stefanesser / dumpdecrypted Goto Github PK

dyld: Library not loaded: @rpath/QNBAutomatic.framework/QNBAutomatic
Referenced from: /var/mobile/Containers/Bundle/Application/518463AE-6083-4D1E-9F98-2E10C11CBE95/live4iphone.app/live4iphone
Reason: image not found
Trace/BPT trap: 5

dumpdecrypted.dylib: missing LC_DYLD_INFO load command

new frida dump tool, no environment is required，support(win,macos,linux)

fd bagbak 通讯录

https://github.com/a97077088/fd

My iPhone is iPhone5 (ios 8.1).The CPU used ARMV7. How i decrypted the X64 Mach-o?

I do modify the Makefile based on my iPhone SDK. Compiling with make was perfect. But, while executing the dumpdecrypted.dylib I get the following error.

dyld: warning: could not load inserted library 'dumpdecrypted.dylib' into hardened process because no suitable image found.
Did find:
dumpdecrypted.dylib: code signature in (dumpdecrypted.dylib) not valid for use in process using Library Validation: mapped file has no cdhash, completely unsigned? Code has to be at least ad-hoc signed.

Hi! Trying to use your great utility on iOS 9 and getting this message:

dyld: could not load inserted library '/var/mobile/Media/dumpdecrypted.dylib' because no suitable image found.  Did find:
/var/mobile/Media/dumpdecrypted.dylib: open() failed with errno=1

Trace/BPT trap: 5

Is there a way to fix it?

dyld: warning: could not load inserted library 'dumpdecrypted.dylib' into hardened process because no suitable image found. Did find:
dumpdecrypted.dylib: missing LC_DYLD_INFO load command
/private/var/mobile/Containers/Data/Application/A94731D0-A0A1-4006-9A2F-F7739BB1F417/Documents/dumpdecrypted.dylib: missing LC_DYLD_INFO load command
Abort trap: 6

root# DYLD_INSERT_LIBARIES=dumpdecrypted.dylib /var/containers/Bundle/Application/4C7D2442-98A2-471F-AACE-964956B50EFE/XinRen.app/XinRen
dyld: warning, unknown environment variable: DYLD_INSERT_LIBARIES
Abort trap: 6

iPhone6, iOS12.4.4, macOS Catalina 10.15.4, xcode11.5

That would be great!

i have generated dumpdecrypted.dylib file using make command on macOSX. I have copied the file to Library/ folder on jailbroken iphone running IOS 8.4. I am trying to install tools on iRET and this is the only one left. Need help

iPhone:~ root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/BAEEB385-FB00-4C99-81CF-F64F7D4B124A/LTao4iPhone.app/LTao4iPhone

dyld: Symbol not found: ___chkstk_darwin
Referenced from: dumpdecrypted.dylib
Expected in: /usr/lib/libSystem.B.dylib
in dumpdecrypted.dylib
Trace/BPT trap: 5

iPhone5s, iOS8.4, macOS Catalina 10.15, xcode11.1

how to solve the problem

[+] detected 32bit ARM binary in memory.
[+] offset to cryptid found: @0x53a78(from 0x53000) = a78
[+] Found encrypted data at address 00004000 of length 2490368 bytes - type 1.
[+] Opening /private/var/mobile/Containers/Bundle/Application/2B3C550D-FAA1-4C2B-A85B-FCA241FA16BA/my.app/my for reading.
[+] Reading header
[+] Detecting header type
[+] Executable is a FAT image - searching for right architecture
[+] Correct arch is at offset 16384 in the file
[+] Opening MobileTicket.decrypted for writing.
[-] Failed opening. Most probably a sandbox issue. Trying something different.
[+] Opening /private/var/mobile/Containers/tmp/my.decrypted for writing.
[-] Failed opening: Operation not permitted

failed to decrypt the app, the device is iPhone 4S, iOS 8.4.

Is this compatible with ios 10? Don't want to accidentally brick my device or anything... Thanks :)

Hello, I would like to know is this compatible with iOS 11.2.6?

I was working on a security research task with my colleague, it's about trying to decrypted a testing app without a given ipa file.

But when we trying to execute command "DYLD_INSERT_LIBRARIES=/path/to/dumpdecrypted.dylib /path/to/executable", we always get "Killed:9" error on terminal.

We tried many solutions like: sign the dylib file before copy it into sandbox by using codesign command on macOS X, change to mobile user before execute command by using su mobile, also we tried the solution in #19, but all we got is still "Killed:9" error.

We try to track the device log to see what actually happened, then we found the error message on device log is "kernel(Sandbox)[0] : Sandbox: hook..execve() killing [pid=5001, uid=0]: only launchd is allowed to spawn untrusted binaries" when we execute command "DYLD_INSERT_LIBRARIES=/path/to/dumpdecrypted.dylib /path/to/executable" everytime.

But both of us are really not good at using macOS X. We still have no idea after tring to find some information, we hope you guys can give us some direction or help.

Thanks for help.

btw, here's our running environment:

macOS X EL Capitan, 10.11.6
Xcode version 8.0(8A218a)
iPhone 7 Plus, iOS 11.2.6, jailbreaked by Electra1131 1.1.0

Discussed previously here:

https://www.reddit.com/r/jailbreakdevelopers/comments/3qvcl9/dump_encrypted_appstore_app_to_be_able_to/

Killed: 9 issue on ios 12.1.1 on iphone 6+

Steps To Reproduce:

1. copy to /usr/lib/.
   # cp dumpdecrypted.dylib into /usr/lib
   Make sure it has appropriate permissions so that user mobile can read and execute it
   -rwxr-xr-x 1 root wheel 214032 Oct 3 16:06 /usr/lib/dumpdecrypted.dylib
2. change user to mobile:
   # su mobile
3. change directory into somewhere that mobile can write to:
   # cd /var/mobile/Documents
4. execute the command with absolute paths:
   # DYLD_INSERT_LIBRARIES=/usr/lib/dumpdecrypted.dylib /var/containers/Bundle/Application/...../MyApp.app/MyApp

running against iOS 12.4.9

Hi,

I successfully compiled it and tried it with an app that was having its cryptic to 0, as expected it has been detected as already decrypted, nothing to do, then i tried on a app with cryptic returning 1, and i got killed: 9.

anIpad:/Applications root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Applications/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX/anApp.app/anApp mach-o decryption dumper
Killed: 9

-9, the suicide signal :( Does this app have a mechanism to kill your process?

Thanks a lot for your time.

IOS7 Support

Why when I try to run "Makefile" in Terminal I have errors?

GCC_BIN: command not found
Downloads/dumpdecrypted-master/Makefile: line 6: CFLAGS: command not found
Downloads/dumpdecrypted-master/Makefile: line 6: SDK: command not found
Downloads/dumpdecrypted-master/Makefile: line 6: SDK: command not found
Downloads/dumpdecrypted-master/Makefile: line 6: SDK: command not found
Downloads/dumpdecrypted-master/Makefile: line 6: GCC_BASE: command not found

I'm getting the following error when I load the library

dyld: lazy symbol binding failed: Symbol not found: ___strlcpy_chk
  Referenced from: dumpdecrypted.dylib
  Expected in: /usr/lib/libSystem.B.dylib

dyld: Symbol not found: ___strlcpy_chk
  Referenced from: dumpdecrypted.dylib
  Expected in: /usr/lib/libSystem.B.dylib

Trace/BPT trap: 5

I'm running XCode 5.1, iOS 7.1 SDK, and using an iPod Touch running iOS 6.1.5

Any suggestions?

...
[+] Dumping FeedbackLogger
[+] detected 64bit ARM binary in memory.
[-] This mach-o file is not encrypted. Nothing was decrypted.

[+] Dumping CoreServicesInternal
[+] detected 64bit ARM binary in memory.
[-] This mach-o file is not encrypted. Nothing was decrypted.
...