IOSSecuritySuite/FrameworkClientApp/ViewController.swift at 246fe9de3164609dd1b577ef8c1c5af5afe93ee6 · securing/IOSSecuritySuite · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
//
//  ViewController.swift
//  FrameworkClientApp
//
//  Created by wregula on 23/04/2019.
//  Copyright © 2019 wregula. All rights reserved.
//

import UIKit
import IOSSecuritySuite

class RuntimeClass {
  @objc dynamic func runtimeModifiedFunction() -> Int {
    return 1
  }
}

internal class ViewController: UIViewController {
  @IBOutlet weak var result: UITextView!

  override func viewDidAppear(_ animated: Bool) {
    var message = ""

#if arch(arm64)
    message += executeChecksForArm64()
#endif

    // Runtime Check
    let test = RuntimeClass.init()
    _ = test.runtimeModifiedFunction()
    let dylds = ["UIKit"]
    let amIRuntimeHooked = IOSSecuritySuite.amIRuntimeHooked(
      dyldAllowList: dylds,
      detectionClass: RuntimeClass.self,
      selector: #selector(RuntimeClass.runtimeModifiedFunction),
      isClassMethod: false
    )

    message += """
        Jailbreak? \(IOSSecuritySuite.amIJailbroken())
        Jailbreak with fail msg? \(IOSSecuritySuite.amIJailbrokenWithFailMessage())
        Jailbreak with failedChecks? \(IOSSecuritySuite.amIJailbrokenWithFailedChecks())
        Run in emulator? \(IOSSecuritySuite.amIRunInEmulator())
        Debugged? \(IOSSecuritySuite.amIDebugged())
        Unexpected Launcher? \(IOSSecuritySuite.isParentPidUnexpected())
        Am I tempered with? \(IOSSecuritySuite.amITampered(
        [.bundleID("biz.securing.FrameworkClientApp")])
        )
        Reversed? \(IOSSecuritySuite.amIReverseEngineered())
        Reversed with failedChecks? \(IOSSecuritySuite.amIReverseEngineeredWithFailedChecks())
        Am I runtime hooked? \(amIRuntimeHooked)
        Am I proxied? \(IOSSecuritySuite.amIProxied())
        """

    result.text = message
  }
}

#if arch(arm64)
extension ViewController {
  func executeChecksForArm64() -> String {
    // executeAntiHook()

    // MSHook Check
    func msHookReturnFalse(takes: Int) -> Bool {
      return false /// add breakpoint at here to test `IOSSecuritySuite.hasBreakpointAt`
    }

    typealias FunctionType = @convention(thin) (Int) -> (Bool)
    func getSwiftFunctionAddr(_ function: @escaping FunctionType) -> UnsafeMutableRawPointer {
      return unsafeBitCast(function, to: UnsafeMutableRawPointer.self)
    }

    let funcAddr = getSwiftFunctionAddr(msHookReturnFalse)

    return """
        Am I MSHooked? \(IOSSecuritySuite.amIMSHooked(funcAddr))
        Application executable file hash value? \(IOSSecuritySuite.getMachOFileHashValue() ?? "")
        IOSSecuritySuite executable file hash value? \(
        IOSSecuritySuite.getMachOFileHashValue(.custom("IOSSecuritySuite")) ?? ""
        )
        Loaded libs? \(IOSSecuritySuite.findLoadedDylibs() ?? [])
        HasBreakpoint? \(IOSSecuritySuite.hasBreakpointAt(funcAddr, functionSize: nil))
        Watchpoint? \(testWatchpoint())
        """
  }

  func testWatchpoint() -> Bool {

//    Uncomment these \/ and set a watch point to check the feature
//    var ptr = malloc(9)
//    var count = 3
    return IOSSecuritySuite.hasWatchpoint()
  }

  func executeAntiHook() {
    typealias MyPrint = @convention(thin) (Any..., String, String) -> Void
    func myPrint(_ items: Any..., separator: String = " ", terminator: String = "\n") {
      print("print has been hooked")
    }

    let myprint: MyPrint = myPrint
    let myPrintPointer = unsafeBitCast(myprint, to: UnsafeMutableRawPointer.self)
    var oldMethod: UnsafeMutableRawPointer?

    // simulating hook
    replaceSymbol(
      "$ss5print_9separator10terminatoryypd_S2StF",
      newMethod: myPrintPointer,
      oldMethod: &oldMethod
    )

    print("print hasn't been hooked")

    // antiHook
    IOSSecuritySuite.denySymbolHook("$ss5print_9separator10terminatoryypd_S2StF")
    print("print has been antiHooked")
  }
}
#endif