Memorydump on Hexploitable

Recent Tool Contributions

Tue, 24 Nov 2015 11:43:52 +0000

So recently I made a couple of minor contributions to online iOS tools. Whilst the contributions are tiny, it was my first experience of actually submitting merge requests to other tools. For this reason I thought I’d share them with you.

1. ipainstaller

One of the changes introduced in iOS 8 was that applications are laid out differently on the device. Essentially, the application exists as multiple containers spread out across the /private/var/mobile/ directory.

MEMSCAN improvements

Thu, 12 Feb 2015 21:51:32 +0000

Improvements to MEMSCAN.

First off, I want to say that I was pretty overwhelmed with the volume of attention MEMSCAN received when I initially blogged about it a little while ago. I really didn’t think it was that big of a deal. I started MEMSCAN for two reasons - there wasn’t anything out there which did /exactly/ what I wanted it to do and also because I wanted to move beyond reading C to actually trying to write some C of my own. The fact that so many people downloaded and have contacted me about MEMSCAN is great and makes me find time to work on it that I didn’t think I had.

Introducing MEMSCAN

Thu, 13 Nov 2014 14:06:05 +0000

MEMSCAN

MEMSCAN is a utility for iOS which I’ve been working on in bits and pieces here and there. I wanted to be able to dump the memory of a given process or to search for certain bytes in memory and get back an address for those bytes. This can be particularly useful when you’re testing an application which uses PIE and the symbols are not available. Using this technique you can look up the method fingerprint (e.g the first 16 bytes) and then get the address of the method.