ChiChou / bagbak

Yet another frida based iOS dumpdecrypted. Also decrypts app extensions

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Unhandled exception: Suspicious path detected

ZonD80 opened this issue · comments

Describe the bug
There is unhandled exception that fails dumping process of extensions, leads that app can't be dumped.

To Reproduce
bagbak -z --override com.Yooshr.Infltr

https://apps.apple.com/ru/app/infltr-infinite-filters/id935623257?l=en

Expected behavior
Guess skipping of system extensions, as looks like BTAvrcp is related to bluetooth daemon

Screenshots
If applicable, add screenshots to help explain your problem.
image

Desktop (please complete the following information):

  • OS: Any
  • nodejs: Any
  • frida-node: Any
  • frida on device version Any
  • 12.4.7 checkra1n
  • com.Yooshr.Infltr

This is a strange test case that triggered an assertion error. All paths are expected to be inside the app bundle, but there is a /usr/sbin/BTAvrcp in this particular app. I'll investigate this

Before I fix this problem by migrating to mremap_encrypted and on-device packaging, I recommend FlexDecrypt. The problem is that it can only decrypt executables one by one, not to mention generating a ipa archive.

I made a VSCode plugin that provides friendly GUI and wraps FlexDecrypt command to pull decrypted ipa from jailbroken iDevice:

https://github.com/ChiChou/vscode-frida/raw/593583cd257394eeb67840d2e3b0e7860887c993/resources/doc/flexdecrypt.png

Please check it out here https://github.com/ChiChou/vscode-frida

Hi. Any news?

@ZonD80 it should be working now

Thank you! Will test on Monday