├── APIManager ├── APIManager.h └── APIManager.m ├── Documentation ├── Apple Private APIs.docx └── Private API and Frameworks.pptx ├── LICENSE ├── README.md ├── Research └── PrivateFrameworks │ └── MediaServices │ ├── MSVZipArchive.h │ └── MSVZipArchive.m └── TODO /APIManager/APIManager.h: -------------------------------------------------------------------------------- 1 | #ifndef APIManager_h 2 | #define APIManager_h 3 | #import 4 | 5 | @interface APIManager : NSObject 6 | +(void)dumpAllFromFramework:(NSString*)framework privateFW:(BOOL)pfw; 7 | +(void)dumpClasses; 8 | +(NSArray*)dumpClasses:(NSString*)framework privateFW:(BOOL)pfw; 9 | +(void)dumpMethods:(Class)class; 10 | +(void)dumpProperties:(Class)class; 11 | +(BOOL)loadFW:(NSString*)name; 12 | +(BOOL)loadPFW:(NSString*)name; 13 | @end 14 | #endif /* APIManager_h */ 15 | -------------------------------------------------------------------------------- /APIManager/APIManager.m: -------------------------------------------------------------------------------- 1 | /* 2 | APIManager.m 3 | Created by Sem Voigtländer on 13/12/2017. 4 | Reverse engineering Apple Private APIs is allowed by Apple. 5 | Using code reverse engineered from Private APIs is not recommended as the original code might be licensed. 6 | Providing code reverse engineered from Private APIs might infringe DMCA rights. 7 | */ 8 | 9 | #import 10 | #import 11 | #import 12 | #import 13 | #import 14 | #import "APIManager.h" 15 | 16 | @interface APIManager() 17 | @end 18 | @implementation APIManager 19 | 20 | +(BOOL)loadFW:(NSString*)name { 21 | return [[NSBundle bundleWithPath:[NSString stringWithFormat:@"/System/Library/Frameworks/%@.framework", name]] load]; 22 | } 23 | +(BOOL)loadPFW:(NSString*)name { 24 | return [[NSBundle bundleWithPath:[NSString stringWithFormat:@"/System/Library/PrivateFrameworks/%@.framework", name]] load]; 25 | } 26 | 27 | +(void)dumpClasses { 28 | uint count = 0; 29 | const char **classes; 30 | Dl_info info; 31 | dladdr(&_mh_execute_header, &info); 32 | classes = objc_copyClassNamesForImage(info.dli_fname, &count); 33 | printf("[Classes]\n"); 34 | for (uint i = 0; i < count; i++) { 35 | NSBundle *b = [NSBundle bundleForClass:NSClassFromString([NSString stringWithUTF8String:classes[i]])]; 36 | if(b != [NSBundle mainBundle]) { 37 | NSArray* bundlePath = [[b bundlePath] componentsSeparatedByString:@"/"]; 38 | printf("\t%s:\n\t\t- %s\n",[[bundlePath lastObject] UTF8String], classes[i]); 39 | } 40 | } 41 | } 42 | +(NSArray*)dumpClasses:(NSString*)framework privateFW:(BOOL)pfw{ 43 | uint count = 0; 44 | Class * classes = NULL; 45 | NSString *fwClasses = @""; 46 | count = objc_getClassList(NULL, 0); 47 | if(count > 0) { 48 | printf("[%s Classes]\n", [framework UTF8String]); 49 | classes = (__unsafe_unretained Class *)malloc(sizeof(Class) * count); 50 | count = objc_getClassList(classes, count); 51 | for (uint i = 0; i < count; i++) { 52 | NSBundle *b = [NSBundle bundleForClass:NSClassFromString([NSString stringWithUTF8String:class_getName(classes[i])])]; 53 | NSString* path =[NSString stringWithFormat:@"/System/Library/PrivateFrameworks/%@.framework",framework]; 54 | if(!pfw) { 55 | path = [NSString stringWithFormat:@"/System/Library/Frameworks/%@.framework",framework]; 56 | } 57 | if([[b bundlePath] isEqualToString:path]) { 58 | printf("\t\t- %s\n",class_getName(classes[i])); 59 | fwClasses = [fwClasses stringByAppendingString:[NSString stringWithFormat:@"%@\n", NSStringFromClass(classes[i])]]; 60 | } 61 | } 62 | } else { 63 | printf("No classes found in %s.\n", [framework UTF8String]); 64 | } 65 | return [fwClasses componentsSeparatedByString:@"\n"]; 66 | } 67 | 68 | 69 | +(void)dumpAllFromFramework:(NSString*)framework privateFW:(BOOL)pfw{ 70 | NSArray* classes = [APIManager dumpClasses:framework privateFW:pfw]; 71 | if(classes != nil) { 72 | for(int i = 0; i < classes.count;i++) { 73 | Class c = NSClassFromString(classes[i]); 74 | [APIManager dumpProperties:c]; 75 | [APIManager dumpMethods:c]; 76 | } 77 | } 78 | } 79 | 80 | +(void)dumpMethods:(Class)class { 81 | uint count = 0; 82 | Method* methods = class_copyMethodList(class, &count); 83 | printf("[%s Methods]:\n", class_getName(class)); 84 | for (uint i = 0; i < count; i++) { 85 | Method method = methods[i]; 86 | printf("\t- %s\n", sel_getName(method_getName(method))); 87 | } 88 | } 89 | 90 | +(void)dumpProperties:(Class)class{ 91 | uint count = 0; 92 | objc_property_t *properties = class_copyPropertyList(class, &count); 93 | printf("[%s Properties]:\n", class_getName(class)); 94 | for(uint i = 0; i < count; i++) { 95 | printf("\t- %s\n", property_getName(properties[i])); 96 | } 97 | } 98 | @end 99 | -------------------------------------------------------------------------------- /Documentation/Apple Private APIs.docx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MTJailed/PrivateAPIManager/26fb7345eef1db6db916f71f2953f9677672c91a/Documentation/Apple Private APIs.docx -------------------------------------------------------------------------------- /Documentation/Private API and Frameworks.pptx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MTJailed/PrivateAPIManager/26fb7345eef1db6db916f71f2953f9677672c91a/Documentation/Private API and Frameworks.pptx -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2017 Sem Voigtlander 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # PrivateAPIManager 2 | A project for reverse engineering and using Apple Private APIs 3 | 4 | ## Contents 5 | - APIManager: Tools for reverse engineering Private APIs 6 | - Research: A directory with reverse engineered Frameworks and Libraries 7 | - Documention: Write-up and slides about Apple Private Frameworks 8 | 9 | ## APIManager 10 | - Can dump classes from frameworks 11 | - Can dump methods from a class 12 | - Can dump public properties of a class 13 | - Can detect the parameter types (SOON) 14 | 15 | ## Research 16 | - MediaServices.Framework: 17 | Added PoC for MSVZipArchive, can extract zip archives. 18 | 19 | ## Support 20 | This project is actively managed and pull-requests are more than welcome. 21 | 22 | A pull request can be a PoC of a reversed private API for example. 23 | 24 | A pull request can also be an addition to the APIManager. 25 | 26 | Pull requests are carefully examined and you will get a soon reply when you make one. 27 | -------------------------------------------------------------------------------- /Research/PrivateFrameworks/MediaServices/MSVZipArchive.h: -------------------------------------------------------------------------------- 1 | #import 2 | @interface MSVZExtractor : NSObject 3 | - (BOOL)extract:(NSString*)input to:(NSString*)output; 4 | @end 5 | 6 | -------------------------------------------------------------------------------- /Research/PrivateFrameworks/MediaServices/MSVZipArchive.m: -------------------------------------------------------------------------------- 1 | // 2 | // MSVZExtractor.m 3 | // XTJailed 4 | // 5 | // Created by Sem Voigtländer on 13/12/2017. 6 | // Copyright © 2017 Jailed Inc. All rights reserved. 7 | // 8 | 9 | #import 10 | #import "MSVZipArchive.h" 11 | #import "APIManager.h" 12 | @interface MSVZExtractor() 13 | { 14 | Class MSVZipArchive; //The class you found in the framework 15 | id instance; //So you can get and set the class it's properties (instantiate) 16 | } 17 | @end 18 | 19 | @implementation MSVZExtractor 20 | 21 | 22 | /* 23 | Function: Extracts a zip archive to a directory 24 | PrivateAPI: MediaServices 25 | @param input: Path to the archive to be extracted 26 | @param to: Path to the directory you want the files to be extracted to 27 | @return: True or false, depending on if the extraction succeeds 28 | */ 29 | 30 | - (BOOL)extract:(NSString*)input to:(NSString*)output { 31 | if([APIManager loadPFW:@"MediaServices"]) { 32 | if(!MSVZipArchive) { 33 | MSVZipArchive = NSClassFromString(@"MSVZipArchive"); 34 | } 35 | if(!instance) { 36 | instance = [[MSVZipArchive alloc] init]; 37 | } 38 | [instance setValue:input forKey:@"_archivePath"]; 39 | NSError *extractionError = nil; 40 | [instance decompressToPath:output withError:&extractionError]; 41 | if(extractionError) { 42 | printf("Failed to extract archive: %s\n", [extractionError 43 | .localizedDescription UTF8String]); 44 | return NO; 45 | } 46 | } else { 47 | return NO; 48 | } 49 | return YES; 50 | } 51 | 52 | //Fake Selector 53 | - (void) decompressToPath:(NSString*)outputPath withError:(id*)error{ 54 | 55 | } 56 | 57 | @end 58 | 59 | -------------------------------------------------------------------------------- /TODO: -------------------------------------------------------------------------------- 1 | # What needs to be done 2 | ## Functionality 3 | - Improve verbosity 4 | - Add reverse engineered private APIs 5 | - Add MTFTP for live extraction 6 | - Add improved type checks for parameters 7 | - Add more Example Projects 8 | 9 | ## Security 10 | - Improve input validation 11 | - Improve exception handling 12 | 13 | ## Documentation 14 | - Add more proof-of-concepts 15 | - Fix typos in the documentation 16 | - Add tutorial videos 17 | - Do responsible disclosure to Apple 18 | 19 | --------------------------------------------------------------------------------