bfinject
bfinject copied to clipboard
appex not decrypt ?
sh bfinject -p APP_PROCESS_NUM -L decrypt
ipa created successfully, but the Plugin/xxx.appex/xxx is not decrypted.
I've tried the appex executable's process number:
[+] Electra detected.
[+] Injecting into '/private/var/containers/Bundle/Application/46E55B2F-C46C-496A-90F1-007456442C35/DemoApp.app/PlugIns/DemoAppEx.appex/DemoAppEx'
[+] Getting Team ID from target application...
[+] Thinning dylib into non-fat arm64 image
[+] Signing injectable .dylib with Team ID JAU66K5B9X and platform entitlements...
[bfinject4realz] Calling task_for_pid() for PID 396.
[bfinject4realz] Calling thread_create() on PID 396
[bfinject4realz] Looking for ROP gadget... found at 0x180ca7118
[bfinject4realz] Fake stack frame at 0x102aa4000
[bfinject4realz] Calling _pthread_set_self() at 0x180f7471c...
[bfinject4realz] Returned from '_pthread_set_self'
[bfinject4realz] Calling dlopen() at 0x180ca6e7c...
[bfinject4realz] Returned from 'dlopen'
[bfinject4realz] Success! Library was loaded at 0x12fe503b0
[+] So long and thanks for all the fish.
It seems like -L decrypt does NOT support appex at all ?
same issues here.