Skip to content

iOS Platform Guide

This guide covers iOS-specific setup, considerations, and best practices for using friTap on iOS devices.

Prerequisites

Device Requirements

  • Jailbroken iOS device (required for friTap operation)
  • iOS 12.0+ (minimum supported version)
  • ARM64 architecture (iPhone 5s and newer)
  • SSH access or USB connection
  • Cydia/Sileo package manager installed

Development Machine Setup

# Install required tools
# macOS (recommended)
brew install usbmuxd
brew install libimobiledevice

# Linux
sudo apt install usbmuxd libimobiledevice-tools

# Install frida-tools
pip3 install frida-tools

Device Setup

Jailbreak Requirements

Jailbreak Requirement

friTap requires a jailbroken iOS device to function. Ensure your device is jailbroken with a compatible jailbreak tool.

Supported Jailbreaks: - checkra1n (iOS 12.0-14.8.1) - unc0ver (iOS 11.0-14.8) - Taurine (iOS 14.0-14.3) - Odyssey (iOS 13.0-13.7)

Install Frida on iOS

# Method 1: Via Cydia/Sileo
# Add Frida repository: https://build.frida.re
# Install "Frida" package

# Method 2: Manual installation via SSH
ssh root@<device-ip>
apt update
apt install re.frida.server

SSH Setup (Optional)

# Install OpenSSH via Cydia/Sileo
# Default credentials (CHANGE IMMEDIATELY):
# Username: root
# Password: alpine

# Connect to device
ssh root@<device-ip>

# Change default password
passwd root

USB Connection Setup

# Forward port for USB connection
iproxy 27042 27042

# Verify connection
frida-ls-devices
# Should show your iOS device

Frida Server Management

Starting Frida Server

# Method 1: SSH connection
ssh root@<device-ip>
frida-server &

# Method 2: USB connection with iproxy
iproxy 27042 27042 &
frida-server &

# Method 3: Using frida-tools
frida-ls-devices  # Auto-starts server if needed

Verify Server Status

# Check if frida-server is running
frida-ls-devices

# List running processes
frida-ps -U

# List installed applications
frida-ps -Ua

friTap Usage on iOS

Basic Analysis

# Extract TLS keys from iOS app
fritap -m -k keys.log com.example.app

# Capture decrypted traffic
fritap -m --pcap traffic.pcap --json metadata.json com.example.app

# Verbose analysis
fritap -m -v -do com.example.app

App Identification

# List running apps
frida-ps -Ua

# Find specific app
frida-ps -Ua | grep -i instagram

# Use bundle identifier
fritap -m com.burbn.instagram

Spawn Mode Analysis

# Start app fresh under friTap control
fritap -m -s -k keys.log --pcap traffic.pcap com.example.app

# This captures app initialization traffic

iOS-Specific Considerations

App Store Applications

# Most App Store apps use system SSL libraries
fritap -m -k keys.log com.apple.mobilesafari

# Some apps may use custom SSL implementations
fritap -m --patterns ios_patterns.json com.example.app

System Applications

# Analyze Safari
fritap -m -k safari_keys.log com.apple.mobilesafari

# Analyze Mail app
fritap -m -k mail_keys.log com.apple.mobilemail

# Analyze Messages
fritap -m -k messages_keys.log com.apple.MobileSMS

Third-Party Applications

# Social media apps
fritap -m -k instagram_keys.log com.burbn.instagram
fritap -m -k whatsapp_keys.log net.whatsapp.WhatsApp

# Banking apps (use test accounts only)
fritap -m -k banking_keys.log com.example.bankapp

# Enterprise apps
fritap -m -k enterprise_keys.log com.company.app

SSL/TLS Libraries on iOS

Common iOS SSL Libraries

SecureTransport (Apple's SSL/TLS): 

# Most iOS apps use SecureTransport
fritap -m -v com.example.app | grep -i securetransport

Network.framework: 

# Modern iOS apps may use Network.framework
fritap -m -v com.example.app | grep -i network

Third-party Libraries: 

# Some apps use OpenSSL/BoringSSL
fritap -m --patterns openssl_patterns.json com.example.app

# Apps with custom SSL
fritap -m --offsets custom_offsets.json com.example.app

Library Detection

# Debug library detection
fritap -m -do -v com.example.app

# Look for SSL-related output in logs
fritap -m -v com.example.app 2>&1 | grep -i ssl

Certificate Pinning on iOS

Detecting Certificate Pinning

# Standard analysis (may fail with pinning)
fritap -m -k keys.log com.example.pinned_app

# If no traffic captured, pinning may be active
fritap -m -do -v com.example.pinned_app

Bypassing Certificate Pinning

# Use spawn mode for early hooking
fritap -m -s -k keys.log com.example.pinned_app

# Enable default socket information
fritap -m --enable_default_fd com.example.pinned_app

# Use SSL Kill Switch (install via Cydia)
# Then run normal analysis
fritap -m -k keys.log com.example.pinned_app

Manual Pinning Bypass

# Install SSL Kill Switch 2 from Cydia
# Or use Frida scripts for pinning bypass

# Custom Frida script for pinning bypass
fritap -m --custom_script bypass_pinning.js com.example.app

Troubleshooting iOS Issues

Connection Problems

# Device not detected
frida-ls-devices

# Restart usbmuxd (macOS/Linux)
sudo pkill usbmuxd
sudo usbmuxd

# Restart frida-server on device
ssh root@<device-ip>
killall frida-server
frida-server &

Frida Server Issues

# Check if frida-server is running
ssh root@<device-ip>
ps aux | grep frida-server

# Restart frida-server
killall frida-server
frida-server &

# Check for port conflicts
netstat -an | grep 27042

App Analysis Issues

# App crashes on hook
fritap -m --no-spawn com.example.app

# Use gentler approach
fritap -m -k keys.log com.example.app

# Check app permissions
frida-ps -Ua | grep com.example.app

Memory and Performance

# Monitor memory usage
ssh root@<device-ip>
top -u mobile

# Reduce analysis overhead
fritap -m --timeout 60 com.example.app

# Target specific functions only
fritap -m --offsets minimal_offsets.json com.example.app

iOS-Specific Features

Keychain Analysis

# Some apps store certificates in Keychain
# Use additional tools for Keychain analysis
fritap -m -k keys.log --json metadata.json com.example.app

# Check for Keychain-related SSL usage
cat metadata.json | jq '.libraries_detected[] | select(.name | contains("Security"))'

Background App Analysis

# Analyze background app refresh
fritap -m --enable_spawn_gating com.example.app

# Monitor background network activity
fritap -m -k background_keys.log com.example.app &
# Switch app to background and monitor

App Extensions Analysis

# Analyze app extensions (widgets, keyboards, etc.)
fritap -m com.example.app.extension

# Monitor extension communications
fritap -m --enable_spawn_gating com.example.app

Advanced iOS Analysis

Multi-App Analysis

# Analyze multiple apps simultaneously
fritap -m --enable_spawn_gating -k all_keys.log &

# Then launch various apps to capture their traffic

System-Level Analysis

# Analyze system-wide SSL traffic (careful!)
fritap -m --enable_spawn_gating -k system_keys.log launchd

# Monitor specific system services
fritap -m com.apple.springboard

Enterprise and MDM Analysis

# Analyze MDM communications
fritap -m -k mdm_keys.log com.apple.managedconfiguration

# Enterprise app analysis
fritap -m -k enterprise_keys.log --json enterprise_data.json com.company.app

Security Considerations

Device Security

  • Keep jailbreak tools updated
  • Change default SSH passwords
  • Use secure networks for analysis
  • Disable unnecessary services

Analysis Safety

# Use test accounts for sensitive apps
# Avoid production banking/financial apps
# Document all analysis activities
# Maintain device backups
  • Only analyze apps you own or have permission to test
  • Respect app store terms of service
  • Follow responsible disclosure for vulnerabilities
  • Comply with local laws and regulations

Integration with Other Tools

Wireshark Integration

# Real-time analysis with Wireshark
fritap -m -l com.example.app

# Open Wireshark and connect to named pipe

Burp Suite Integration

# Capture traffic for Burp analysis
fritap -m --pcap api_traffic.pcap com.example.app

# Configure device proxy settings for Burp

Custom Analysis Tools

# Export data for custom analysis
fritap -m --json analysis_data.json com.example.app

# Process with custom scripts
python analyze_ios_data.py analysis_data.json

Best Practices for iOS Analysis

1. Device Preparation

# Always start with clean device state
# Remove previous analysis artifacts
# Ensure stable jailbreak environment

2. Analysis Methodology

# Start with basic analysis
fritap -m -k keys.log com.example.app

# Progress to comprehensive analysis
fritap -m -k keys.log --pcap traffic.pcap --json metadata.json com.example.app

3. Data Management

# Organize analysis data
mkdir ios_analysis_$(date +%Y%m%d)
cd ios_analysis_$(date +%Y%m%d)

# Run analysis with organized output
fritap -m -k app_keys.log --pcap app_traffic.pcap --json app_metadata.json com.example.app

4. Documentation

# Document device state
uname -a > device_info.txt
frida --version >> device_info.txt

# Document app version
frida-ps -Ua | grep com.example.app >> app_info.txt

Common iOS App Categories

Social Media Apps

# Instagram
fritap -m -k instagram_keys.log com.burbn.instagram

# Twitter
fritap -m -k twitter_keys.log com.atebits.Tweetie2

# TikTok
fritap -m -k tiktok_keys.log com.zhiliaoapp.musically

Communication Apps

# WhatsApp
fritap -m -k whatsapp_keys.log net.whatsapp.WhatsApp

# Signal
fritap -m -k signal_keys.log org.whispersystems.signal

# Telegram
fritap -m -k telegram_keys.log ph.telegra.Telegraph

Financial Apps

# Use test accounts only
fritap -m -k banking_keys.log com.example.bank

# PayPal (test environment)
fritap -m -k paypal_keys.log com.paypal.ppmobile

Gaming Apps

# Mobile games with networking
fritap -m -k game_keys.log com.example.game

# Monitor game server communications
fritap -m --pcap game_traffic.pcap com.example.mmorpg

Next Steps