, but the Plugin/xxx.appex/xxx is not decrypted.

I've tried the appex executable's process number:

[+] Electra detected.
[+] Injecting into '/private/var/containers/Bundle/Application/46E55B2F-C46C-496A-90F1-007456442C35/DemoApp.app/PlugIns/DemoAppEx.appex/DemoAppEx'
[+] Getting Team ID from target application...
[+] Thinning dylib into non-fat arm64 image
[+] Signing injectable .dylib with Team ID JAU66K5B9X and platform entitlements...
[bfinject4realz] Calling task_for_pid() for PID 396.
[bfinject4realz] Calling thread_create() on PID 396
[bfinject4realz] Looking for ROP gadget... found at 0x180ca7118
[bfinject4realz] Fake stack frame at 0x102aa4000
[bfinject4realz] Calling _pthread_set_self() at 0x180f7471c...
[bfinject4realz] Returned from '_pthread_set_self'
[bfinject4realz] Calling dlopen() at 0x180ca6e7c...
[bfinject4realz] Returned from 'dlopen'
[bfinject4realz] Success! Library was loaded at 0x12fe503b0
[+] So long and thanks for all the fish.

It seems like -L decrypt does NOT support appex at all ?

laoyur avatar Jul 14 '18 08:07 laoyur

same issues here.

haidang1904 avatar Dec 12 '18 06:12 haidang1904