https://github.com/corellium/ios_persistence_mapping

Accompanying code for blog post "Mapping iOS Persistence Attack Surface using Corellium"
https://github.com/corellium/ios_persistence_mapping

Last synced: about 1 month ago
JSON representation

Accompanying code for blog post "Mapping iOS Persistence Attack Surface using Corellium"

• Host: GitHub
• URL: https://github.com/corellium/ios_persistence_mapping
• Owner: corellium
• Created: 2022-07-27T14:51:12.000Z (over 2 years ago)
• Default Branch: main
• Last Pushed: 2022-08-23T17:07:22.000Z (over 2 years ago)
• Last Synced: 2024-08-03T01:25:24.130Z (4 months ago)
• Language: Python
• Size: 151 KB
• Stars: 9
• Watchers: 2
• Forks: 1
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-rainmana - corellium/ios_persistence_mapping - Accompanying code for blog post "Mapping iOS Persistence Attack Surface using Corellium" (Python)

README

        
# Mapping iOS Persistence Attack Surface using Corellium

Accompanying code for a [blog post](https://www.corellium.com/blog/mapping-ios-persistence).

This repository contains a `uniq_opens.txt` file as generated in the blog post. Replace this file if new data is generated.

## Setup

1. Install Neo4J Desktop or create [AuraDB](https://neo4j.com/cloud/platform/aura-graph-database/) instance

2. Run `brew install libmagic`

3. Run `python3 -m pip install -r requirements.txt` in the project root

4. Run `npm install` in the project root

5. Download and unpack the target IPSW and mount the root filesystem

6. Run `diskutil enableOwnership /Volumes//Volumes/SkyF19F77.D10D101D20D201OS` (or whatever the actual mount point is)

7. Edit the `process_opens.py` script so that `ROOT_FS_PATH` is the mount point of the filesystem

8. Edit the `process_opens.py` script to fill in the Neo4J credentials/host

9. Copy `config.json.example` to `config.json` and fill in the Corellium credentials, project name, and device UUID

10. Invoke the script: `sudo python3 process_opens.py` (as root because we enable permissions on the FS)

Once complete, validate that the data imported successfully by running this Cypher query in the Neo4J Browser:

```

MATCH (p:Process) RETURN p

```