├── README.md ├── injection ├── ccsnoop.dylib ├── com.apple.CommCenterClassic.plist ├── injectCommCenter.sh └── ccsnoop.c └── LICENSE /README.md: -------------------------------------------------------------------------------- 1 | ios 2 | === 3 | 4 | Fun with iOS 5 | -------------------------------------------------------------------------------- /injection/ccsnoop.dylib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lightbulbone/ios/HEAD/injection/ccsnoop.dylib -------------------------------------------------------------------------------- /injection/com.apple.CommCenterClassic.plist: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lightbulbone/ios/HEAD/injection/com.apple.CommCenterClassic.plist -------------------------------------------------------------------------------- /injection/injectCommCenter.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | echo "Removing old logs..." 4 | rm -f /var/wireless/Library/Logs/ccsnoop.log 5 | 6 | echo "Saving default plist..." 7 | cp /System/Library/LaunchDaemons/com.apple.CommCenterClassic.plist /System/Library/LaunchDaemons/com.apple.CommCenterClassic.plist.vanilla 8 | 9 | echo "Moving injection plist into place..." 10 | cp /tmp/com.apple.CommCenterClassic.plist /System/Library/LaunchDaemons/com.apple.CommCenterClassic.plist 11 | 12 | # Restart CommCenter 13 | echo "Unloading CommCenterClassic..." 14 | launchctl unload -w /System/Library/LaunchDaemons/com.apple.CommCenterClassic.plist 15 | echo "Loading CommCenterClassic..." 16 | launchctl load -w /System/Library/LaunchDaemons/com.apple.CommCenterClassic.plist 17 | 18 | echo "Restoring original plist..." 19 | cp /System/Library/LaunchDaemons/com.apple.CommCenterClassic.plist.vanilla /System/Library/LaunchDaemons/com.apple.CommCenterClassic.plist 20 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright (c) 2013, LightBulbOne 2 | All rights reserved. 3 | 4 | Redistribution and use in source and binary forms, with or without modification, 5 | are permitted provided that the following conditions are met: 6 | 7 | Redistributions of source code must retain the above copyright notice, this 8 | list of conditions and the following disclaimer. 9 | 10 | Redistributions in binary form must reproduce the above copyright notice, this 11 | list of conditions and the following disclaimer in the documentation and/or 12 | other materials provided with the distribution. 13 | 14 | Neither the name of the {organization} nor the names of its 15 | contributors may be used to endorse or promote products derived from 16 | this software without specific prior written permission. 17 | 18 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 19 | ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 20 | WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 21 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR 22 | ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 23 | (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 24 | LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 25 | ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 | (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 27 | SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 | -------------------------------------------------------------------------------- /injection/ccsnoop.c: -------------------------------------------------------------------------------- 1 | /* file: ccsnoop.c 2 | * 3 | * author: lightbulbone 4 | * description: log communication between CommCenter and whatever it talks to 5 | * 6 | * compilation: 7 | * 1. Set environment variable ARM_CC= 8 | * 2. Set environment variable SYSROOT= 9 | * 3. Compile 10 | * 11 | * For example: 12 | * bash $ export ARM_CC=/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/usr/bin/arm-apple-darwin10-llvm-gcc-4.2 13 | * bash $ export SYSROOT=/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS6.1.sdk/ 14 | * bash $ ${ARM_CC} -Wall -dynamiclib -isysroot ${SYSROOT} -o ccsnoop.dylib ccsnoop.c 15 | * 16 | */ 17 | 18 | /* Copyright (c) 2013, LightBulbOne 19 | * All rights reserved. 20 | * 21 | * Redistribution and use in source and binary forms, with or without 22 | * modification, are permitted provided that the following conditions 23 | * are met: 24 | * 25 | * 1. Redistributions of source code must retain the above copyright notice, 26 | * this list of conditions and the following disclaimer. 27 | * 2. Redistributions in binary form must reproduce the above copyright 28 | * notice, this list of conditions and the following disclaimer in the 29 | * documentation and/or other materials provided with the distribution. 30 | * 3. Neither the name of the LightBulbOne nor the names of its contributors 31 | * may be used to endorse or promote products derived from this software 32 | * without specific prior written permission. 33 | * 34 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 35 | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 36 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 37 | * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 38 | * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 39 | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 40 | * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 41 | * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 42 | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 43 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 44 | * POSSIBILITY OF SUCH DAMAGE. 45 | */ 46 | 47 | #include 48 | #include 49 | #include 50 | #include 51 | #include 52 | #include 53 | #include 54 | 55 | const char *logPath = "/var/wireless/Library/Logs/ccsnoop.log"; 56 | FILE *logFile = NULL; 57 | 58 | typedef struct interposer_s { 59 | void* new_func; 60 | void* origin_func; 61 | } interposer_t; 62 | 63 | int ccs_open(const char *, int, mode_t); 64 | int ccs_close(int); 65 | int ccs_read(int, void *, int); 66 | int ccs_write(int, void *, int); 67 | 68 | static const interposer_t interposers[] __attribute__ ((section("__DATA, __interpose"))) = 69 | { 70 | { (void *)ccs_open, (void *)open }, 71 | { (void *)ccs_close, (void *)close}, 72 | { (void *)ccs_read, (void *)read}, 73 | { (void *)ccs_write, (void *)write}, 74 | }; 75 | 76 | void ccs_log(const char *fmt, ...) 77 | { 78 | va_list fp; 79 | 80 | if(logFile == NULL) { 81 | logFile = fopen(logPath, "a*"); 82 | if(!logFile) 83 | return; 84 | } 85 | 86 | va_start(fp, fmt); 87 | vfprintf(logFile, fmt, fp); 88 | 89 | fflush(logFile); 90 | } 91 | 92 | int ccs_open(const char *path, int flags, mode_t mode) 93 | { 94 | ccs_log("open [%s]\n", path); 95 | 96 | int ret = open(path, flags, mode); 97 | return ret; 98 | } 99 | 100 | int ccs_close(int fd) 101 | { 102 | char filePath[PATH_MAX]; 103 | if (fcntl(fd, F_GETPATH, filePath) != -1) 104 | { 105 | ccs_log("close [%s]\n", filePath); 106 | } 107 | 108 | int ret = close(fd); 109 | return ret; 110 | } 111 | 112 | int ccs_read(int fd, void *buffer, int nbytes) 113 | { 114 | int ret = read(fd, buffer, nbytes); 115 | 116 | char filePath[PATH_MAX]; 117 | if (fcntl(fd, F_GETPATH, filePath) != -1) 118 | { 119 | ccs_log("read [%s] %d bytes => %s\n", filePath, nbytes, (char *)buffer); 120 | } 121 | else 122 | { 123 | ccs_log("read [UNKNOWN] %d bytes => %s\n", nbytes, (char *)buffer); 124 | } 125 | 126 | return ret; 127 | } 128 | 129 | int ccs_write(int fd, void *buffer, int nbyte) 130 | { 131 | int ret = write(fd, buffer, nbyte); 132 | 133 | char filePath[PATH_MAX]; 134 | if (fcntl(fd, F_GETPATH, filePath) != -1) 135 | { 136 | ccs_log("write [%s] %d bytes => %s\n", filePath, nbyte, (char *)buffer); 137 | } 138 | else 139 | { 140 | ccs_log("write [UNKNOWN] %d bytes => %s\n", nbyte, (char *)buffer); 141 | } 142 | 143 | return ret; 144 | } 145 | --------------------------------------------------------------------------------