### Install Agent Dependencies Source: https://github.com/sensepost/objection/wiki/Agent-Development-Environment Run this command in the objection/agent directory to install all necessary dependencies for the agent. ```bash npm install ``` -------------------------------- ### Install Objection using pip3 Source: https://github.com/sensepost/objection/wiki/Installation Use this command for a native installation of Objection. Ensure Python 3 and pip3 are installed. ```bash pip3 install -U objection ``` -------------------------------- ### Install ios-deploy on macOS Source: https://github.com/sensepost/objection/wiki/Running-Patched-iOS-Applications Installs the `ios-deploy` utility globally using npm. This command should be run on macOS systems. ```bash npm install -g ios-deploy ``` -------------------------------- ### Install libimobiledevice Utilities on Kali Linux Source: https://github.com/sensepost/objection/wiki/Running-Patched-iOS-Applications Installs necessary `libimobiledevice` utilities, including `ideviceinstaller`, on Kali Linux using apt. ```bash apt install libimobiledevice-utils ideviceinstaller ``` -------------------------------- ### Full Plugin Implementation Example Source: https://github.com/sensepost/objection/wiki/Plugins A complete Python plugin example that adds a 'plugin frida info' command to the Objection REPL. It includes a Frida script for retrieving version information. ```python { 'meta': 'Work with Frida version information', 'commands': { 'info': { 'meta': 'Get the current Frida version', 'exec': self.version } } } ``` ```python __description__ = "An example plugin, also used in a UnitTest" from objection.utils.plugin import Plugin s = """ rpc.exports = { getInformation: function() { console.log('hello from Frida'); // direct output send('Incoming message'); // output via send for 'message' signal return Frida.version; // return type } } """ class VersionInfo(Plugin): """ VersionInfo is a sample plugin to get Frida version information """ def __init__(self, ns): """ Creates a new instance of the plugin :param ns: """ # plugin sources are specified, so when the plugin is loaded it will not # try and discover an index.js next to this file. self.script_src = s # as script_src is specified, a path is not necessary. this is simply an # example of an alternate method to load a Frida script # self.script_path = os.path.join(os.path.dirname(__file__), "script.js") implementation = { 'meta': 'Work with Frida version information', 'commands': { 'info': { 'meta': 'Get the current Frida version', 'exec': self.version } } } super().__init__(__file__, ns, implementation) self.inject() def version(self, args: list): """ Tests a plugin by calling an RPC export method called getInformation, and printing the result. :param args: :return: """ v = self.api.get_information() print('Frida version: {0}'.format(v)) namespace = 'version' plugin = VersionInfo ``` -------------------------------- ### Run iOS Jailbreak Simulation on Startup Source: https://github.com/sensepost/objection/wiki/Early-Instrumentation Use the `--startup-command` flag with `objection start` to execute a command as soon as the application starts. This is useful for testing early-stage application behaviors like jailbreak detection. ```bash objection -n Gadget start --startup-command 'ios jailbreak simulate' ``` -------------------------------- ### Objection Patch IPA Execution Example Source: https://github.com/sensepost/objection/wiki/Patching-iOS-Applications An example output demonstrating the objection patchipa command in action, showing the steps from finding a provision file to codesigning the patched IPA. ```bash $ objection patchipa --source "DVIA-nowatch.ipa" --codesign-signature 0C2E8200D4XXXX Using Gadget version: 10.5.15 No provision file specified, searching for one... Found provision /Users/leonjza/Library/Developer/Xcode/DerivedData/PewPew-ctjryaatvxygoabrwrllkmwxlvgn/Build/Products/Debug-iphoneos/PewPew.app/embedded.mobileprovision expiring in 4 days, 19:10:47.596338 Found a valid provisioning profile Working with app: DamnVulnerableIOSApp.app Bundle identifier is: com.highaltitudehacks.dvia Creating Frameworks directory for FridaGadget... Codesigning 1 .dylib's with signature 0C2E8200D4XXXX Code signing: FridaGadget.dylib Creating new archive with patched contents... Codesigning patched IPA... Cannot find entitlements in binary. Using defaults Copying final ipa from /var/folders/nn/7rzmzs_920n8qvff8n9nf1rm0000gn/T/DVIA-nowatch-frida-codesigned.ipa to current directory... Cleaning up temp files... ``` -------------------------------- ### Install Agent Dependencies Source: https://github.com/sensepost/objection/wiki/Development-Environment-Installation Navigate to the agent directory within the cloned Objection repository and install its Node.js dependencies using npm. ```bash cd agent npm install ``` -------------------------------- ### Android RPC Example: List Activities Source: https://github.com/sensepost/objection/wiki/API Example of how to list activities in an Android application using the `androidHookingListActivities` RPC method. ```APIDOC ## GET /rpc/invoke/androidHookingListActivities ### Description Lists all activities in the current Android application. ### Method GET ### Endpoint /rpc/invoke/androidHookingListActivities ### Parameters None ### Request Example ```bash curl -s "http://127.0.0.1:8888/rpc/invoke/androidHookingListActivities" ``` ### Response #### Success Response (200) - **activities** (array of strings) - A list of activity class names. #### Response Example ```json ["com.reddit.frontpage.StartActivity","com.reddit.frontpage.IntroductionActivity", ...] ``` ``` -------------------------------- ### iOS RPC Example: Search Methods Source: https://github.com/sensepost/objection/wiki/API Example of how to search for methods in an iOS application using the `iosHookingSearchMethods` RPC method. ```APIDOC ## POST /rpc/invoke/iosHookingSearchMethods ### Description Searches for methods in the current iOS application based on a partial string match. ### Method POST ### Endpoint /rpc/invoke/iosHookingSearchMethods ### Parameters #### Request Body - **partial** (string) - Required - The partial string to search for within method names. ### Request Example ```bash curl -s -X POST "http://127.0.0.1:8888/rpc/invoke/iosHookingSearchMethods" -H "Content-Type: application/json" -d '{"partial": "jail"}' ``` ### Response #### Success Response (200) - **methods** (array of strings) - A list of method signatures matching the partial string. #### Response Example ```json ["[JailbreakDetection + isJailbroken]","[UIScreen + _shouldDisableJail]", ...] ``` ``` -------------------------------- ### Android RPC Example: Get Class Methods Source: https://github.com/sensepost/objection/wiki/API Example of how to get all methods within a specific Android activity class using the `androidHookingGetClassMethods` RPC method. ```APIDOC ## POST /rpc/invoke/androidHookingGetClassMethods ### Description Retrieves all methods for a given Android class. ### Method POST ### Endpoint /rpc/invoke/androidHookingGetClassMethods ### Parameters #### Request Body - **className** (string) - Required - The fully qualified name of the class. ### Request Example ```bash curl -s -X POST "http://127.0.0.1:8888/rpc/invoke/androidHookingGetClassMethods" -H "Content-Type: application/json" -d '{"className": "com.reddit.frontpage.StartActivity"}' ``` ### Response #### Success Response (200) - **methods** (array of strings) - A list of method signatures. #### Response Example ```json ["static android.os.Handler com.reddit.frontpage.StartActivity.a(com.reddit.frontpage.StartActivity)","private void com.reddit.frontpage.StartActivity.a()", ...] ``` ``` -------------------------------- ### Compile and Install insert_dylib Source: https://github.com/sensepost/objection/wiki/Patching-iOS-Applications Compile the insert_dylib utility from source using xcodebuild and copy the executable to the system's bin directory. ```bash git clone https://github.com/Tyilo/insert_dylib cd insert_dylib xcodebuild cp build/Release/insert_dylib /usr/local/bin/insert_dylib ``` -------------------------------- ### Install applesign via npm Source: https://github.com/sensepost/objection/wiki/Installation Install the 'applesign' tool using npm, which is a prerequisite for iOS patching. ```bash npm install -g applesign ``` -------------------------------- ### Activate Python virtual environment Source: https://github.com/sensepost/objection/wiki/Installation Activate the created virtual environment before installing Objection. This ensures dependencies are isolated. ```bash source ~/objection-venv/bin/activate ``` -------------------------------- ### Invoke iOS Cookies Get RPC Method Source: https://github.com/sensepost/objection/wiki/API Example of calling the `iosCookiesGet` RPC method which requires no arguments. Assumes the API is running on default host and port. ```bash curl -s http://127.0.0.1:8888/rpc/invoke/iosCookiesGet ``` -------------------------------- ### Execute a Shell Command (ls) Source: https://github.com/sensepost/objection/blob/master/objection/console/helpfiles/!.txt Use the '!' command followed by a shell command to execute it. This example lists directory contents. ```console !ls ``` -------------------------------- ### List installed packages Source: https://github.com/sensepost/objection/wiki/Patching-Android-Applications Use `adb shell pm list packages` to find the package name of an installed application. ```bash $ adb shell pm list packages | grep uber package:com.ubercab ``` -------------------------------- ### Clone Mettle Repository Source: https://github.com/sensepost/objection/blob/master/plugins/mettle/README.md Clone the Mettle repository from GitHub to begin the installation process. ```bash git clone https://github.com/rapid7/mettle.git ``` -------------------------------- ### Execute a Shell Command (uname) Source: https://github.com/sensepost/objection/blob/master/objection/console/helpfiles/!.txt Use the '!' command followed by a shell command to execute it. This example displays system information. ```console !uname -a ``` -------------------------------- ### Importing a Frida script as a job Source: https://github.com/sensepost/objection/wiki/Working-with-Jobs Demonstrates how to import a Frida script and have it run as a background job. The output shows the job starting and being listed. ```bash sensepost s- iPad on (iPad: 10.2.1) [usb] # import test.js Job: 55321569-cd6b-4eb6-82a6-ef3cbc0cce88 - Starting Job: 55321569-cd6b-4eb6-82a6-ef3cbc0cce88 - Started sensepost s- iPad on (iPad: 10.2.1) [usb] # jobs list UUID Name Started ------------------------------------ ----------- ------------------- 55321569-cd6b-4eb6-82a6-ef3cbc0cce88 user-script 2017-07-09 12:05:32 ``` -------------------------------- ### Check Current Objection Version Source: https://github.com/sensepost/objection/wiki/Updating Run this command to display the currently installed version of Objection. ```bash $ objection version objection: 1.1.10 ``` -------------------------------- ### Start Objection REPL for iOS App Source: https://github.com/sensepost/objection/wiki/Using-objection Initiates the Objection REPL for a specified iOS application. Ensure the app is patched and the device is connected. ```bash $ objection -n Gadget start ``` -------------------------------- ### Install Patched IPA on Linux Source: https://github.com/sensepost/objection/wiki/Running-Patched-iOS-Applications Installs a patched and code-signed IPA file onto an iOS device from a Linux host using `ideviceinstaller`. The output shows the installation progress and the bundle identifier. ```bash $ ideviceinstaller -i my-app-frida-codesigned.ipa WARNING: could not locate iTunesMetadata.plist in archive! Copying 'my-app-frida-codesigned.ipa' to device... DONE. Installing 'com.sensepost.myapp' Install: CreatingStagingDirectory (5%) Install: ExtractingPackage (15%) Install: InspectingPackage (20%) Install: TakingInstallLock (20%) Install: PreflightingApplication (30%) Install: InstallingEmbeddedProfile (30%) Install: VerifyingApplication (40%) Install: CreatingContainer (50%) Install: InstallingApplication (60%) Install: PostflightingApplication (70%) Install: SandboxingApplication (80%) Install: GeneratingApplicationMap (90%) Install: Complete ``` -------------------------------- ### Patching IPA with Gadget Configuration Source: https://github.com/sensepost/objection/wiki/Gadget-Configurations Example command to patch an IPA file using Objection, specifying a custom gadget configuration file. ```text objection patchipa -s app.ipa --gadget-config config.json ``` -------------------------------- ### Check virtualenv Version Source: https://github.com/sensepost/objection/wiki/Installation Verify your virtualenv version. This is an optional prerequisite for virtual environment installation. ```bash virtualenv --version ``` -------------------------------- ### Install Objection in Development Mode Source: https://github.com/sensepost/objection/wiki/Development-Environment-Installation Install Objection in editable mode from the cloned directory after activating your Python virtual environment. This ensures that code changes are immediately reflected. ```bash pip3 install --editable . ``` -------------------------------- ### Find All Apktool Installations Source: https://github.com/sensepost/objection/wiki/Apktool-Upgrades The 'whereis apktool' command lists all known locations of the apktool executable and related files on your system. This helps in identifying potential conflicts or multiple installations. ```bash $ whereis apktool apktool: /usr/bin/apktool /usr/local/bin/apktool /usr/share/apktool /home/user/.local/bin/apktool /usr/share/man/man1/apktool.1.gz ``` -------------------------------- ### Create and Activate Python Virtual Environment Source: https://github.com/sensepost/objection/wiki/Development-Environment-Installation Create a new Python 3 virtual environment and activate it. This is recommended to avoid conflicts with your system's Python installation. ```bash virtualenv -p python3 ~/py3-venv source ~/py3-venv/bin/activate ``` -------------------------------- ### Example Android Logcat Output Source: https://github.com/sensepost/objection/wiki/Gadget-Configurations Sample output observed in adb logcat after patching and launching the application, showing script execution. ```text [frida-sript] D ping @ 1590572522509 D ping @ 1590572523510 D ping @ 1590572524512 D ping @ 1590572525514 D ping @ 1590572526515 ``` -------------------------------- ### Check Apktool Version Source: https://github.com/sensepost/objection/wiki/Apktool-Upgrades Verify the currently installed Apktool version using the 'apktool -version' command. This is important as Objection may have specific version requirements. ```bash $ apktool -version 2.4.1 ``` -------------------------------- ### Upgrade Objection using pip Source: https://github.com/sensepost/objection/wiki/Updating Use this command to install the latest version of Objection from PyPI. ```bash pip3 install objection --upgrade ``` -------------------------------- ### Evaluate Basic JavaScript Source: https://github.com/sensepost/objection/blob/master/objection/console/helpfiles/evaluate.txt Executes a simple JavaScript command to send a message. This is a basic example of interacting with the agent. ```bash evaluate "send({msg: 'hello'})" ``` -------------------------------- ### Run Patched iOS Application on macOS Source: https://github.com/sensepost/objection/wiki/Running-Patched-iOS-Applications Installs and runs a patched iOS application using `ios-deploy`. Ensure the IPA is extracted and the device is connected and unlocked. ```bash ios-deploy --bundle Payload/my-app.app -W -d ``` -------------------------------- ### Check Apktool Path Source: https://github.com/sensepost/objection/wiki/Apktool-Upgrades Use the 'which apktool' command to find the executable path that Objection will use. This is crucial for ensuring Objection is configured to use the intended Apktool installation. ```bash $ which apktool /usr/local/bin/apktool ``` -------------------------------- ### Run Simple Frida Script Inline Source: https://github.com/sensepost/objection/wiki/API Execute a basic Frida script directly in the request body to get the Frida version. The Content-Type must be text/javascript. ```bash $ curl -X POST -H "Content-Type: text/javascript" http://127.0.0.1:8888/script/runonce -d "send(Frida.version);" [{"payload":"12.2.5","type":"send"}] ``` -------------------------------- ### Get APK path on device Source: https://github.com/sensepost/objection/wiki/Patching-Android-Applications Use `adb shell pm path ` to determine the installation path of an APK on the Android device. ```bash $ adb shell pm path com.ubercab package:/data/app/com.ubercab-1/base.apk ``` -------------------------------- ### Invoke Android Hooking Get Class Methods RPC Method Source: https://github.com/sensepost/objection/wiki/API Example of calling the `androidHookingGetClassMethods` RPC method which requires a `className` argument. The request is made using POST with a JSON payload. ```bash curl -s -X POST "http://127.0.0.1:8888/rpc/invoke/androidHookingGetClassMethods" -H "Content-Type: application/json" -d '{"className": "com.twitter.sdk.android.tweetui.GalleryActivity"}' ``` -------------------------------- ### Objection Command Help Source: https://github.com/sensepost/objection/wiki/Using-objection Displays the available options, flags, and commands for the `objection` tool. Use this to understand the command structure and available functionalities. ```txt $ objection --help Usage: objection [OPTIONS] COMMAND [ARGS]... _ _ _ _ ___| |_|_|___ ___| |_|_|___ ___ | . | . | | -_| _| _| | . | | |___|___| |___|___|_| |_|___|_|_| |___|(object)inject(ion) Runtime Mobile Exploration by: @leonjza from @sensepost Options: -N, --network Connect using a network connection instead of USB. -h, --host TEXT [default: 127.0.0.1] -P, --port INTEGER [default: 27042] -ah, --api-host TEXT [default: 127.0.0.1] -ap, --api-port INTEGER [default: 8888] -n, --name TEXT Name or bundle identifier to attach to. -S, --serial TEXT A device serial to connect to. -d, --debug Enable debug mode with verbose output. -s, --spawn Spawn the target. -p, --no-pause Resume the target immediately. -f, --foremost Use the current foremost application. --debugger Enable the Chrome debug port. --uid TEXT Specify the uid to run as (Android only). --help Show this message and exit. Commands: api Start the objection API server in headless mode. patchapk Patch an APK with the frida-gadget.so. patchipa Patch an IPA with the FridaGadget dylib. run Run a single objection command. signapk Zipalign and sign an APK with the objection key. start Start a new session version Prints the current version and exits. ``` -------------------------------- ### Explore a Specific Gadget with Objection Source: https://github.com/sensepost/objection/wiki/Running-On-A-Rooted-Device Connect to a target application (gadget) on the device using `objection --gadget "" explore`. This command initiates an interactive exploration session. ```bash ~ » objection --gadget "com.dropbox.android" explore _ _ _ _ ___| |_ |_|___ ___| |_|_|___ ___ | . | . | | | -_| _| _| | . | | |___|___|_| |___|___|_| |_|___|_|_| |___|(object)inject(ion) Runtime Mobile Exploration by: @leonjza from @sensepost [tab] for command suggestions com.dropbox.android on (samsung: 4.4.2) [usb] # ``` -------------------------------- ### Display Environment Variables in Objection Source: https://github.com/sensepost/objection/wiki/Using-objection Use the 'env' command to list the paths for key directories like files, cache, and code cache. This helps in understanding the application's file structure. ```bash com.opera.mini.native on (samsung: 6.0.1) [usb] # env Name Path ---------------------- ------------------------------------------------------------ filesDirectory /data/user/0/com.opera.mini.native/files cacheDirectory /data/user/0/com.opera.mini.native/cache externalCacheDirectory /storage/emulated/0/Android/data/com.opera.mini.native/cache codeCacheDirectory /data/user/0/com.opera.mini.native/code_cache obbDir /storage/emulated/0/Android/obb/com.opera.mini.native packageCodePath /data/app/com.opera.mini.native-1/base.apk ``` -------------------------------- ### Common Installation Error: Python 2 vs Python 3 Source: https://github.com/sensepost/objection/wiki/Installation This error indicates you are trying to install Objection with Python 2. Use 'pip3' or ensure you are using a Python 3 interpreter. ```bash pip install objection ``` -------------------------------- ### Objection PatchAPK Help Output Source: https://github.com/sensepost/objection/wiki/Gadget-Configurations Help text for the objection patchapk command, highlighting the --gadget-config and --script-source flags. ```text $ objection patchapk --help Usage: objection patchapk [OPTIONS] Patch an APK with the frida-gadget.so. Options: [ ... ] -c, --gadget-config TEXT The gadget configuration file to use. Refer to https://frida.re/docs/gadget/ for more information. -l, --script-source TEXT A script file to use with the the "path" config type. Specify "libfrida- gadget.script.so" as the "path" in your config. [ ... ] ``` -------------------------------- ### Display Application Environment Variables Source: https://github.com/sensepost/objection/wiki/Using-objection Prints the paths for various important directories related to the application, such as Documents, Library, and Caches. This command helps in understanding the application's file structure. ```bash com.sensepost.ipewpew on (iPad: 10.2.1) [usb] # env ``` -------------------------------- ### GET /rpc/invoke/ Source: https://github.com/sensepost/objection/wiki/API Invokes a remote procedure call (RPC) method using a GET request. The method name is specified in the endpoint path. This method may be used for simple calls without arguments. ```APIDOC ## GET /rpc/invoke/ ### Description Invokes a specified RPC method using an HTTP GET request. The method name is part of the URL. This is typically used for methods that do not require arguments. ### Method GET ### Endpoint /rpc/invoke/ ### Parameters #### Path Parameters - **method name** (string) - Required - The name of the RPC method to invoke. ### Response #### Success Response (200) - **(any)** - The result of the RPC method execution. The format depends on the invoked method. ### Request Example ```bash curl http://127.0.0.1:8888/rpc/invoke/someMethodWithoutArgs ``` ### Response Example ```json { "result": "some value" } ``` ``` -------------------------------- ### List packages with paths Source: https://github.com/sensepost/objection/wiki/Patching-Android-Applications Use `adb shell pm list packages -f -3` to list third-party packages along with their paths on the device. ```bash $ adb shell pm list packages -f -3 | cut -d "=" -f1 | grep uber ``` -------------------------------- ### Create a Python virtual environment Source: https://github.com/sensepost/objection/wiki/Installation Create an isolated Python virtual environment for Objection. This is the recommended approach for managing dependencies. ```bash python3 -m venv ~/objection-venv ``` -------------------------------- ### Build Mettle for Target Architecture Source: https://github.com/sensepost/objection/blob/master/plugins/mettle/README.md Build the Mettle framework for your specific target architecture using the provided Makefile. Replace 'aarch64-iphone-darwin' with your desired target. ```bash make TARGET=aarch64-iphone-darwin ``` -------------------------------- ### Upgrade virtualenv Source: https://github.com/sensepost/objection/wiki/Installation Upgrade virtualenv to the latest version if necessary. This is an optional prerequisite for virtual environment installation. ```bash pip install virtualenv --upgrade ``` -------------------------------- ### List Android Activities using RPC Source: https://github.com/sensepost/objection/wiki/API Demonstrates how to list activities in an Android application by invoking the `androidHookingListActivities` RPC method. Assumes the API is running. ```bash $ curl -s "http://127.0.0.1:8888/rpc/invoke/androidHookingListActivities" ["com.reddit.frontpage.StartActivity","com.reddit.frontpage.IntroductionActivity", ... snip ...] ``` -------------------------------- ### Navigate and List Directory Contents Source: https://github.com/sensepost/objection/wiki/Using-objection Change directory to the application's Documents folder and list its contents to identify files and their properties. ```bash com.sensepost.ipewpew on (iPad: 10.2.1) [usb] # cd /var/mobile/Containers/Data/Application/6CDB1F03-8747-42DE-8376-C4008A2E0731/Documents /var/mobile/Containers/Data/Application/6CDB1F03-8747-42DE-8376-C4008A2E0731/Documents com.sensepost.ipewpew on (iPad: 10.2.1) [usb] # ls NSFileType Perms NSFileProtection Read Write Owner Group Size Creation Name ------------ ------- ------------------------------------ ------ ------- ------------ ------------ -------- ------------------------- --------------------------------- Regular 420 CompleteUntilFirstUserAuthentication True True mobile (501) mobile (501) 4.0 B 2017-09-04 13:47:08 +0000 api.db Regular 420 None True True mobile (501) mobile (501) 4.0 B 2017-09-04 13:48:49 +0000 bar.png Regular 420 CompleteUnlessOpen True True mobile (501) mobile (501) 4.0 B 2017-09-04 13:44:27 +0000 blueprint.txt Regular 420 CompleteUntilFirstUserAuthentication True True mobile (501) mobile (501) 275.0 B 2017-09-15 09:43:25 +0000 credentials.plist Regular 420 CompleteUntilFirstUserAuthentication True True mobile (501) mobile (501) 12.0 KiB 2017-08-10 09:50:08 +0000 pewpew.sqlite Regular 420 Complete True True mobile (501) mobile (501) 4.0 B 2017-09-04 13:42:57 +0000 secret.txt Readable: Yes Writable: Yes ``` -------------------------------- ### Repack APK with Apktool Source: https://github.com/sensepost/objection/wiki/Android-APK-Patching Use apktool to build a new APK from a directory. This is used after manual modifications. ```bash apktool build temp/ -o new.apk ``` -------------------------------- ### Objection PatchIPA Help Output Source: https://github.com/sensepost/objection/wiki/Gadget-Configurations Help text for the objection patchipa command, highlighting the --gadget-config and --script-source flags. ```text $ objection patchipa --help [ ... ] -C, --gadget-config TEXT The gadget configuration file to use. Refer to https://frida.re/docs/gadget/ for more information. -l, --script-source TEXT A script file to use with the the "path" config type. Remember that use the name of this file in your "path". It will be next to the config. ``` -------------------------------- ### Listing active jobs Source: https://github.com/sensepost/objection/wiki/Working-with-Jobs Demonstrates how to list all currently running jobs in the Objection REPL. This command is useful for monitoring background tasks. ```bash sensepost s- iPad on (iPad: 10.2.1) [usb] # jobs list UUID Name Started ------------------------------------ ------------------------------- ------------------- cf1c8381-5c55-4658-b9fd-2dff56c320d5 simulate-jailbroken-environment 2017-07-09 11:38:51 27c38e53-4c3e-468b-8948-5c5a31dbc7d2 pasteboard-monitor 2017-07-09 11:58:06 ``` -------------------------------- ### Execute a method on an Android heap object Source: https://github.com/sensepost/objection/blob/master/objection/console/helpfiles/android.heap.execute.txt Executes the 'toString' method on the Java object identified by handle '0x12345678'. This is a basic example of method invocation. ```bash android heap execute 0x12345678 toString ``` -------------------------------- ### Load Mettle Plugin in Objection Source: https://github.com/sensepost/objection/blob/master/plugins/mettle/README.md Load the Mettle plugin into Objection after placing the codesigned dylib in the plugin directory. This command will upload the dylib to the device. ```bash plugin mettle load ``` -------------------------------- ### Inspect Plist File Content Locally Source: https://github.com/sensepost/objection/wiki/Using-objection Use the 'cat' command on the local filesystem to view the content of a downloaded plist file. ```bash com.sensepost.ipewpew on (iPad: 10.2.1) [usb] # !cat creds.plist Running OS command: cat creds.plist password snek username bob ``` -------------------------------- ### Search iOS Methods using RPC Source: https://github.com/sensepost/objection/wiki/API Demonstrates searching for methods in an iOS application using the `iosHookingSearchMethods` RPC method with a JSON payload. Assumes the API is running. ```bash $ curl -s -X POST "http://127.0.0.1:8888/rpc/invoke/iosHookingSearchMethods" -H "Content-Type: application/json" -d '{"partial": "jail"}' ["[JailbreakDetection + isJailbroken]","[UIScreen + _shouldDisableJail]", ... snip ...] ``` -------------------------------- ### Build the Agent Source: https://github.com/sensepost/objection/wiki/Agent-Development-Environment Compile the TypeScript source code into an ES5 compatible JavaScript agent. This command may run automatically after 'npm install' depending on your npm version. ```bash npm run build ``` -------------------------------- ### Launch Activity on Android Source: https://github.com/sensepost/objection/wiki/Using-objection Invoke an Android activity using the `android intent launch_activity` command, followed by the activity's class name. This is useful for testing or interacting with specific application components. ```bash com.opera.mini.native on (samsung: 6.0.1) [usb] # android intent launch_activity com.facebook.ads.AudienceNetworkActivity Launching Activity: com.facebook.ads.AudienceNetworkActivity... ``` -------------------------------- ### Get Android Class Methods using RPC Source: https://github.com/sensepost/objection/wiki/API Shows how to retrieve methods for a specific Android activity class by invoking the `androidHookingGetClassMethods` RPC method with a JSON payload. Assumes the API is running. ```bash $ curl -s -X POST "http://127.0.0.1:8888/rpc/invoke/androidHookingGetClassMethods" -H "Content-Type: application/json" -d '{"className": "com.reddit.frontpage.StartActivity"}' ["static android.os.Handler com.reddit.frontpage.StartActivity.a(com.reddit.frontpage.StartActivity)","private void com.reddit.frontpage.StartActivity.a()", ... snip ...] ``` -------------------------------- ### Explore Application with Objection Source: https://github.com/sensepost/objection/wiki/Running-On-A-Jailbroken-Device Connect to a specific application on a jailbroken device using Objection by specifying its bundle ID with the `--gadget` flag. This command launches the Objection exploration interface for the target application. ```bash ~ » objection --gadget "com.apple.AppStore" explore _ _ _ _ ___| |_ |_|___ ___| |_|_|___ ___ | . | . | | | -_| _| _| | . | | |___|___|_| |___|___|_| |_|___|_|_| |___|(object)inject(ion) Runtime Mobile Exploration by: @leonjza from @sensepost [tab] for command suggestions com.apple.AppStore on (iPad: 8.1) [usb] # ``` -------------------------------- ### RPC Invoke Endpoint Source: https://github.com/sensepost/objection/wiki/API The /rpc/invoke/ endpoint allows direct invocation of RPC methods exposed by the Frida agent. Use GET for methods without arguments and POST for methods with arguments, providing arguments as a JSON payload. ```APIDOC ## GET /rpc/invoke/ ### Description Invokes an RPC method exposed by the Frida agent that does not require any arguments. ### Method GET ### Endpoint /rpc/invoke/ ### Parameters None ### Request Example ```bash curl -s http://127.0.0.1:8888/rpc/invoke/iosCookiesGet ``` ### Response #### Success Response (200) - **result** (any) - The result of the RPC method invocation. ### Response Example ```json { "result": "[...]" } ``` ## POST /rpc/invoke/ ### Description Invokes an RPC method exposed by the Frida agent that requires arguments. Arguments must be provided as a JSON payload. ### Method POST ### Endpoint /rpc/invoke/ ### Parameters #### Request Body - **arguments** (object) - Required - A JSON object containing the arguments for the RPC method. ### Request Example ```bash curl -s -X POST "http://127.0.0.1:8888/rpc/invoke/androidHookingGetClassMethods" -H "Content-Type: application/json" -d '{"className": "com.twitter.sdk.android.tweetui.GalleryActivity"}' ``` ### Response #### Success Response (200) - **result** (any) - The result of the RPC method invocation. #### Response Example ```json { "result": "[...]" } ``` ``` -------------------------------- ### Update Apktool using Curl Source: https://github.com/sensepost/objection/wiki/Apktool-Upgrades Manually download and install the latest Apktool JAR file by using curl to fetch it from the official Bitbucket repository and save it to a location in your PATH. This method is useful when OS package managers do not provide the latest version. ```bash $ curl -fsSL https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.4.1.jar -o /usr/local/bin/apktool ``` -------------------------------- ### List Processes on a Rooted Device Source: https://github.com/sensepost/objection/wiki/Running-On-A-Rooted-Device Use `frida-ps -U` to list all running processes on a connected rooted Android device. The 'Name' column indicates potential targets for Objection. ```bash ~ » frida-ps -U PID Name ----- --------------------- 3637 actlmand 3641 adbd 4750 android.process.acore 10850 android.process.media 3667 androidshmservice 3577 apaservice 64562 com.dropbox.android 3632 at_distributor ``` -------------------------------- ### List Processes on Jailbroken Device Source: https://github.com/sensepost/objection/wiki/Running-On-A-Jailbroken-Device Use `frida-ps -Uia` to list all running processes on a jailbroken device connected via USB. The 'Identifier' column shows the application's bundle ID, which is used as a 'Gadget' name in Objection. ```bash $ frida-ps -Uia PID Name Identifier --- ---------------- --------------------------- - App Store com.apple.AppStore - Calendar com.apple.mobilecal - Camera com.apple.camera ``` -------------------------------- ### Run Patched iOS Application Source: https://github.com/sensepost/objection/wiki/Running-Patched-iOS-Applications Use this command to launch a patched iOS application. Specify the bundle identifier of the app as the final argument. ```bash idevicedebug -d run com.sensepost.myapp ``` -------------------------------- ### Change Directory and List Contents in Objection Source: https://github.com/sensepost/objection/wiki/Using-objection Navigate to a specific directory using the 'cd' command and then use 'ls' to view its contents. This is useful for exploring different parts of the application's file system. ```bash com.opera.mini.native on (samsung: 6.0.1) [usb] # cd /data/user/0/com.opera.mini.native/cache /data/user/0/com.opera.mini.native/cache com.opera.mini.native on (samsung: 6.0.1) [usb] # ls Type Last Modified Read Write Hidden Size Name --------- ----------------------- ------ ------- -------- ------ ---------------------------- Directory 2017-09-05 14:03:41 GMT True True False 4.0 KiB crash_dumps Directory 2017-09-05 14:03:42 GMT True True False 4.0 KiB webviewAppCache Directory 2017-09-05 14:03:42 GMT True True False 4.0 KiB webviewDatabases Directory 2017-09-15 09:48:55 GMT True True False 4.0 KiB turboproxy File 2017-09-05 14:03:51 GMT True True False 64.0 B fhash.dat Directory 2017-09-05 14:03:53 GMT True True False 4.0 KiB uil-images Directory 2017-09-11 08:18:07 GMT True True False 4.0 KiB obml Directory 2017-09-05 14:03:59 GMT True True False 4.0 KiB mini_images File 2017-09-05 14:04:05 GMT True True False 59.3 KiB 1493867303508.tmp Directory 2017-09-11 12:12:08 GMT True True False 4.0 KiB volley Directory 2017-09-15 09:49:04 GMT True True False 4.0 KiB org.chromium.android_webview File 2017-09-05 14:04:18 GMT True True False 521.0 B -721711023.png File 2017-09-08 09:06:10 GMT True True False 952.0 B raw1084510070dex ``` -------------------------------- ### Plugin Implementation Dictionary Structure Source: https://github.com/sensepost/objection/wiki/Plugins Defines the basic structure for the 'implementation' dictionary in a plugin, specifying metadata and sub-commands. ```text // Dictionary root { 'meta': 'Work with Frida version information', 'commands': SUB_COMMANDS } ``` ```text // SUB_COMMANDS { { 'command_name': { 'meta': 'Short information about the command', 'exec': module.function # module method to call for this command } } ``` -------------------------------- ### Verify APK pull Source: https://github.com/sensepost/objection/wiki/Patching-Android-Applications Use `ls` to confirm that the APK file has been successfully downloaded to your local directory. ```bash $ ls com.ubercab.apk com.ubercab.apk ```