ChiChou / bagbak

Yet another frida based iOS dumpdecrypted. Also decrypts app extensions

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

SC_Info and _CodeSignature folders remain in subdirectories

asdfzxcvbn opened this issue · comments

commented

Describe the bug
the SC_Info and _CodeSignature folders are removed from the app root, but are still present in subdirectories. for example, Payload/whatever.app/PlugIns/IntentsExtension.appex/SC_Info may still be present.

To Reproduce

  1. dump an app
  2. check subdirectories

Expected behavior
all SC_Info and _CodeSignature folders are removed.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

  • OS: Arch Linux
  • nodejs: [e.g. v18.16.0]
  • frida on device version
  • iOS and jailbreak version
  • The app you are trying to work on: spotify, discord, etc..

Additional context
Add any other context about the problem here.

commented

fixed for the PlugIns directory! however some frameworks still have the folders.

$ find . -name "SC_Info*"
./Frameworks/IGPyTorchFramework.framework/SC_Info
./Frameworks/FBSharedFramework.framework/SC_Info
./Frameworks/IGInAppPurchaseFramework.framework/SC_Info

$ find . -name "_CodeSignature*"
./Frameworks/IGPyTorchFramework.framework/_CodeSignature
./Frameworks/FBSharedFramework.framework/_CodeSignature
./Frameworks/IGInAppPurchaseFramework.framework/_CodeSignature