Category Archives: RCE

Patch MobileSafari to Open Local File

The MobileSafari comes with iPhone doesn’t allow to open local file, you’ll get the following error when you try to enter a file:/// URL:
Safari can’t open the page because it is a local file.

This can be easily patched. This article describes how to patch MobileSafari to make it open local files (e.g. PDF). I’ll use [...]

Commented SpringBoard Icon List Method Disassembly

This is the full disassembly listing of the icon list retrieving method in SpringBoard 1.1.1, I’ve added the comments to ease the reading. Based on this disassembly listing, it’s easy to create a patch to enable the SpringBoard multipage scrolling.
NOTE: The scrolling feature has already been in the SpringBoard, Apple just didn’t open it to [...]

How AppSupport Patch (1.1.2) Calls External Library

UPDATE: For patched binaries, please check AppSupport Page. This article only analyzes the dynamic library loading mechanism in the patch, not the patch itself.
I’ve decided to reverse the AppSupport patch (for 1.1.2) because I wanna know how it is written, more ever, it was said there’re some tricks inside the code which deals with dynamic [...]

Disassembling Code: IDA Pro And SoftICE

This is a book about code disassembly, it can be used as an entry to reverse code engineering (RCE).
Excerpts from the book preface:

This book is not intended for readers who have no programming experience. If you program in some high-level programming language but are not acquainted with Assembly, you’ll need to consult some [...]

IDA Pro 5.2 is Way Better Than 5.0/5.1

I have been using IDA Pro 5.0/5.1 to disassemble the iPhone apps (with a macho.ldw patched for ARM in Mach-O binaries), it worked great except some instructions could not be recognized/disassembled. However, the condition has changed a lot in IDA Pro 5.2, this version recognizes much more ARM instructions than its precedent versions.
Highlights of [...]