{"id":17183372,"url":"https://github.com/teodutu/sandbox-graph-comparator","last_synced_at":"2025-06-11T01:36:49.669Z","repository":{"id":121179055,"uuid":"330434708","full_name":"teodutu/Sandbox-Graph-Comparator","owner":"teodutu","description":"A comparator for Apple sandbox profiles","archived":false,"fork":false,"pushed_at":"2021-07-08T09:28:55.000Z","size":38,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-25T02:40:33.756Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/teodutu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-01-17T16:27:09.000Z","updated_at":"2021-07-08T09:28:58.000Z","dependencies_parsed_at":null,"dependency_job_id":"13d79330-d8fa-4dd9-afba-bc1f06d047b7","html_url":"https://github.com/teodutu/Sandbox-Graph-Comparator","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/teodutu%2FSandbox-Graph-Comparator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/teodutu%2FSandbox-Graph-Comparator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/teodutu%2FSandbox-Graph-Comparator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/teodutu%2FSandbox-Graph-Comparator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/teodutu","download_url":"https://codeload.github.com/teodutu/Sandbox-Graph-Comparator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/teodutu%2FSandbox-Graph-Comparator/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259181906,"owners_count":22818029,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-15T00:40:23.558Z","updated_at":"2025-06-11T01:36:49.650Z","avatar_url":"https://github.com/teodutu.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Sandbox-Graph-Comparator\nA comparator for Apple Sandbox profiles\n\nCompares an *iOS* SBPL Sandbox Profile against its decompiled form, provided by\n[SandBlaster](https://github.com/malus-security/sandblaster). The profiles are\ncompiled as graphs and a `diff`-like output with missing rules and filters is\nprinted. The graph representation of the SBPL profile is obtained using\n[SandScout](https://github.com/malus-security/sandscout).\n\n\n## Running the script\nFirst, you'll need to initialise the two submodules:\n```bash\n$ cd sandblaster\n$ git submodule init\n$ cd ../sandscout\n$ git submodule init\n```\n\nThen you can run `compare_profiles.py` by providing it with 2 input files: one\noriginal *SBPL* and another bianry profile. One example is:\n```bash\npython3 compare_profiles.py -o original.sbpl -d profile.bin -r 8.4 --ops sb_ops\n```\n\nAlternatively, if the binary profile has been previously decompiled to *SBPL*,\nthe decompilation step can be skipped (and the running time reduced) by merely\nparsing the resulting *SBPL* file using\n[SandScout](https://github.com/malus-security/sandscout) once more. In order to\ndo this, pass the `--sbpl` parameter to the script, as shown in the example\nbelow:\n```bash\npython3 compare_profiles.py -o original.sbpl -d decompiled.sbpl --sbpl\n```\n\n### Comparing all profiles in an iOS version\nIn order to validate all profiles in an *iOS* release, you first need the\nfollowing hierarchy:\n```\nsamples\n├── \u003crelease_less_than_ios9\u003e\n│   ├── reversed_profiles/\n|       ├── a.sb\n|       ├── b.sb\n|       ...\n|       └── x.sb\n│   ├── binary_profiles\n|       ├── a.bin\n|       ├── b.bin\n|       ...\n|       └── x.bin\n|   └── sb_ops\n├── \u003crelease_more_than_ios9\u003e\n│   ├── reversed_profiles\n|       ├── a.sb\n|       ├── b.sb\n|       ...\n|       └── x.sb\n│   ├── sandbox_bundle\n|   └── sb_ops\n├── ...\n\n```\nThen, call the script `compare_all_profiles.sh` and provide it with the name of\nthe release and *iOS* version like so:\n```bash\n./compare_all_profiles.sh iPhone5,1_9.3_13E237 9.3\n```\n\nThe script will create (if it doesn't already exist) a `diffs/\u003crelease\u003e` folder\ninside the `samples` directory, where the would-be differences between the\ncompiled and decompiled profiles would be found:\n\n```\nsamples/\n├── diffs\n│   └── \u003crelease\u003e\n│       ├── a.diff\n│       ├── b.diff\n│       ├── ...\n│       └── x.diff\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fteodutu%2Fsandbox-graph-comparator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fteodutu%2Fsandbox-graph-comparator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fteodutu%2Fsandbox-graph-comparator/lists"}