How to perform iOS Code Injection on your favourite iOS App. The slides will show you the tools you need to mod iOS .ipa files. This presentation was featured on https://www.meetup.com/Singapore-iOS-Dev-Scout-Meetup/events/235120178/ Check out the presentation video to view the steps we took to mod the PokemonGo App. Demo Codes are found here https://github.com/depoon/iOSDylibInjectionDemo

1. Image from http://dyci.github.io/
iOS Dynamic Library
Injection
- Kenneth Poon

2. •Technical Lead iOS Engineer @ PropertyGuru
•Agile, Xtreme Programming, Tests
•XCUITest+Gherkin (July 2016)

3. Agenda
• Short story of me engaging in PokemonGo
• Game plan for creating iOS Mod Apps
• Demo of Code Injection

4. Trying to beat the game
6 Aug 2016
- 9 am Discovered PokemonGo is live
- 12 pm Started Location Spoofing
A Week Later
- Built my own location spoof Mac App
- Integration Go Radar Api
- Requires Direct XCode-Device Wired
Connection

5. Trying to beat the game

6. How to install this PokemonGo Mod?
http://pokemongohacks.me/

7. How to install this PokemonGo Mod?
Mod Ipa
Cydia
Impactor
• Cydia Impactor is a tool that resigns and install apps
onto devices
• Works with non-jailbroken devices
• Downloadable at http://www.cydiaimpactor.com/
Apple Dev
Account
Non-JB

8. How to install this PokemonGo Mod?
DEMO

9. Hmmm Whats That?

10. Concepts - Code Injection
Investigative To Introduce Behaviour Change
• Code Injection Attacks Examples
- SQL Injection / XML Injection
- HTML Script / Command Injection

11. Concepts - Dynamic Library / Binary
• XCode compiles Apps statically
• Highlights Compilation Errors for codes in project that
cannot be statically linked
• During Build Phase, Xcode links project with external
binaries and perform necessary checks.
• However at packaging phase, Xcode does not
guarantee all dependencies will be available during run
time
dyld: Library not loaded: @rpath/libswift_stdlib_core.dylib

12. Concepts - Dynamic Library / Binary

13. Concepts - Dynamic Library / Binary
• Static Library - a unit of code linked at compile time.
[Cant use this]
• Dynamic library - a unit of code and/or assets linked at
runtime that may change
[We can use this]
• Load Dylib command needs to be executed on the .ipa
package before the final package/signing of the app

14.
Non-JB
Game plan for creating iOS Mod Apps
Cydia
Impactor
Apple Dev
Account
Original Ipa
Custom
Dylib
Patched Ipa
Patched Ipa
+
Patching
You may need to download cracked from 3rd Party content
providers like www.iphonecake.com

15. Dynamic Library Injection
DEMO
https://github.com/depoon/iOSDylibInjectionDemo